Fix the silently failing Python security scan, add Dependabot, align type stubs with the runtime - #52
Merged
Conversation
…stubs with the runtime
The Python dependency scan has exited 1 on every run since 0.8.0 switched it to
`safety scan`: Safety 3 demands an interactive login ("Please login or register
Safety CLI ... EOF when reading a line"), and the step's continue-on-error hid
the failure, so no Python advisories have actually been checked. Replace it
with `uv export` of the locked, hashed dependency set plus `uvx pip-audit
--disable-pip`, which needs no account and audits exactly the pins in uv.lock.
CodeQL moves to codeql-action v4 (v3 is deprecated December 2026), and a
Dependabot config watches Cargo.lock, uv.lock and the Actions pins weekly with
minor/patch updates grouped per ecosystem.
The type stubs named parameters the runtime does not accept: `evaluate(
expression, context)` where PyO3 exposes `(src, evaluation_context)`, and
`add_function(name, func)` where the runtime has `function`. A keyword call
that type-checked failed at runtime with TypeError and the working spelling
failed to type-check. The stub now mirrors the runtime, and a new test parses
cel.pyi and compares every declared signature with inspect.signature of the
extension, so the two cannot drift again.
Context.variables and Context.functions, which the class docstring has
documented as attributes all along, now exist as read-only getters returning
fresh dicts.
Also removes cel.evaluation_modes (dead since the evaluation-mode feature was
removed in 0.5.2) and docs/requirements.txt (Read the Docs and the README use
the docs dependency group), fixes the README licence line and the mkdocs
site_url, and adds Python version and Typing :: Typed classifiers.
Claude-Session: https://claude.ai/code/session_019WbvXZFm8Nb2LXF2kiWoWW
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3f3cde1ae5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Dependabot's uv updater usually touches only uv.lock when it bumps a version already allowed by pyproject.toml, so the push filter that lists pyproject.toml and the Cargo files would have skipped the audit of exactly the change it is meant to check, leaving it to the weekly schedule. Claude-Session: https://claude.ai/code/session_019WbvXZFm8Nb2LXF2kiWoWW
hardbyte
pushed a commit
that referenced
this pull request
Sep 14, 2026
Resolves the CHANGELOG Unreleased conflict with #52 by folding the import fix into the shared Fixed section. Claude-Session: https://claude.ai/code/session_019WbvXZFm8Nb2LXF2kiWoWW
hardbyte
pushed a commit
that referenced
this pull request
Sep 14, 2026
Resolves the CHANGELOG Unreleased conflict with #52; src/context.rs merged cleanly (the getters sit alongside the cache-invalidating mutators). Claude-Session: https://claude.ai/code/session_019WbvXZFm8Nb2LXF2kiWoWW
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Three things found while triaging the repo, none of them visible from a green CI badge:
uvx safety scanends withPlease login or register Safety CLI ... Unhandled exception happened: EOF when reading a lineand exit code 1 (see the latest Security run);continue-on-error: trueturns that into a green step. Safety 3 requires an account, so no Python advisories have been checked for the last two releases.cel.pyideclaresevaluate(expression, context)andadd_function(name, func); PyO3 exposesevaluate(src, evaluation_context)andadd_function(name, function).evaluate(expression="1+1")type-checks and fails at runtime withTypeError;evaluate(src="1+1")works and fails to type-check.Context.variables/Context.functionswere documented but didn't exist. The class docstring has listed them under Attributes since the beginning;ctx.variablesraisedAttributeError.What
security.yml:uv export --all-groups --no-emit-projectwrites the locked, hashed dependency set;uvx pip-audit --disable-pipaudits exactly those pins. No account needed; verified locally (No known vulnerabilities found). CodeQL action v3 → v4 (v3 is deprecated December 2026)..github/dependabot.yml: weekly forcargo,uvandgithub-actions, with minor/patch bumps grouped per ecosystem so it is one review a week, and majors kept separate since cel-rust majors need a changelog entry.cel.pyinow mirrors the runtime names, andContext(variables, functions)acceptsfunctionspositionally as the runtime does. Newtests/test_type_stubs.pyparses the stub and compares every declared signature againstinspect.signatureof the extension objects, and checks every public runtime member is declared, so this can't drift again silently.Context.variablesandContext.functionsgetters return fresh dicts (variables through the same CEL→Python conversion as results, so a tuple reads back as a list; functions as the registered callables). Tests intests/test_context.py.cel.evaluation_modes(dead since 0.5.2 removed the feature; nothing imports it) anddocs/requirements.txt(RTD and the README both use thedocsdependency group).mkdocs.ymlsite_urlpointed at a 404 host; pyproject gains Python 3.11–3.14 andTyping :: Typedclassifiers.Verification
pytest 541 passed, 1 skipped, 5 xfailed;
ruff check/ruff format --check; mypy;uvx ty checkon a probe file using the new stub names and getters;cargo fmt --check,cargo clippy -D warnings; both workflow files anddependabot.ymlparse as YAML.Independent of #44 and #51 apart from a trivial CHANGELOG Unreleased-section conflict with whichever merges first.
https://claude.ai/code/session_019WbvXZFm8Nb2LXF2kiWoWW
Generated by Claude Code