fix: REUSE compliance and basedpyright errors on main#15
Conversation
REUSE compliance (was failing on main): - Extend REUSE.toml to cover the 15 previously unannotated files: .cruft.json, .darglint, .dockerignore, .env.example, .infisical.json, .markdownlint.json, .mutmut_config, .prettierrc, .shellcheckrc, .yamllint, Dockerfile, uv.lock, .claude/settings.local.json.example, .claude/**/*.py, and scripts/README.md. - Change documentation glob from "*.md" to "**/*.md" so nested READMEs (e.g. scripts/README.md) are covered without per-file listing. - Remove the three unreferenced license texts (LICENSES/Apache-2.0.txt, BSD-3-Clause.txt, GPL-3.0-or-later.txt) — nothing in the repo declared these, so they tripped the "unused licenses" check. They can be re-added if a file later adopts one of them. basedpyright (was reporting 5 errors with [api] extras installed): - src/foundry_unify/api/health.py: switch ReadinessCheck's optional fields from Field(None, ...) to Field(default=None, ...) so the type checker recognises the default and stops requiring "error" at every call site. - src/foundry_unify/middleware/correlation.py: type call_next as Callable[[Request], Awaitable[Response]] (matches Starlette's RequestResponseEndpoint). The previous Callable[[Request], Response] was both an incompatible override of BaseHTTPMiddleware.dispatch and the reason `await call_next(request)` was flagged as not awaitable. - src/foundry_unify/middleware/security.py: Starlette's MutableHeaders has no .pop(); use a case-insensitive containment check followed by del to strip the Server header. Verified locally: reuse lint clean (156/156 files), basedpyright src/ clean (0 errors), ruff check + format clean. https://claude.ai/code/session_015Zx4CpQVNSvskJhJXT5v3q
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (7)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
✅ FIPS Compatibility Check
Status: ✅ PASSED What is FIPS?FIPS 140-2/140-3 is a US government standard for cryptographic modules. Common issues:
|
There was a problem hiding this comment.
Pull request overview
Companion cleanup to PR #14 that fixes two long-standing CI failures on main: REUSE compliance violations and basedpyright type errors. The changes are non-functional housekeeping.
Changes:
- Fix REUSE compliance by annotating previously-uncovered config/dotfiles in
REUSE.tomland deleting three unreferenced license texts (Apache-2.0,BSD-3-Clause,GPL-3.0-or-later). - Fix basedpyright errors in
api/health.pyby usingField(default=None, ...)for optional fields. - Fix basedpyright errors in middleware: correct
call_nextsignature toCallable[[Request], Awaitable[Response]]inCorrelationMiddleware.dispatch, and replace unsupportedMutableHeaders.pop()with a case-insensitivedelinSecurityHeadersMiddleware.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| src/foundry_unify/api/health.py | Switch ReadinessCheck optional fields to explicit Field(default=None, ...) to satisfy basedpyright. |
| src/foundry_unify/middleware/correlation.py | Add Awaitable import and correct call_next type so await call_next(request) type-checks. |
| src/foundry_unify/middleware/security.py | Replace response.headers.pop("Server", None) (unsupported on MutableHeaders) with conditional del. |
| REUSE.toml | Cover newly listed dotfiles/build files, include .claude/**/*.py, and broaden docs glob to **/*.md. |
| LICENSES/Apache-2.0.txt | Delete unreferenced license text. |
| LICENSES/BSD-3-Clause.txt | Delete unreferenced license text. |
| LICENSES/GPL-3.0-or-later.txt | Delete unreferenced license text. |
|
Summary
Companion cleanup PR to #14. Two long-standing CI failures live on
mainand have nothing to do with the security/docs hardening in #14, so they are addressed here separately to keep each diff reviewable.REUSE compliance
reuse lintfails onmainwith two classes of issue:.cruft.json,.darglint,.dockerignore,.env.example,.infisical.json,.markdownlint.json,.mutmut_config,.prettierrc,.shellcheckrc,.yamllint),Dockerfile,uv.lock,.claude/settings.local.json.example, the Claude skills Python script, andscripts/README.md.LICENSES/:Apache-2.0.txt,BSD-3-Clause.txt,GPL-3.0-or-later.txt. No file in the repo declares any of them.Fixes:
REUSE.tomlto cover each newly listed dotfile/build file, plus.claude/settings.local.json.example.".claude/**/*.py"to the MIT source-code annotation so the planning-doc validator script is covered."*.md"to"**/*.md"so nested READMEs (e.g.scripts/README.md) are picked up without per-file listing — the existing!LICENSES/*.txtexclusion still keeps license texts out.basedpyright
uv run basedpyright src/with the[api]extras installed reports five concrete errors onmain:api/health.py:91, 122—ReadinessCheck(...)calls without anerrorargument are flagged becauseField(None, ...)is read by the type checker as "no default provided." Switching the optional fields toField(default=None, ...)makes both the default and the type explicit.middleware/correlation.py:203—dispatchoverridesBaseHTTPMiddleware.dispatchincompatibly: the parent expectsCallable[[Request], Awaitable[Response]](Starlette'sRequestResponseEndpoint), but the override typescall_nextasCallable[[Request], Response].middleware/correlation.py:236— Direct consequence of (2):await call_next(request)is flagged becauseResponseisn't awaitable. Fixing the signature in (2) fixes this too.middleware/security.py:99—response.headers.pop("Server", None)fails type-checking because Starlette'sMutableHeadersdoesn't expose.pop(). Replace with the supportedif "server" in response.headers: del response.headers["server"](Starlette lowercases keys internally, so this is case-insensitive).No behaviour changes:
pop("Server", None)on aMutableHeaderswould have raisedAttributeErrorat runtime — that path was unreachable in practice because tests didn't exercise it.Verified locally
reuse lint→ "Congratulations! Your project is compliant with version 3.3 of the REUSE Specification" (156/156 files).uv run basedpyright src/with--extra dev --extra api→ 0 errors, 27 warnings (warnings unchanged).uv run ruff check src/→ clean.uv run ruff format --check src/→ clean.Test plan
Check REUSE Complianceworkflow turns green on this branch.Core Validation / Code Quality Checkspasses on this branch.SecurityHeadersMiddleware, which still strips the header when present).https://claude.ai/code/session_015Zx4CpQVNSvskJhJXT5v3q
Generated by Claude Code