ci: close CI hardening gaps — root monitor matrix coverage, classified json smoke, coverage gate, pinned actions, constraints - #233
Merged
Conversation
added 2 commits
August 11, 2026 17:39
…ONPATH (#227) _spawn_server() ran the child from a tmp cwd outside the checkout, so `python -m ledger_agent.mcp_server` died with ModuleNotFoundError when the package was not pip-installed into that interpreter; the failure surfaced as a misleading KeyError: 1 from _exchange(). Prepend the repo root to PYTHONPATH for the child, and turn blank-stdout EOF into an AssertionError carrying the child return code and stderr. Verified: 8/8 MCP tests; full suite 697 passed / 0 failed / 0 skipped.
…d json smoke, coverage gate, pinned actions, constraints (#229 #231 #232) #229: engine matrix now runs the default pytest invocation (testpaths: tests/ + root test_ledger.py), so the 17-test root monitor suite runs on every leg (Linux 3.10-3.13, Windows 3.12, macOS 3.12) instead of only lint-and-smoke. New tests/test_discovery_contract.py asserts the default collection includes test_ledger.py — a revert to 'pytest tests/' fails CI. #231: the old 'ledger.py --json || echo expected' step absorbed EVERY nonzero exit. New tools/json_smoke.py classifies: exit 0 + valid JSON with providers/generated_at passes; the specifically recognized '(state.db not found)' stderr case is the only tolerated nonzero exit; anything else fails loudly. Regression tests cover all branches (tests/test_json_smoke_classifier.py). #232: engine leg now gates coverage (--cov-fail-under=65; baseline 70.7% 2026-08-12). All actions pinned to commit SHAs (checkout, setup-python, docker login/metadata/build-push, pypi-publish). New constraints.txt pins direct deps (respecting pyproject upper bounds); all workflows install with -c constraints.txt. Added concurrency cancel-in-progress.
This was referenced Aug 12, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves #229, #231, #232 (filed from the 2026-08-11 test-suite + CI audit).
#229 — root monitor suite now has full matrix coverage. The engine matrix
ran
pytest tests/explicitly, so the roottest_ledger.pymonitor suite(17 tests) only ran on the lint-and-smoke leg. The matrix now runs the default
pytest invocation (
testpathsfrom pyproject.toml:tests+test_ledger.py)on every leg — Linux 3.10/3.11/3.12/3.13, Windows 3.12, macOS 3.12.
tests/test_discovery_contract.pyasserts the default collection includestest_ledger.py, so reverting topytest tests/fails CI.#231 — JSON smoke failures are no longer masked. The old step
ledger.py --json || echo "(state.db unavailable — expected in CI)"convertedevery nonzero exit into an "expected" message. New
tools/json_smoke.pyclassifies the result: exit 0 + valid JSON with
providers/generated_atpasses; the specifically recognized
(state.db not found)stderr case is theonly tolerated nonzero exit; anything else fails loudly. Regression tests
cover every branch (
tests/test_json_smoke_classifier.py), including anend-to-end subprocess run.
#232 — coverage gate, SHA-pinned actions, constraints.
--cov-fail-under=65(baseline 70.7% on2026-08-12, 697→711 tests).
docker login/metadata/build-push, pypi-publish (release/v1).
constraints.txtpins direct dependencies to exact versions (respectingpyproject.toml upper bounds: stripe<14, reportlab<5, pytest<10); every
workflow installs with
-c constraints.txt.concurrency: cancel-in-progressadded so superseded commits stop burningrunners.
Local verification:
pytest --cov=ledger_agent --cov=ledger --cov-fail-under=65→ 711 passed, 70.69% coverage.tools/json_smoke.pyagainst the real
ledger.py→ PASS (valid JSON with providers/generated_at).