Release/0.8.17 by tschm · Pull Request #956 · Jebel-Quant/rhiza

tschm · 2026-03-31T04:45:51Z

Summary

uv bumped to v0.11.2 across all workflows and pre-commit hooks (was 0.10.12)
Cross-platform CI: test job now runs on ubuntu-latest, macos-latest, and windows-latest (matrix expanded from Ubuntu-only)
Link checker: New rhiza_link_check.yml workflow added using lychee to validate README links on push/schedule
Security target: Makefile gains a security target that runs pip-audit (ignoring CVE-2026-4539 — pygments ReDoS, no fix yet) and bandit
Pre-commit updates: ruff bumped to v0.15.8, check-jsonschema to v0.37.1; recipe/meta.yaml excluded from check-yaml
Cleanup: Deleted test_marimushka.py integration test (93 lines removed)

…5.8 (#922) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>

#925) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

…a to v0.37.1 (#923) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

* Update uv version and CI configuration for multiple OS Updated the version of 'uv' to 0.11.2 and modified the CI configuration to support multiple OS environments. Signed-off-by: Thomas Schmelzer <thomas.schmelzer@gmail.com> * ci: add windows-latest to test matrix Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Signed-off-by: Thomas Schmelzer <thomas.schmelzer@gmail.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

* Initial plan * feat: exclude recipe/meta.yaml from check-yaml pre-commit hook Agent-Logs-Url: https://github.com/Jebel-Quant/rhiza/sessions/8878e3cd-5e8f-4fa3-900d-f982d2b10c1e Co-authored-by: tschm <2046079+tschm@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: tschm <2046079+tschm@users.noreply.github.com>

* Initial plan * feat: add rhiza_link_check.yml workflow for README link validation Co-authored-by: tschm <2046079+tschm@users.noreply.github.com> Agent-Logs-Url: https://github.com/Jebel-Quant/rhiza/sessions/6368d0b0-6f68-44fd-98b5-69ec6e3c05ce * fix: override security target to ignore CVE-2026-4539 (pygments, no fix available) Co-authored-by: tschm <2046079+tschm@users.noreply.github.com> Agent-Logs-Url: https://github.com/Jebel-Quant/rhiza/sessions/e4ab7930-2fd3-476d-921b-51925a0a5644 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: tschm <2046079+tschm@users.noreply.github.com> Co-authored-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>

Signed-off-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>

…scanning (#914) * Initial plan * feat: add license make target to quality.mk for license compliance scanning Agent-Logs-Url: https://github.com/Jebel-Quant/rhiza/sessions/bdf9ab08-8cb0-4fbd-8650-c27028fe69af Co-authored-by: tschm <2046079+tschm@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: tschm <2046079+tschm@users.noreply.github.com> Co-authored-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>

Copilot

Pull request overview

This PR prepares the 0.8.17 release by updating the repo’s tooling versions and CI workflows, expanding CI to multiple OSes, and adding a scheduled README link-check workflow.

Changes:

Bump uv (and related pre-commit tool versions) across CI/workflows and hooks.
Expand CI test matrix to run on Ubuntu/macOS/Windows and tighten coverage upload conditions.
Add a new README link-check workflow (Lychee) and add a make security override to ignore a specific CVE.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
`Makefile`	Adds a repo-owned `security` target overriding template behavior to ignore CVE-2026-4539 during `pip-audit`.
`.rhiza/tests/integration/test_marimushka.py`	Removes the marimushka integration test file.
`.pre-commit-config.yaml`	Updates ruff/check-jsonschema/uv hook revisions and excludes `recipe/meta.yaml` from `check-yaml`.
`.github/workflows/rhiza_validate.yml`	Bumps `uv` version used in validation workflow.
`.github/workflows/rhiza_typecheck.yml`	Bumps `uv` version used in typecheck workflow.
`.github/workflows/rhiza_semgrep.yml`	Bumps `uv` version used in Semgrep workflow.
`.github/workflows/rhiza_security.yml`	Bumps `uv` version used in security workflow (which runs `make security`).
`.github/workflows/rhiza_release.yml`	Bumps `uv` version used in release workflow.
`.github/workflows/rhiza_pip_audit.yml`	Bumps `uv` version used in the weekly `pip-audit` workflow.
`.github/workflows/rhiza_marimo.yml`	Bumps `uv` version used in marimo workflow.
`.github/workflows/rhiza_link_check.yml`	Adds new Lychee-based workflow to validate `README.md` links on push/PR/schedule.
`.github/workflows/rhiza_license.yml`	Bumps `uv` version used in license workflow.
`.github/workflows/rhiza_deptry.yml`	Bumps `uv` version used in deptry workflow.
`.github/workflows/rhiza_dep_compat_test.yml`	Bumps `uv` version used in dependency-compat workflow.
`.github/workflows/rhiza_ci.yml`	Bumps `uv` and expands test job to an OS matrix (Ubuntu/macOS/Windows).
`.github/workflows/rhiza_book.yml`	Bumps `uv` and updates `actions/deploy-pages` version.
`.github/workflows/rhiza_benchmarks.yml`	Bumps `uv` version used in benchmarks workflow.
`.github/workflows/copilot-setup-steps.yml`	Bumps `uv` version used in Copilot setup workflow.

