ci: add quality gate workflow running make check and make validate (#23)

[guyash1]

Closes#23.

Adds .github/workflows/ci.yml running make check (ruff + mypy + pytest) and make validate (offline validation of the flagship example) on every pull request and on pushes to main.

Per the issue's non-goals: single Python version as pinned in pyproject.toml (3.11), no version matrix, no caching tuning beyond pip cache in setup-python. A concurrency group cancels superseded runs of the same branch to save runner minutes.

Also includes a small cleanup commit fixing 5 pre-existing lint/mypy errors that were already on main (two unused imports, two overlong lines, one missing type annotation) — without it, the new CI would be red on its own PR.

Making the check job a required status check via branch protection on main remains a maintainer action (repo settings), as noted in the issue.

[Asaf-prog]

Please, the pipeline did not trigger automatically. Please fix it.

[guyash1]

Hi @Asaf-prog — I looked into it. The workflow itself is fine (it ran and passed on several PRs this week, e.g. #39 and #41). The runs that didn't start — like #42 right now — are stuck in action_required: GitHub's default protection that requires a maintainer to approve workflow runs for first-time contributors submitting from forks. That's a repo setting, not something the workflow file can change.

Two options (maintainer-only):

1. Per-PR: open the stuck PR's Checks/Actions tab and click "Approve and run". Once a contributor has a merged PR, their future runs trigger automatically.
2. Permanent: Settings → Actions → General → "Fork pull request workflows from outside collaborators" — relax it to only require approval for brand-new GitHub accounts. Slight security trade-off (anyone's fork PR can consume runner minutes), your call.

One thing I'd advise against: switching the trigger to pull_request_target would make runs start automatically, but it executes untrusted fork code with elevated repo permissions — a known security foot-gun, so I didn't do that.

[guyash1]

Closes#23.

Adds .github/workflows/ci.yml running make check (ruff + mypy + pytest) and make validate (offline validation of the flagship example) on every pull request and on pushes to main.

Per the issue's non-goals: single Python version as pinned in pyproject.toml (3.11), no version matrix, no caching tuning beyond pip cache in setup-python. A concurrency group cancels superseded runs of the same branch to save runner minutes.

Also includes a small cleanup commit fixing 5 pre-existing lint/mypy errors that were already on main (two unused imports, two overlong lines, one missing type annotation) — without it, the new CI would be red on its own PR.

Making the check job a required status check via branch protection on main remains a maintainer action (repo settings), as noted in the issue.

[Asaf-prog]

Please, the pipeline did not trigger automatically. Please fix it.

[guyash1]

Hi @Asaf-prog — I looked into it. The workflow itself is fine (it ran and passed on several PRs this week, e.g. #39 and #41). The runs that didn't start — like #42 right now — are stuck in action_required: GitHub's default protection that requires a maintainer to approve workflow runs for first-time contributors submitting from forks. That's a repo setting, not something the workflow file can change.

Two options (maintainer-only):

1. Per-PR: open the stuck PR's Checks/Actions tab and click "Approve and run". Once a contributor has a merged PR, their future runs trigger automatically.
2. Permanent: Settings → Actions → General → "Fork pull request workflows from outside collaborators" — relax it to only require approval for brand-new GitHub accounts. Slight security trade-off (anyone's fork PR can consume runner minutes), your call.

One thing I'd advise against: switching the trigger to pull_request_target would make runs start automatically, but it executes untrusted fork code with elevated repo permissions — a known security foot-gun, so I didn't do that.

[guyash1]

Closes#23.

Adds .github/workflows/ci.yml running make check (ruff + mypy + pytest) and make validate (offline validation of the flagship example) on every pull request and on pushes to main.

Per the issue's non-goals: single Python version as pinned in pyproject.toml (3.11), no version matrix, no caching tuning beyond pip cache in setup-python. A concurrency group cancels superseded runs of the same branch to save runner minutes.

Also includes a small cleanup commit fixing 5 pre-existing lint/mypy errors that were already on main (two unused imports, two overlong lines, one missing type annotation) — without it, the new CI would be red on its own PR.

Making the check job a required status check via branch protection on main remains a maintainer action (repo settings), as noted in the issue.

[Asaf-prog]

Please, the pipeline did not trigger automatically. Please fix it.

[guyash1]

Hi @Asaf-prog — I looked into it. The workflow itself is fine (it ran and passed on several PRs this week, e.g. #39 and #41). The runs that didn't start — like #42 right now — are stuck in action_required: GitHub's default protection that requires a maintainer to approve workflow runs for first-time contributors submitting from forks. That's a repo setting, not something the workflow file can change.

Two options (maintainer-only):

1. Per-PR: open the stuck PR's Checks/Actions tab and click "Approve and run". Once a contributor has a merged PR, their future runs trigger automatically.
2. Permanent: Settings → Actions → General → "Fork pull request workflows from outside collaborators" — relax it to only require approval for brand-new GitHub accounts. Slight security trade-off (anyone's fork PR can consume runner minutes), your call.

One thing I'd advise against: switching the trigger to pull_request_target would make runs start automatically, but it executes untrusted fork code with elevated repo permissions — a known security foot-gun, so I didn't do that.

[guyash1]

Closes#23.

Adds .github/workflows/ci.yml running make check (ruff + mypy + pytest) and make validate (offline validation of the flagship example) on every pull request and on pushes to main.

Per the issue's non-goals: single Python version as pinned in pyproject.toml (3.11), no version matrix, no caching tuning beyond pip cache in setup-python. A concurrency group cancels superseded runs of the same branch to save runner minutes.

Also includes a small cleanup commit fixing 5 pre-existing lint/mypy errors that were already on main (two unused imports, two overlong lines, one missing type annotation) — without it, the new CI would be red on its own PR.

