Add test, pre-commit, uv-lock-check, and dependency-update workflows

.github/workflows/dependency-update.yml

@@ -0,0 +1,97 @@
+name: Weekly dependency update
+
+# Refreshes the uv lockfiles once a week and opens a single PR if anything
+# changed, so dependency bumps get reviewed on their own rather than riding
+# along with feature work. Uses a 7-day supply-chain quarantine (packages
+# published in the last week are excluded) to avoid pulling brand-new releases.
+# Simplified to uv-only (this repo has no npm/Makefile).
+
+on:
+  schedule:
+    - cron: "0 9 * * 1" # Every Monday at 09:00 UTC
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: dependency-update
+  cancel-in-progress: true
+
+jobs:
+  update-lockfiles:
+    name: Update uv lockfiles
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: write # push the update branch
+      pull-requests: write # open the PR
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: Compute 7-day cutoff timestamp
+        id: cutoff
+        run: |
+          CUTOFF=$(date -u -d '7 days ago' +%Y-%m-%dT%H:%M:%SZ)
+          echo "timestamp=$CUTOFF" >> "$GITHUB_OUTPUT"
+          echo "date=$(date -u -d '7 days ago' +%Y-%m-%d)" >> "$GITHUB_OUTPUT"
+          echo "Cutoff: $CUTOFF (packages published after this are excluded)"
+
+      - name: Refresh lockfiles (7-day quarantine)
+        env:
+          UV_EXCLUDE_NEWER: ${{ steps.cutoff.outputs.timestamp }}
+        run: |
+          for proj in benchmarks self-hosted/vllm; do
+            echo "==== uv lock --upgrade in $proj ===="
+            ( cd "$proj" && uv lock --upgrade ) || echo "WARNING: uv lock failed in $proj; continuing."
+          done
+
+      - name: Detect changes
+        id: diff
+        run: |
+          if git diff --quiet -- '**/uv.lock'; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            echo "No lockfile changes."
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            {
+              echo "## Weekly dependency update"
+              echo ""
+              echo "uv lockfiles refreshed with a 7-day supply-chain quarantine (packages published after ${{ steps.cutoff.outputs.date }} excluded)."
+              echo ""
+              echo "Changed lockfiles:"
+              git diff --name-only -- '**/uv.lock' | sed 's/^/- /'
+            } > /tmp/pr_body.md
+          fi
+
+      - name: Create pull request
+        if: steps.diff.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          BRANCH="chore/dependency-update-$(date +%Y-%m-%d)"
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          # Checkout used persist-credentials: false, so re-point origin at a
+          # token-authenticated URL for both git push and the gh CLI.
+          git remote set-url origin \
+            "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+          git checkout -b "$BRANCH"
+          git add '**/uv.lock'
+          git commit -m "chore(deps): weekly uv lockfile update ($(date +%Y-%m-%d))"
+          git push -u --force origin "$BRANCH"
+
+          if gh pr view "$BRANCH" --json number >/dev/null 2>&1; then
+            echo "PR already exists for $BRANCH; branch updated."
+          else
+            gh pr create \
+              --title "chore(deps): weekly uv lockfile update ($(date +%Y-%m-%d))" \
+              --body-file /tmp/pr_body.md \
+              --base main
+          fi

.github/workflows/pre-commit.yml

@@ -0,0 +1,31 @@
+name: pre-commit
+
+# Runs the repo's pre-commit hooks (ruff lint + format, plus whitespace / EOF /
+# merge-conflict / YAML hygiene) on every PR, so style and formatting stay
+# consistent without relying on contributors having the hooks installed locally.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  pre-commit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - uses: pre-commit/action@v3.0.1