Copilot · 2026-03-31T04:51:20Z

Makefile

+# Override pip-audit to ignore CVE-2026-4539 (pygments ReDoS, no fix available yet)
+.PHONY: security
+security: install ## run security scans (pip-audit and bandit)
+	@printf "${BLUE}[INFO] Running pip-audit for dependency vulnerabilities...${RESET}\n"
+	@${UVX_BIN} pip-audit --ignore-vuln CVE-2026-4539
+	@printf "${BLUE}[INFO] Running bandit security scan...${RESET}\n"
+	@${UVX_BIN} bandit -r ${SOURCE_FOLDER} -ll -q -c pyproject.toml


This redefines the existing security target that already comes from .rhiza/make.d/test.mk, which will cause GNU Make “overriding recipe for target 'security'” warnings and makes it unclear which implementation is authoritative. Prefer updating the upstream security recipe to accept an ignore list (e.g., via a variable like PIP_AUDIT_ARGS) rather than overriding the whole target in the repo-owned Makefile.

Copilot · 2026-03-31T04:51:21Z

.github/workflows/rhiza_ci.yml

    strategy:
      matrix:
        python-version: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
+        os: [ubuntu-latest, macos-latest, windows-latest]


The test job now runs on windows-latest, but the workflow still runs make test with the default shell (PowerShell on Windows). This will likely fail because make and the Makefile recipes assume a POSIX shell/tools (sh, rm, find, etc.). Consider setting defaults.run.shell: bash for the job and installing a GNU make + coreutils environment on Windows (e.g., via MSYS2), or excluding Windows until the toolchain is provisioned.

Suggested change

os: [ubuntu-latest, macos-latest, windows-latest]

os: [ubuntu-latest, macos-latest]

Copilot · 2026-03-31T04:51:22Z

.github/workflows/rhiza_pip_audit.yml

+          version: "0.11.2"

      - name: Run pip-audit
        run: uvx pip-audit


make security now ignores CVE-2026-4539 due to no available fix, but this scheduled workflow still runs uvx pip-audit without that ignore. That will keep the weekly job failing/noisy until the CVE is resolved. Align this workflow with the Makefile (add --ignore-vuln CVE-2026-4539, or invoke a dedicated Make target that applies the ignore list).

Suggested change

run: uvx pip-audit

run: uvx pip-audit --ignore-vuln CVE-2026-4539

Copilot · 2026-03-31T04:51:22Z

.github/workflows/rhiza_link_check.yml

+
+on:
+  push:
+    branches: [main]


This workflow’s push trigger is limited to branches: [main], but other Rhiza workflows consistently support both main and master (e.g., .github/workflows/rhiza_validate.yml:7-10, .github/workflows/rhiza_ci.yml:17-20). Consider changing this to branches: [ main, master ] for consistency and compatibility with repos still using master.

Suggested change

branches: [main]

branches: [ main, master ]

* refactor: move .semgrep.yml to .rhiza/semgrep.yml Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: add paper, presentations, and devcontainer docs from main Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: delete REPOSITORY_ANALYSIS.md Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * refactor: consolidate CI workflows from main Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: sync .pre-commit-config.yaml and GitLab CI from origin/main Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: remove deprecated `.claude/plan.md` and `.claude/quality.md` files * chore: sync .gitlab/README.md from origin/main Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Chore: bump version 0.8.17 → 0.8.18 * chore: update template-bundles.yml to replace deprecated workflows wi… (#959) * chore: update template-bundles.yml to replace deprecated workflows with `rhiza_quality.yml` * chore: simplify CI trigger by removing branch restrictions * chore: remove branch restrictions from GitHub Actions triggers * fix: update broken markdown links to correct file paths Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * paper.mk * chore: remove `--exclude-mail` flag from link checker configuration * chore: remove branch restrictions from `rhiza_validate.yml` trigger * chore: update `.rhiza/template-bundles.yml` to replace outdated workflow references with `.rhiza/semgrep.yml` * chore: remove `rhiza_pip_audit.yml` from template-bundles.yml * chore: remove `rhiza_security.yml` from template-bundles.yml * chore: remove event-based restrictions from `rhiza_validate.yml` triggers * chore: consolidate `license` and `semgrep` checks into `rhiza_validate.yml` and remove standalone workflows * feat: add GitLab CI workflows for link checking and paper compilation Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Chore: bump version 0.8.18 → 0.8.19 --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

renovate bot and others added 9 commits March 31, 2026 08:35

chore(deps): update pre-commit hook astral-sh/ruff-pre-commit to v0.1…

3f26648

…5.8 (#922) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>

chore(deps): update pre-commit hook astral-sh/uv-pre-commit to v0.11.2 (

fdb1990

#925) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>

chore(deps): update actions/deploy-pages action to v5 (#926)

f59a3f3

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update pre-commit hook python-jsonschema/check-jsonschem…

141e700

…a to v0.37.1 (#923) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update dependency astral-sh/uv to v0.11.2 (#924)

0d97779

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Delete .rhiza/tests/integration/test_marimushka.py (#915)

e662e33

Signed-off-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>

Copilot AI review requested due to automatic review settings March 31, 2026 04:45

Copilot started reviewing on behalf of tschm March 31, 2026 04:46 View session

Copilot AI reviewed Mar 31, 2026

View reviewed changes

Chore: bump version 0.8.16 → 0.8.17

9e54455

tschm temporarily deployed to release March 31, 2026 04:54 — with GitHub Actions Inactive

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Release/0.8.17#956

Release/0.8.17#956
tschm wants to merge 12 commits intomainfrom
release/0.8.17

tschm commented Mar 31, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 31, 2026

Uh oh!

Copilot AI Mar 31, 2026

Uh oh!

Copilot AI Mar 31, 2026

Uh oh!

Copilot AI Mar 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	os: [ubuntu-latest, macos-latest, windows-latest]
	os: [ubuntu-latest, macos-latest]

	run: uvx pip-audit
	run: uvx pip-audit --ignore-vuln CVE-2026-4539

Conversation

tschm commented Mar 31, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants