feat: Woodpecker CI pipeline + Forgejo PyPI publishing

forgejo_admin commented

2026-03-01 06:28:56 +00:00

Contributor

Summary

Add Woodpecker CI pipeline with lint, test, and publish steps
Add ruff config to pyproject.toml and fix all lint/format issues across 17 files
Verified Forgejo PyPI smoke test: twine upload and pip install both succeed

Changes

.woodpecker.yml: New 3-step CI pipeline (lint, test, publish to Forgejo PyPI)
pyproject.toml: Added [tool.ruff] section (Python 3.10+, line-length 120, E/F/W/I rules)
src/woodpecker_sdk/client.py: Broke long method signatures across multiple lines (E501)
src/woodpecker_sdk/{cron_jobs,organizations,pipelines,repo_registries,repo_secrets,repositories,secrets,users}.py: Ruff format fixes (line wrapping, dict formatting)
tests/test_{agents,debug,organizations,pipeline_queues,pipelines,repositories,system}.py: Import sorting (I001), unused import removal (F401), format fixes

Test Plan

Push triggers lint + test steps in Woodpecker CI
Lint step passes (ruff check + format verified locally -- all clean)
Test step passes with Woodpecker secrets injected (woodpecker_url, woodpecker_token)
After merge to main: publish step runs and pushes to Forgejo PyPI
Manual smoke test passed: twine upload to Forgejo succeeded, pip install --extra-index-url resolves correctly

Review Checklist

Passed automated review-fix loop
No secrets committed
No unnecessary file changes
Commit messages are descriptive

issue-woodpecker-sdk-pypi-pipeline -- the issue this PR addresses
plan-2026-02-28-woodpecker-sdk-mcp -- Phase 2: Forgejo PyPI registry + Woodpecker CI pipeline

## Summary - Add Woodpecker CI pipeline with lint, test, and publish steps - Add ruff config to pyproject.toml and fix all lint/format issues across 17 files - Verified Forgejo PyPI smoke test: twine upload and pip install both succeed ## Changes - `.woodpecker.yml`: New 3-step CI pipeline (lint, test, publish to Forgejo PyPI) - `pyproject.toml`: Added `[tool.ruff]` section (Python 3.10+, line-length 120, E/F/W/I rules) - `src/woodpecker_sdk/client.py`: Broke long method signatures across multiple lines (E501) - `src/woodpecker_sdk/{cron_jobs,organizations,pipelines,repo_registries,repo_secrets,repositories,secrets,users}.py`: Ruff format fixes (line wrapping, dict formatting) - `tests/test_{agents,debug,organizations,pipeline_queues,pipelines,repositories,system}.py`: Import sorting (I001), unused import removal (F401), format fixes ## Test Plan - [ ] Push triggers lint + test steps in Woodpecker CI - [ ] Lint step passes (ruff check + format verified locally -- all clean) - [ ] Test step passes with Woodpecker secrets injected (woodpecker_url, woodpecker_token) - [ ] After merge to main: publish step runs and pushes to Forgejo PyPI - [ ] Manual smoke test passed: `twine upload` to Forgejo succeeded, `pip install --extra-index-url` resolves correctly ## Review Checklist - [ ] Passed automated review-fix loop - [ ] No secrets committed - [ ] No unnecessary file changes - [ ] Commit messages are descriptive ## Related Notes - `issue-woodpecker-sdk-pypi-pipeline` -- the issue this PR addresses - `plan-2026-02-28-woodpecker-sdk-mcp` -- Phase 2: Forgejo PyPI registry + Woodpecker CI pipeline

forgejo_admin added 1 commit

2026-03-01 06:28:56 +00:00

feat: add Woodpecker CI pipeline and ruff linting f24fcf27f5

Add .woodpecker.yml with lint, test, build, and publish steps.
Add ruff config to pyproject.toml and fix all lint/format issues.
Publish step pushes to Forgejo's built-in PyPI registry.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

forgejo_admin added 1 commit

2026-03-01 06:30:21 +00:00

fix: use from_secret syntax and add event filters in pipeline

ci/woodpecker/push/woodpecker Pipeline failed

Details

ci/woodpecker/pr/woodpecker Pipeline failed

Details

ccad6eb9f4

Replace deprecated `secrets` shorthand with `environment`/`from_secret`.
Add workflow-level event filter and use $$ escaping for secret env vars.
Fixes Woodpecker deprecation errors that prevented pipeline execution.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

forgejo_admin commented

2026-03-01 06:30:27 +00:00

Author

Contributor

Review-fix round 1:

Pipeline #1 and #2 errored due to deprecated secrets shorthand syntax. Woodpecker now requires environment with from_secret instead.

Changes in commit ccad6eb:

Replaced secrets: [woodpecker_url, woodpecker_token] with explicit environment/from_secret mappings
Replaced secrets: [forgejo_publish_user, forgejo_publish_token] with explicit environment/from_secret mappings
Added workflow-level when event filter to suppress "bad_habit" linter warnings
Used $$ escaping for secret env vars in the twine upload command per Woodpecker docs

**Review-fix round 1:** Pipeline #1 and #2 errored due to deprecated `secrets` shorthand syntax. Woodpecker now requires `environment` with `from_secret` instead. Changes in commit ccad6eb: - Replaced `secrets: [woodpecker_url, woodpecker_token]` with explicit `environment`/`from_secret` mappings - Replaced `secrets: [forgejo_publish_user, forgejo_publish_token]` with explicit `environment`/`from_secret` mappings - Added workflow-level `when` event filter to suppress "bad_habit" linter warnings - Used `$$` escaping for secret env vars in the twine upload command per Woodpecker docs

forgejo_admin added 1 commit

2026-03-01 06:32:16 +00:00

fix: move branch and ref to optional fields in Feed schema

ci/woodpecker/push/woodpecker Pipeline was successful

Details

ci/woodpecker/pr/woodpecker Pipeline was successful

Details

b5203f0a71

The Woodpecker API does not always include branch/ref in feed items
(e.g. pull_request events). Move them from required to optional fields
to match actual API behavior and unblock CI.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

forgejo_admin commented

2026-03-01 06:32:22 +00:00

Author

Contributor

Review-fix round 2:

Pipeline #3 showed 65 passed, 1 failed, 4 skipped. The single failure was test_get_user_feed -- a pre-existing test bug where branch and ref were marked as required Feed fields, but the Woodpecker API omits them from certain event types (e.g. pull_request).

Changes in commit b5203f0:

Moved branch and ref from FEED_REQUIRED_FIELDS to FEED_OPTIONAL_FIELDS in tests/test_user.py
This matches the actual Woodpecker API behavior

**Review-fix round 2:** Pipeline #3 showed 65 passed, 1 failed, 4 skipped. The single failure was `test_get_user_feed` -- a pre-existing test bug where `branch` and `ref` were marked as required Feed fields, but the Woodpecker API omits them from certain event types (e.g. pull_request). Changes in commit b5203f0: - Moved `branch` and `ref` from `FEED_REQUIRED_FIELDS` to `FEED_OPTIONAL_FIELDS` in `tests/test_user.py` - This matches the actual Woodpecker API behavior

forgejo_admin commented

2026-03-01 06:40:57 +00:00

Author

Contributor

PR #6 Review

Reviewer: QA Agent (fresh context)
Branch: 5-forgejo-pypi-registry-woodpecker-ci-pipe -> main
Plan: plan-2026-02-28-woodpecker-sdk-mcp -- Phase 2

BLOCKERS

None.

NITS

Pip install overhead per step. Each step (lint, test, build, publish) runs pip install from scratch since they use separate containers. This is functionally correct (Woodpecker shares workspace, not the Python environment), but future optimization could use a custom image with pre-installed tools or pip caching to speed up CI runs. Non-blocking -- the current approach is clear and simple.
Hardcoded Forgejo URL in pipeline. The twine upload command contains the literal URL https://forgejo.tail5b443a.ts.net/api/packages/forgejo_admin/pypi. If the Forgejo instance URL ever changes, this must be updated manually. Consider extracting to a secret (e.g., forgejo_publish_url) for future reusability across repos. Non-blocking -- the plan explicitly notes this is the first pipeline and will become a template.
No --non-interactive flag on twine. If twine ever prompts for input (e.g., package already exists at that version), the CI step would hang. Adding --non-interactive or --skip-existing would make the publish step more resilient. Non-blocking -- manual version bumping is the current decision per the plan.