.github/workflows/test.yml

@@ -0,0 +1,69 @@
+name: Test
+
+# The PR merge gate. For each uv project it installs deps and runs the same
+# checks we run locally (see each project's dev-workflow docs and the top-level
+# CLAUDE.md): ruff lint, mypy on the type-checked modules, and the unittest
+# suite. Kept in sync with what contributors run by hand before committing.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: "Test: ${{ matrix.name }}"
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: benchmarks
+            dir: benchmarks
+            # Modules with clean type annotations; matches the documented
+            # dev-workflow mypy target so CI does not fail on never-checked files.
+            mypy: scripts/dataset_loader.py scripts/runner_config.py
+          - name: self-hosted-vllm
+            dir: self-hosted/vllm
+            mypy: ""
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+          # Full history: build_vended_models.py stamps models.json's
+          # measured_on from the frontier JSON's last commit date, and
+          # test_build_vended_models.py checks the committed file still matches
+          # what the generator produces. A shallow clone cannot see that commit,
+          # so the generator falls back to the checkout mtime and the test fails
+          # on every PR regardless of whether the file is actually stale.
+          fetch-depth: 0
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: Sync dependencies
+        working-directory: ${{ matrix.dir }}
+        run: uv sync
+
+      - name: Ruff lint
+        working-directory: ${{ matrix.dir }}
+        run: uv run ruff check .
+
+      - name: Mypy
+        if: matrix.mypy != ''
+        working-directory: ${{ matrix.dir }}
+        run: uv run mypy ${{ matrix.mypy }}
+
+      - name: Unit tests
+        working-directory: ${{ matrix.dir }}
+        run: uv run python -m unittest discover -s tests

.github/workflows/uv-lock-check.yml

@@ -0,0 +1,55 @@
+name: uv.lock freshness check
+
+# Fails a PR whose pyproject.toml changed without a matching `uv lock`, so the
+# committed lockfiles never drift out of sync with their dependency specs.
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - '**/pyproject.toml'
+      - '**/uv.lock'
+      - '.github/workflows/uv-lock-check.yml'
+  push:
+    branches: [main]
+    paths:
+      - '**/pyproject.toml'
+      - '**/uv.lock'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lock-check:
+    name: "Lock check: ${{ matrix.project }}"
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    strategy:
+      fail-fast: false
+      matrix:
+        project:
+          - benchmarks
+          - self-hosted/vllm
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: Verify uv.lock is in sync with pyproject.toml
+        working-directory: ${{ matrix.project }}
+        run: |
+          echo "Checking ${{ matrix.project }}/uv.lock ..."
+          if ! uv lock --check; then
+            echo "::error::uv.lock in ${{ matrix.project }}/ is out of sync with pyproject.toml."
+            echo "::error::Run 'uv lock' in that directory and commit the updated uv.lock."
+            exit 1
+          fi

.pre-commit-config.yaml

@@ -0,0 +1,41 @@
+# Pre-commit hooks for this repo. Run locally with `pre-commit run --all-files`
+# after `pip install pre-commit` (or `uv tool install pre-commit`); the
+# pre-commit.yml workflow runs the same hooks on every PR.
+#
+# Ruff lints and formats the Python in both uv projects (benchmarks/ and
+# self-hosted/vllm/). The generic hooks catch whitespace, end-of-file, merge
+# markers, and unparseable YAML before they land.
+
+default_language_version:
+  python: python3
+
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: trailing-whitespace
+        # Vendored chat templates are byte-for-byte copies of an upstream model's
+        # template (plus a documented patch). Their whitespace IS the prompt, so
+        # reformatting them would silently change what the model is sent.
+        exclude: '^self-hosted/vllm/config/.*\.jinja$'
+      - id: end-of-file-fixer
+        # Same reason, and sharper here: text after a template's final tag is
+        # literal output, so appending a newline appends one to every rendered
+        # prompt -- diverging the committed file from the one the benchmark ran.
+        exclude: '^self-hosted/vllm/config/.*\.jinja$'
+      - id: check-merge-conflict
+      - id: check-yaml
+      # Raised to 1536 KB so the self-contained slide decks (HTML with
+      # base64-embedded charts, ~1.3 MB) can be committed as single portable
+      # files. Still low enough to catch accidental large binaries/artifacts.
+      - id: check-added-large-files
+        args: ["--maxkb=1536"]
+
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.14.0
+    hooks:
+      - id: ruff
+        name: ruff (lint)
+        args: ["--fix"]
+      - id: ruff-format
+        name: ruff (format)

AGENTS.md

@@ -22,9 +22,9 @@ They are large, generated, or irrelevant to code changes — walking them wastes
 
 When a task is unscoped, the source worth reading lives under:
 
-- `self-hosted/` — the vLLM and Ollama self-hosting paths (scripts, model docs, clients)
-- `benchmarks/` — harness scripts, datasets, and runner config
-- `bedrock/` — Bedrock proxy setup (LiteLLM config, scripts)
+- `self-hosted/vllm/` — the vLLM self-hosting path (scripts, model guides, clients)
+- `benchmarks/` — harness scripts, datasets, runner config, and docs
+- `vend/swe-router/` — the vendored model-selection skill
 - top-level `README.md` and each subdirectory's `README.md`
 
 ## Conventions