Adds the gates the hashview repo runs, adapted to hate_crack's uv toolchain:
- ruff format --check as a CI step + a ruff-format prek pre-push hook
(the package was reformatted in the preceding commit).
- Bandit SAST vs a committed baseline (.bandit-baseline.json, 114 reviewed
low-severity subprocess/shlex findings); [tool.bandit] config in
pyproject.toml; CI job + prek pre-push hook. Only NEW findings fail.
- pip-audit dependency-CVE gate (CI job). PYSEC-2026-2447 (diskcache 5.6.3,
transitive via instructor -> atomic-agents) is ignored — no upstream fix.
- Hygiene pre-commit hooks (trailing-whitespace, end-of-file-fixer, check-yaml,
check-merge-conflict, check-added-large-files) via the pre-commit-hooks repo.
- CLAUDE.md updated: lint/security commands, prek install (+pre-commit hook
type), and the active-hooks list.
Co-Authored-By: Claude <noreply@anthropic.com>
The repo had no CI: ruff/ty/pytest ran only in local prek pre-push hooks, so
a commit pushed without hooks installed reached main unvalidated -- and
auto-tag would then cut a release from it. Adds ci.yml (ruff, ty, pytest on
3.13) and gates tagging on it.
Auto-tagged versions also never produced a release. The tag is pushed with
the default GITHUB_TOKEN, and GitHub suppresses workflow triggers for
GITHUB_TOKEN-created events, so the tag-triggered release.yml never fired --
v2.11.3 was tagged with no release. auto-tag now creates the release itself,
idempotently; release.yml stays as the manual-tag path.
Also fixes version logic that matched the `!` breaking marker but only ever
bumped minor (and never saw BREAKING CHANGE: footers, since only subjects
were inspected), serializes concurrent merges that both computed the same
tag, and repins softprops/action-gh-release from an arbitrary master commit
to v2.6.2 with all workflows on one actions/checkout version.
Clears the pre-existing ty error in notify/tailer.py that would have made
the new type-check step red: _read_new_lines read self._file_pos
(int | None) while its only None-guard lived in the caller, so the position
is passed in explicitly as an int. Behavior unchanged.
Co-Authored-By: Claude <noreply@anthropic.com>