SOP COMPLIANCE

Branch named after issue number -- Branch 5-forgejo-pypi-registry-woodpecker-ci-pipe references Forgejo issue #5.
PR body follows template-pr-body -- All required sections present: Summary, Changes, Test Plan, Review Checklist, Related Notes.
Related Notes references plan slug -- PR body references plan-2026-02-28-woodpecker-sdk-mcp (Phase 2) and issue-woodpecker-sdk-pypi-pipeline.
Tests exist and pass -- 70 existing integration tests unmodified in intent; lint fixes are formatting-only. Test schema fix (branch/ref moved to optional) is a legitimate correctness fix.
No secrets, .env files, or credentials committed -- All secrets use Woodpecker's from_secret injection. No .env, .pypirc, or credential files in repo. .gitignore is clean.
No unnecessary file changes (scope creep) -- All 19 changed files are in scope: 1 new pipeline file, 1 pyproject.toml ruff config addition, 17 source/test files with ruff formatting fixes. The branch/ref Feed schema fix is directly related (discovered during CI test runs).
Commit messages are descriptive -- Three commits with clear conventional-commit prefixes: feat: for the pipeline, fix: for the from_secret syntax correction, fix: for the Feed schema field move. Each describes what changed and why.

CODE QUALITY

.woodpecker.yml: Correct Woodpecker v2 syntax. from_secret used properly for secret injection. $$ escaping for shell-time variable expansion is correct. when conditions properly gate build and publish to push on main only. Lint and test run on all events (push + PR).
pyproject.toml ruff config: Matches the plan decision (colocated in pyproject.toml, no standalone ruff.toml). Rule selection ["E", "F", "W", "I"] is appropriate (pycodestyle errors/warnings, pyflakes, import sorting). target-version = "py310" matches requires-python = ">=3.10".
Source formatting changes: All changes are mechanical ruff reformatting -- line wrapping for E501, dict formatting, import sorting (I001), unused import removal (F401). No behavioral changes.
Test changes: Import sorting, unused pytest import removal in files that don't use pytest.mark or pytest.skip. The test_user.py Feed schema change moving branch and ref from required to optional is a correctness fix (the Woodpecker API can return Feed entries without these fields).

SECURITY

No hardcoded credentials anywhere.
Forgejo internal URL (forgejo.tail5b443a.ts.net) is on Tailnet -- not publicly accessible. Acceptable in pipeline config.
from_secret is the correct mechanism for Woodpecker secret injection.

VERDICT: APPROVED

The PR cleanly implements Phase 2 of the plan: a 4-step Woodpecker CI pipeline (lint, test, build, publish) and ruff linting configuration. All changes are in scope, secrets are handled properly, the PR body follows the template, and commit messages are descriptive. The nits are non-blocking optimization suggestions for future iterations.

## PR #6 Review **Reviewer:** QA Agent (fresh context) **Branch:** `5-forgejo-pypi-registry-woodpecker-ci-pipe` -> `main` **Plan:** `plan-2026-02-28-woodpecker-sdk-mcp` -- Phase 2 --- ### BLOCKERS None. --- ### NITS 1. **Pip install overhead per step.** Each step (`lint`, `test`, `build`, `publish`) runs `pip install` from scratch since they use separate containers. This is functionally correct (Woodpecker shares workspace, not the Python environment), but future optimization could use a custom image with pre-installed tools or pip caching to speed up CI runs. Non-blocking -- the current approach is clear and simple. 2. **Hardcoded Forgejo URL in pipeline.** The twine upload command contains the literal URL `https://forgejo.tail5b443a.ts.net/api/packages/forgejo_admin/pypi`. If the Forgejo instance URL ever changes, this must be updated manually. Consider extracting to a secret (e.g., `forgejo_publish_url`) for future reusability across repos. Non-blocking -- the plan explicitly notes this is the first pipeline and will become a template. 3. **No `--non-interactive` flag on twine.** If twine ever prompts for input (e.g., package already exists at that version), the CI step would hang. Adding `--non-interactive` or `--skip-existing` would make the publish step more resilient. Non-blocking -- manual version bumping is the current decision per the plan. --- ### SOP COMPLIANCE - [x] **Branch named after issue number** -- Branch `5-forgejo-pypi-registry-woodpecker-ci-pipe` references Forgejo issue #5. - [x] **PR body follows `template-pr-body`** -- All required sections present: Summary, Changes, Test Plan, Review Checklist, Related Notes. - [x] **Related Notes references plan slug** -- PR body references `plan-2026-02-28-woodpecker-sdk-mcp` (Phase 2) and `issue-woodpecker-sdk-pypi-pipeline`. - [x] **Tests exist and pass** -- 70 existing integration tests unmodified in intent; lint fixes are formatting-only. Test schema fix (`branch`/`ref` moved to optional) is a legitimate correctness fix. - [x] **No secrets, .env files, or credentials committed** -- All secrets use Woodpecker's `from_secret` injection. No `.env`, `.pypirc`, or credential files in repo. `.gitignore` is clean. - [x] **No unnecessary file changes (scope creep)** -- All 19 changed files are in scope: 1 new pipeline file, 1 pyproject.toml ruff config addition, 17 source/test files with ruff formatting fixes. The `branch`/`ref` Feed schema fix is directly related (discovered during CI test runs). - [x] **Commit messages are descriptive** -- Three commits with clear conventional-commit prefixes: `feat:` for the pipeline, `fix:` for the `from_secret` syntax correction, `fix:` for the Feed schema field move. Each describes what changed and why. ### CODE QUALITY - **`.woodpecker.yml`**: Correct Woodpecker v2 syntax. `from_secret` used properly for secret injection. `$$` escaping for shell-time variable expansion is correct. `when` conditions properly gate `build` and `publish` to `push` on `main` only. Lint and test run on all events (push + PR). - **`pyproject.toml` ruff config**: Matches the plan decision (colocated in pyproject.toml, no standalone ruff.toml). Rule selection `["E", "F", "W", "I"]` is appropriate (pycodestyle errors/warnings, pyflakes, import sorting). `target-version = "py310"` matches `requires-python = ">=3.10"`. - **Source formatting changes**: All changes are mechanical ruff reformatting -- line wrapping for E501, dict formatting, import sorting (I001), unused import removal (F401). No behavioral changes. - **Test changes**: Import sorting, unused `pytest` import removal in files that don't use `pytest.mark` or `pytest.skip`. The `test_user.py` Feed schema change moving `branch` and `ref` from required to optional is a correctness fix (the Woodpecker API can return Feed entries without these fields). ### SECURITY - No hardcoded credentials anywhere. - Forgejo internal URL (`forgejo.tail5b443a.ts.net`) is on Tailnet -- not publicly accessible. Acceptable in pipeline config. - `from_secret` is the correct mechanism for Woodpecker secret injection. --- ### VERDICT: APPROVED The PR cleanly implements Phase 2 of the plan: a 4-step Woodpecker CI pipeline (lint, test, build, publish) and ruff linting configuration. All changes are in scope, secrets are handled properly, the PR body follows the template, and commit messages are descriptive. The nits are non-blocking optimization suggestions for future iterations.

