@biffo/cli 0.301.23 → 0.301.25

package/_skeletons/sibling-template/.github/workflows/ci.yml

@@ -208,16 +208,14 @@ jobs:
       run:
         working-directory: services/api
     steps:
-      # `fetch-depth: 0` matches the root repo's own `python` job (#1692) and is
-      # required by the Dependency audit step below: py-dependency-audit.sh's
-      # pre-existing-vs-introduced comparison (#1673) only activates when
-      # `origin/${GITHUB_BASE_REF}` resolves locally, which a shallow (depth-1,
-      # single-ref) checkout never provides. Without this, every finding blocks,
-      # identical to pre-#1673 behaviour, on every repo scaffolded from this
-      # skeleton (biffo-template#1803).
+      # `fetch-depth: 0` is no longer required here (#1882): it existed
+      # solely for py-dependency-audit.sh's pre-existing-vs-introduced
+      # comparison (#1673), which needed `origin/${GITHUB_BASE_REF}` to
+      # resolve locally -- that step, and the same full-depth checkout it
+      # needs, moved to the `python-audit` job below when the audit was
+      # split out of this required job. Nothing remaining in this job reads
+      # `origin/` state, so the default shallow checkout is correct here now.
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-        with:
-          fetch-depth: 0
       - uses: astral-sh/setup-uv@v5
         with:
           enable-cache: true
@@ -278,13 +276,6 @@ jobs:
         with:
           name: bandit-report
           path: services/api/bandit-report.json
-      - name: Dependency audit
-        if: ${{ !cancelled() }}
-        # Same treatment as the JS job's Dependency audit above: fails on a real
-        # advisory, INCONCLUSIVE on an unreachable PyPI/OSV (#591, #743). cwd is
-        # services/api, which is the environment `uv sync` installed and so the
-        # one to audit.
-        run: sh ../../scripts/py-dependency-audit.sh
       - name: Routing smoke test — self-test
         if: ${{ !cancelled() }}
         # Not exercising this repo's own deployment (CI has none to reach) —
@@ -370,6 +361,39 @@ jobs:
           fi
           echo "PASS: every scripts/*.test.sh guard in this repo has a caller."
 
+  # Split out of the `python` job deliberately (biffo-template#1882, mirroring
+  # #1880/#1881's identical JS-side fix): `pip-audit`'s advisory lookups are
+  # exactly as registry-dependent and chronically unreliable as `pnpm audit`'s
+  # were. `python` (required) no longer runs this step, so a registry-side
+  # advisory event can never again block that job; this job runs the exact
+  # same script informationally on every push/PR (`continue-on-error: true`)
+  # and is deliberately NOT part of DEFAULT_STATUS_CHECKS/SIBLING_STATUS_CHECKS.
+  python-audit:
+    name: Python Dependency Audit (non-blocking, #1882)
+    runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
+    timeout-minutes: 20
+    continue-on-error: true
+    defaults:
+      run:
+        working-directory: services/api
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          fetch-depth: 0
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - run: uv sync --all-groups --locked
+      - name: Dependency audit
+        if: ${{ !cancelled() }}
+        # Same treatment as the JS job's Dependency audit: fails on a real
+        # advisory, INCONCLUSIVE on an unreachable PyPI/OSV (#591, #743) —
+        # and this job's own non-required status is what stops that
+        # inconclusive result from blocking the merge queue in the first
+        # place. cwd is services/api, which is the environment `uv sync`
+        # installed and so the one to audit.
+        run: sh ../../scripts/py-dependency-audit.sh
+
   security-secrets:
     name: Secret Scan
     runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.301.23",
+  "version": "0.301.25",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",

package/scripts/verify.sh

@@ -1445,6 +1445,13 @@ fi
 [ -f scripts/branch-health-plan-only-detection.test.sh ] &&
   run_check branch-health-plan-only sh scripts/branch-health-plan-only-detection.test.sh
 
+# The DDL module-number allocator's own race-freedom proof (#1886): races real
+# `git` processes against throwaway local bare repos (never a mock of git, and
+# never /tmp -- repo-local scratch dirs cleaned up by its own trap), so it needs
+# neither network nor a live deployment. Measured here: ~2.4s.
+[ -f scripts/allocate-module-number.test.sh ] &&
+  run_check allocate-module-number sh scripts/allocate-module-number.test.sh
+
 # The append-only corpus guard (#778). CI runs it in Release Guards, and it was
 # invisible to the parity test until #897 widened the harvester -- it is neither
 # `pnpm`, `uv`, `terraform` nor `sh scripts/`, so the guard whose property is