feat(ci): add qlty gate and weekly health scan#48
Conversation
Wires up the new python-qlty-gate reusable workflow for two purposes: PR gate (qlty-gate job): runs qlty check in diff mode on pull requests, blocking merges that introduce medium+ severity issues. The check name "qlty-gate / Qlty Gate" is added to the org baseline required checks. Weekly health scan (qlty-health job): runs qlty check --all on a Monday morning schedule to surface the full backlog. Exits 0 (no-fail: true) until the existing 100-issue debt is resolved, at which point no-fail should be removed to create a regression alarm. Existing coverage-upload job (qlty) is guarded to push-to-main only. Refs: ByronWilliamsCPA/.github#188 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
Warning Review limit reached
More reviews will be available in 58 minutes and 53 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Adds Qlty enforcement and ongoing scanning to the repository’s CI so PRs can be blocked on newly introduced medium+ severity Qlty findings, while also running a weekly informational full-repo scan to track existing issue backlog. This fits the repo’s pattern of delegating CI/security quality checks to org-level reusable workflows with SHA pins.
Changes:
- Adds a PR “gate” job (
qlty-gate) that calls the org reusablepython-qlty-gateworkflow in diff mode (intended to block merges on medium+ findings). - Adds a scheduled and manually-invokable “health” job (
qlty-health) that runs a full-codebase scan withno-fail: true. - Restricts the existing Qlty coverage upload job to
pushevents only, and updates workflow concurrency grouping.
| concurrency: | ||
| group: qlty-coverage-${{ github.ref }} | ||
| group: qlty-${{ github.ref }} | ||
| cancel-in-progress: true |
| # PR gate: diff mode, block merges that introduce medium+ severity issues. | ||
| # Check name: "qlty-gate / Qlty Gate" -- required by org baseline ruleset. | ||
| qlty-gate: | ||
| if: github.event_name == 'pull_request' | ||
| uses: ByronWilliamsCPA/.github/.github/workflows/python-qlty-gate.yml@040026ab682aa4b9ef491750d62cdd1592cdb659 |
| # Coverage upload after merges to main only. | ||
| qlty: | ||
| if: github.event_name == 'push' | ||
| uses: ByronWilliamsCPA/.github/.github/workflows/python-qlty-coverage.yml@40ff5b5615e786ee0867e1b9e8f21a4735036e63 # main |
Summary
qlty-gatejob): calls the newpython-qlty-gatereusable workflow in diff mode on pull requests; blocks merges that introduce medium+ severity qlty issues in changed filesqlty-healthjob): calls the same reusable workflow with--allon a Monday schedule; informational only (no-fail: true) until the existing 100-issue backlog is resolvedpushevents onlyWhy this approach
The
qlty checkstatus context posted by the qlty.sh GitHub App always reportsSUCCESSregardless of issue count. It cannot block PRs. The only reliable enforcement path is a GitHub Actions CheckRun that calls the qlty CLI and exits non-zero.The resulting check name
qlty-gate / Qlty Gateis what gets added torequired_status_checksin the org baseline ruleset (companion change, no PR needed -- done via API).Dependencies
Depends on ByronWilliamsCPA/.github#188 merging first. References the branch commit SHA
040026ab682aa4b9ef491750d62cdd1592cdb659. After .github#188 squash-merges, Renovate will update this SHA automatically.Test plan
qlty-gate / Qlty Gatecheck appears on this PR after .github#188 mergesno-fail: truefromqlty-healthonce backlog reaches zero