forgejo_admin added 1 commit

2026-03-01 06:45:17 +00:00

fix: harden CI publish step — extract URL secret, add non-interactive flag, merge build+publish

ci/woodpecker/push/woodpecker Pipeline was successful

Details

ci/woodpecker/pr/woodpecker Pipeline was successful

Details

c78bd38a84

- Extract hardcoded Forgejo PyPI URL into `forgejo_pypi_url` secret for portability
- Add `--non-interactive` flag to twine to prevent CI hangs
- Merge build and publish into a single step to reduce pip install overhead

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

forgejo_admin commented

2026-03-01 06:45:30 +00:00

Author

Contributor

Nit fixes applied (Phase 2)

Three nits addressed in commit c78bd38:

1. Hardcoded Forgejo URL extracted to secret

The publish step previously had https://forgejo.tail5b443a.ts.net/api/packages/forgejo_admin/pypi hardcoded in the twine command. This has been replaced with a FORGEJO_PYPI_URL environment variable sourced from the new global secret forgejo_pypi_url (already created in Woodpecker). The pipeline is now portable across Forgejo instances.

2. Added `--non-interactive` flag to twine

The twine upload command now includes --non-interactive to prevent twine from ever hanging on input prompts in CI.

3. Merged build and publish into a single step

The separate build and publish steps have been combined into one publish step. Since publish depends on the dist/ artifacts from build, merging them avoids a redundant pip install and keeps the artifacts in the same workspace. Lint and test remain as separate steps.

## Nit fixes applied (Phase 2) Three nits addressed in commit `c78bd38`: ### 1. Hardcoded Forgejo URL extracted to secret The publish step previously had `https://forgejo.tail5b443a.ts.net/api/packages/forgejo_admin/pypi` hardcoded in the twine command. This has been replaced with a `FORGEJO_PYPI_URL` environment variable sourced from the new global secret `forgejo_pypi_url` (already created in Woodpecker). The pipeline is now portable across Forgejo instances. ### 2. Added `--non-interactive` flag to twine The `twine upload` command now includes `--non-interactive` to prevent twine from ever hanging on input prompts in CI. ### 3. Merged build and publish into a single step The separate `build` and `publish` steps have been combined into one `publish` step. Since publish depends on the `dist/` artifacts from build, merging them avoids a redundant `pip install` and keeps the artifacts in the same workspace. Lint and test remain as separate steps.

forgejo_admin commented

2026-03-01 06:47:49 +00:00

Author

Contributor

PR #6 Review (Round 2)

BLOCKERS

None.

NITS

PR body says "4-step CI pipeline" but .woodpecker.yml has 3 steps. The Summary and Changes sections both reference "4-step CI pipeline (lint, test, build, publish)" but the implementation correctly merged build+publish into a single publish step. The PR body text should say "3-step" to match reality. Non-blocking -- the implementation is the correct choice.
Ruff version not pinned in CI. The lint step runs pip install ruff without a version pin. A future ruff release could introduce new rules or change formatting behavior, causing CI to fail on code that hasn't changed. Consider pip install ruff==0.9.x (or whatever current version is). This is standard CI hygiene but non-blocking for initial merge.
twine upload will fail on re-publish of same version. If the publish step runs on a main push but the version in pyproject.toml hasn't been bumped, twine upload will fail because Forgejo's PyPI registry rejects duplicate versions. The plan acknowledges "manual version bumping (for now)" but there's no guard in the pipeline (e.g., twine upload --skip-existing or a version-check step). This is acceptable for v1 since the team knows to bump versions, but worth noting. Non-blocking.

SOP COMPLIANCE

Branch named after issue: 5-forgejo-pypi-registry-woodpecker-ci-pipe -- starts with issue number 5, follows convention.
PR body follows template-pr-body: All five required sections present (Summary, Changes, Test Plan, Review Checklist, Related Notes).
Related Notes references plan slug: plan-2026-02-28-woodpecker-sdk-mcp and issue-woodpecker-sdk-pypi-pipeline both present.
Tests exist and pass: 70 integration tests from Phase 1 remain. No new tests needed for pipeline config (CI pipeline is the test). Feed schema fix (branch/ref moved to optional) is a correctness fix validated against the live API.
No secrets committed: All credentials use Woodpecker from_secret directives. No .env, .pypirc, or credential files in the repo. $$ escaping used correctly in twine command to prevent Woodpecker from logging secrets.
No unnecessary file changes (scope creep): All 19 changed files are either: (a) new pipeline config, (b) ruff config addition, (c) ruff auto-format fixes, or (d) the Feed schema correctness fix. All are within Phase 2 scope.
Commit messages are descriptive: 4 commits with clear conventional-commit prefixes (feat:, fix:) describing exactly what changed.

CODE QUALITY NOTES

Pipeline structure is sound. The when event filter at top level plus the per-step when on publish correctly gates publishing to main-only pushes. Secrets are properly injected via environment + from_secret.
Ruff config is appropriate. py310 target matches requires-python = ">=3.10". Rule selection (E, F, W, I) covers pycodestyle errors/warnings, pyflakes, and isort -- good baseline without being overly aggressive.
Format changes are mechanical and correct. All src/ changes are ruff-driven line wrapping (E501) and dict formatting. All test changes are import sorting (I001), unused import removal (F401 -- pytest removed from files that don't use it directly since it's picked up via conftest), and string concatenation flattening.
Feed schema fix is correct. Moving branch and ref from required to optional in tests/test_user.py matches the Woodpecker API's actual behavior where these fields can be absent.

VERDICT: APPROVED

Clean implementation of Phase 2. The pipeline follows the plan's spec (with the reasonable optimization of merging build+publish). No secrets exposed, no scope creep, SOP compliance is complete. The three nits are all non-blocking suggestions for future improvement.

## PR #6 Review (Round 2) ### BLOCKERS None. ### NITS 1. **PR body says "4-step CI pipeline" but `.woodpecker.yml` has 3 steps.** The Summary and Changes sections both reference "4-step CI pipeline (lint, test, build, publish)" but the implementation correctly merged build+publish into a single `publish` step. The PR body text should say "3-step" to match reality. Non-blocking -- the implementation is the correct choice. 2. **Ruff version not pinned in CI.** The lint step runs `pip install ruff` without a version pin. A future ruff release could introduce new rules or change formatting behavior, causing CI to fail on code that hasn't changed. Consider `pip install ruff==0.9.x` (or whatever current version is). This is standard CI hygiene but non-blocking for initial merge. 3. **`twine upload` will fail on re-publish of same version.** If the publish step runs on a main push but the version in `pyproject.toml` hasn't been bumped, `twine upload` will fail because Forgejo's PyPI registry rejects duplicate versions. The plan acknowledges "manual version bumping (for now)" but there's no guard in the pipeline (e.g., `twine upload --skip-existing` or a version-check step). This is acceptable for v1 since the team knows to bump versions, but worth noting. Non-blocking. ### SOP COMPLIANCE - [x] **Branch named after issue:** `5-forgejo-pypi-registry-woodpecker-ci-pipe` -- starts with issue number `5`, follows convention. - [x] **PR body follows `template-pr-body`:** All five required sections present (Summary, Changes, Test Plan, Review Checklist, Related Notes). - [x] **Related Notes references plan slug:** `plan-2026-02-28-woodpecker-sdk-mcp` and `issue-woodpecker-sdk-pypi-pipeline` both present. - [x] **Tests exist and pass:** 70 integration tests from Phase 1 remain. No new tests needed for pipeline config (CI pipeline is the test). Feed schema fix (`branch`/`ref` moved to optional) is a correctness fix validated against the live API. - [x] **No secrets committed:** All credentials use Woodpecker `from_secret` directives. No `.env`, `.pypirc`, or credential files in the repo. `$$` escaping used correctly in twine command to prevent Woodpecker from logging secrets. - [x] **No unnecessary file changes (scope creep):** All 19 changed files are either: (a) new pipeline config, (b) ruff config addition, (c) ruff auto-format fixes, or (d) the Feed schema correctness fix. All are within Phase 2 scope. - [x] **Commit messages are descriptive:** 4 commits with clear conventional-commit prefixes (`feat:`, `fix:`) describing exactly what changed. ### CODE QUALITY NOTES - **Pipeline structure is sound.** The `when` event filter at top level plus the per-step `when` on publish correctly gates publishing to main-only pushes. Secrets are properly injected via `environment` + `from_secret`. - **Ruff config is appropriate.** `py310` target matches `requires-python = ">=3.10"`. Rule selection (`E`, `F`, `W`, `I`) covers pycodestyle errors/warnings, pyflakes, and isort -- good baseline without being overly aggressive. - **Format changes are mechanical and correct.** All src/ changes are ruff-driven line wrapping (E501) and dict formatting. All test changes are import sorting (I001), unused import removal (F401 -- `pytest` removed from files that don't use it directly since it's picked up via conftest), and string concatenation flattening. - **Feed schema fix is correct.** Moving `branch` and `ref` from required to optional in `tests/test_user.py` matches the Woodpecker API's actual behavior where these fields can be absent. ### VERDICT: APPROVED Clean implementation of Phase 2. The pipeline follows the plan's spec (with the reasonable optimization of merging build+publish). No secrets exposed, no scope creep, SOP compliance is complete. The three nits are all non-blocking suggestions for future improvement.

forgejo_admin added 1 commit

2026-03-01 06:51:06 +00:00

fix: pin ruff==0.15.2 in CI lint step

ci/woodpecker/push/woodpecker Pipeline was successful

Details

ci/woodpecker/pr/woodpecker Pipeline was successful

Details

23084047e8

Avoid non-deterministic lint failures from unpinned ruff version.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

forgejo_admin commented

2026-03-01 06:51:15 +00:00

Author

Contributor

Nit fixes applied (review round 2):

PR body: "4-step" -> "3-step" -- The build step was merged into the publish step in commit c78bd38, but the PR body still referenced a "4-step CI pipeline". Updated the PR body to accurately say "3-step" and removed the separate "build" mention from the Changes and Test Plan sections.
Pin ruff version in CI -- Changed pip install ruff to pip install ruff==0.15.2 in .woodpecker.yml to avoid non-deterministic lint failures from unpinned dependency. Version matches what is currently installed locally.

**Nit fixes applied (review round 2):** 1. **PR body: "4-step" -> "3-step"** -- The build step was merged into the publish step in commit `c78bd38`, but the PR body still referenced a "4-step CI pipeline". Updated the PR body to accurately say "3-step" and removed the separate "build" mention from the Changes and Test Plan sections. 2. **Pin ruff version in CI** -- Changed `pip install ruff` to `pip install ruff==0.15.2` in `.woodpecker.yml` to avoid non-deterministic lint failures from unpinned dependency. Version matches what is currently installed locally.

forgejo_admin commented

2026-03-01 06:53:06 +00:00

Author

Contributor

PR #6 Review (Round 3)

BLOCKERS

None.

NITS

Ruff version pin could be fresher (non-blocking): .woodpecker.yml pins ruff==0.15.2 (released 2026-02-19). The latest is 0.15.4 (released 2026-02-26). Not a blocker since 0.15.2 is valid and stable, but worth updating when convenient.
$$ env-var syntax in twine command: Line 28 of .woodpecker.yml uses $$FORGEJO_PYPI_URL, $$FORGEJO_PUBLISH_USER, $$FORGEJO_PUBLISH_TOKEN. The $$ prefix is the correct Woodpecker syntax for referencing environment variables defined via from_secret in the same step's environment block -- this is correct. Just noting for future readers that $$ prevents Woodpecker from interpreting $ as a pipeline substitution variable.
Publish step re-installs build + twine on every main push: A minor CI runtime cost. Could be optimized with a custom image later, but perfectly fine for the initial pipeline pattern.

SOP COMPLIANCE

Branch named after issue: Branch is 5-forgejo-pypi-registry-woodpecker-ci-pipe -- follows {issue-num}-{slug} convention.
PR body follows template-pr-body: All five required sections present: Summary, Changes, Test Plan, Review Checklist, Related Notes.
Related Notes references plan slug: PR body includes plan-2026-02-28-woodpecker-sdk-mcp and issue-woodpecker-sdk-pypi-pipeline.
Tests exist and pass: 70 integration tests exist. Pipeline includes test step with secrets injection.
No secrets committed: No .env files, credentials, or tokens found in the diff. All sensitive values use from_secret in the pipeline. .gitignore excludes common sensitive patterns.
No unnecessary file changes (scope creep): All 19 changed files are within scope. The ruff formatting fixes across SDK source and test files are a natural consequence of adding the linter -- not scope creep.
Commit messages are descriptive: Five commits on this branch, all properly prefixed (feat:, fix:) with clear descriptions:
- feat: add Woodpecker CI pipeline and ruff linting
- fix: use from_secret syntax and add event filters in pipeline
- fix: move branch and ref to optional fields in Feed schema
- fix: harden CI publish step -- extract URL secret, add non-interactive flag, merge build+publish
- fix: pin ruff==0.15.2 in CI lint step

CODE REVIEW

.woodpecker.yml (new file, 38 lines):

Three-step pipeline (lint, test, publish) matches the plan specification exactly.
when block at top correctly triggers on push and pull_request events.
Publish step correctly gated to event: push, branch: main only.
Secrets injected via environment + from_secret -- correct Woodpecker syntax.
--non-interactive flag on twine prevents hangs in CI -- good practice.

pyproject.toml changes:

Ruff config colocated as specified in the plan's decisions table ("No standalone ruff.toml").
target-version = "py310" matches requires-python = ">=3.10" -- consistent.
Rule selection ["E", "F", "W", "I"] covers pycodestyle errors, pyflakes, pycodestyle warnings, and isort -- reasonable baseline.

Source file changes (8 files):

All changes are mechanical ruff formatting: line wrapping of long method signatures, dict formatting across multiple lines. No behavioral changes.
Formatting is consistent and improves readability.

Test file changes (7 files):

Import sorting fixes (I001), unused import removals (F401: pytest removed from test_organizations.py, test_repositories.py).
Assertion string concatenation simplified (parenthesized multi-line f-strings collapsed to single-line where they fit within 120 chars).
test_user.py: branch and ref moved from required to optional Feed fields -- this is a bug fix for a schema mismatch against the actual API, not a formatting change. Correctly addressed.

No security concerns: No hardcoded secrets, no credential files, no suspicious patterns.

VERDICT: APPROVED

Clean PR. The pipeline matches the Phase 2 specification from plan-2026-02-28-woodpecker-sdk-mcp. All SOP compliance checks pass. Code changes are well-scoped -- a new CI pipeline file, colocated ruff config, and the mechanical formatting fixes that follow from introducing the linter. The Feed schema fix (branch/ref to optional) is a legitimate correctness improvement discovered during this work. No blockers.

## PR #6 Review (Round 3) ### BLOCKERS None. ### NITS 1. **Ruff version pin could be fresher (non-blocking):** `.woodpecker.yml` pins `ruff==0.15.2` (released 2026-02-19). The latest is 0.15.4 (released 2026-02-26). Not a blocker since 0.15.2 is valid and stable, but worth updating when convenient. 2. **`$$` env-var syntax in twine command:** Line 28 of `.woodpecker.yml` uses `$$FORGEJO_PYPI_URL`, `$$FORGEJO_PUBLISH_USER`, `$$FORGEJO_PUBLISH_TOKEN`. The `$$` prefix is the correct Woodpecker syntax for referencing environment variables defined via `from_secret` in the same step's `environment` block -- this is correct. Just noting for future readers that `$$` prevents Woodpecker from interpreting `$` as a pipeline substitution variable. 3. **Publish step re-installs build + twine on every main push:** A minor CI runtime cost. Could be optimized with a custom image later, but perfectly fine for the initial pipeline pattern. ### SOP COMPLIANCE - [x] **Branch named after issue:** Branch is `5-forgejo-pypi-registry-woodpecker-ci-pipe` -- follows `{issue-num}-{slug}` convention. - [x] **PR body follows `template-pr-body`:** All five required sections present: Summary, Changes, Test Plan, Review Checklist, Related Notes. - [x] **Related Notes references plan slug:** PR body includes `plan-2026-02-28-woodpecker-sdk-mcp` and `issue-woodpecker-sdk-pypi-pipeline`. - [x] **Tests exist and pass:** 70 integration tests exist. Pipeline includes test step with secrets injection. - [x] **No secrets committed:** No `.env` files, credentials, or tokens found in the diff. All sensitive values use `from_secret` in the pipeline. `.gitignore` excludes common sensitive patterns. - [x] **No unnecessary file changes (scope creep):** All 19 changed files are within scope. The ruff formatting fixes across SDK source and test files are a natural consequence of adding the linter -- not scope creep. - [x] **Commit messages are descriptive:** Five commits on this branch, all properly prefixed (`feat:`, `fix:`) with clear descriptions: - `feat: add Woodpecker CI pipeline and ruff linting` - `fix: use from_secret syntax and add event filters in pipeline` - `fix: move branch and ref to optional fields in Feed schema` - `fix: harden CI publish step -- extract URL secret, add non-interactive flag, merge build+publish` - `fix: pin ruff==0.15.2 in CI lint step` ### CODE REVIEW **`.woodpecker.yml` (new file, 38 lines):** - Three-step pipeline (lint, test, publish) matches the plan specification exactly. - `when` block at top correctly triggers on `push` and `pull_request` events. - Publish step correctly gated to `event: push, branch: main` only. - Secrets injected via `environment` + `from_secret` -- correct Woodpecker syntax. - `--non-interactive` flag on twine prevents hangs in CI -- good practice. **`pyproject.toml` changes:** - Ruff config colocated as specified in the plan's decisions table ("No standalone ruff.toml"). - `target-version = "py310"` matches `requires-python = ">=3.10"` -- consistent. - Rule selection `["E", "F", "W", "I"]` covers pycodestyle errors, pyflakes, pycodestyle warnings, and isort -- reasonable baseline. **Source file changes (8 files):** - All changes are mechanical ruff formatting: line wrapping of long method signatures, dict formatting across multiple lines. No behavioral changes. - Formatting is consistent and improves readability. **Test file changes (7 files):** - Import sorting fixes (I001), unused import removals (F401: `pytest` removed from `test_organizations.py`, `test_repositories.py`). - Assertion string concatenation simplified (parenthesized multi-line f-strings collapsed to single-line where they fit within 120 chars). - `test_user.py`: `branch` and `ref` moved from required to optional Feed fields -- this is a bug fix for a schema mismatch against the actual API, not a formatting change. Correctly addressed. **No security concerns:** No hardcoded secrets, no credential files, no suspicious patterns. ### VERDICT: APPROVED Clean PR. The pipeline matches the Phase 2 specification from `plan-2026-02-28-woodpecker-sdk-mcp`. All SOP compliance checks pass. Code changes are well-scoped -- a new CI pipeline file, colocated ruff config, and the mechanical formatting fixes that follow from introducing the linter. The Feed schema fix (`branch`/`ref` to optional) is a legitimate correctness improvement discovered during this work. No blockers.

forgejo_admin merged commit 0556e6985d into main

2026-03-01 06:54:47 +00:00

forgejo_admin deleted branch 5-forgejo-pypi-registry-woodpecker-ci-pipe

2026-03-01 06:54:47 +00:00

forgejo_admin referenced this pull request from a commit

2026-03-01 06:54:48 +00:00

feat: Woodpecker CI pipeline + Forgejo PyPI publishing (#6)

Rows
Columns

feat: Woodpecker CI pipeline + Forgejo PyPI publishing #6

Summary

Changes

Test Plan

Review Checklist

Related Notes

PR #6 Review

BLOCKERS

NITS

SOP COMPLIANCE

CODE QUALITY

SECURITY

VERDICT: APPROVED

Nit fixes applied (Phase 2)

1. Hardcoded Forgejo URL extracted to secret

2. Added --non-interactive flag to twine

3. Merged build and publish into a single step

PR #6 Review (Round 2)

BLOCKERS

NITS

SOP COMPLIANCE

CODE QUALITY NOTES

VERDICT: APPROVED

PR #6 Review (Round 3)

BLOCKERS

NITS

SOP COMPLIANCE

CODE REVIEW

VERDICT: APPROVED

2. Added `--non-interactive` flag to twine