Making the check job a required status check via branch protection on main remains a maintainer action (repo settings), as noted in the issue.

[Asaf-prog]

Please, the pipeline did not trigger automatically. Please fix it.

[guyash1]

Hi @Asaf-prog — I looked into it. The workflow itself is fine (it ran and passed on several PRs this week, e.g. #39 and #41). The runs that didn't start — like #42 right now — are stuck in action_required: GitHub's default protection that requires a maintainer to approve workflow runs for first-time contributors submitting from forks. That's a repo setting, not something the workflow file can change.

Two options (maintainer-only):

1. Per-PR: open the stuck PR's Checks/Actions tab and click "Approve and run". Once a contributor has a merged PR, their future runs trigger automatically.
2. Permanent: Settings → Actions → General → "Fork pull request workflows from outside collaborators" — relax it to only require approval for brand-new GitHub accounts. Slight security trade-off (anyone's fork PR can consume runner minutes), your call.

One thing I'd advise against: switching the trigger to pull_request_target would make runs start automatically, but it executes untrusted fork code with elevated repo permissions — a known security foot-gun, so I didn't do that.

[guyash1]

Closes#23.

Adds .github/workflows/ci.yml running make check (ruff + mypy + pytest) and make validate (offline validation of the flagship example) on every pull request and on pushes to main.

Per the issue's non-goals: single Python version as pinned in pyproject.toml (3.11), no version matrix, no caching tuning beyond pip cache in setup-python. A concurrency group cancels superseded runs of the same branch to save runner minutes.

Also includes a small cleanup commit fixing 5 pre-existing lint/mypy errors that were already on main (two unused imports, two overlong lines, one missing type annotation) — without it, the new CI would be red on its own PR.

Making the check job a required status check via branch protection on main remains a maintainer action (repo settings), as noted in the issue.

[Asaf-prog]

Please, the pipeline did not trigger automatically. Please fix it.

[guyash1]

Hi @Asaf-prog — I looked into it. The workflow itself is fine (it ran and passed on several PRs this week, e.g. #39 and #41). The runs that didn't start — like #42 right now — are stuck in action_required: GitHub's default protection that requires a maintainer to approve workflow runs for first-time contributors submitting from forks. That's a repo setting, not something the workflow file can change.

Two options (maintainer-only):

1. Per-PR: open the stuck PR's Checks/Actions tab and click "Approve and run". Once a contributor has a merged PR, their future runs trigger automatically.
2. Permanent: Settings → Actions → General → "Fork pull request workflows from outside collaborators" — relax it to only require approval for brand-new GitHub accounts. Slight security trade-off (anyone's fork PR can consume runner minutes), your call.

One thing I'd advise against: switching the trigger to pull_request_target would make runs start automatically, but it executes untrusted fork code with elevated repo permissions — a known security foot-gun, so I didn't do that.

[guyash1]

Closes#23.

Adds .github/workflows/ci.yml running make check (ruff + mypy + pytest) and make validate (offline validation of the flagship example) on every pull request and on pushes to main.

Per the issue's non-goals: single Python version as pinned in pyproject.toml (3.11), no version matrix, no caching tuning beyond pip cache in setup-python. A concurrency group cancels superseded runs of the same branch to save runner minutes.

Also includes a small cleanup commit fixing 5 pre-existing lint/mypy errors that were already on main (two unused imports, two overlong lines, one missing type annotation) — without it, the new CI would be red on its own PR.

Making the check job a required status check via branch protection on main remains a maintainer action (repo settings), as noted in the issue.

[Asaf-prog]

Please, the pipeline did not trigger automatically. Please fix it.

[guyash1]

Hi @Asaf-prog — I looked into it. The workflow itself is fine (it ran and passed on several PRs this week, e.g. #39 and #41). The runs that didn't start — like #42 right now — are stuck in action_required: GitHub's default protection that requires a maintainer to approve workflow runs for first-time contributors submitting from forks. That's a repo setting, not something the workflow file can change.

Two options (maintainer-only):

1. Per-PR: open the stuck PR's Checks/Actions tab and click "Approve and run". Once a contributor has a merged PR, their future runs trigger automatically.
2. Permanent: Settings → Actions → General → "Fork pull request workflows from outside collaborators" — relax it to only require approval for brand-new GitHub accounts. Slight security trade-off (anyone's fork PR can consume runner minutes), your call.

One thing I'd advise against: switching the trigger to pull_request_target would make runs start automatically, but it executes untrusted fork code with elevated repo permissions — a known security foot-gun, so I didn't do that.

[guyash1]

Closes#23.

Adds .github/workflows/ci.yml running make check (ruff + mypy + pytest) and make validate (offline validation of the flagship example) on every pull request and on pushes to main.

Per the issue's non-goals: single Python version as pinned in pyproject.toml (3.11), no version matrix, no caching tuning beyond pip cache in setup-python. A concurrency group cancels superseded runs of the same branch to save runner minutes.

Also includes a small cleanup commit fixing 5 pre-existing lint/mypy errors that were already on main (two unused imports, two overlong lines, one missing type annotation) — without it, the new CI would be red on its own PR.

Making the check job a required status check via branch protection on main remains a maintainer action (repo settings), as noted in the issue.

[Asaf-prog]

Please, the pipeline did not trigger automatically. Please fix it.

[guyash1]

Hi @Asaf-prog — I looked into it. The workflow itself is fine (it ran and passed on several PRs this week, e.g. #39 and #41). The runs that didn't start — like #42 right now — are stuck in action_required: GitHub's default protection that requires a maintainer to approve workflow runs for first-time contributors submitting from forks. That's a repo setting, not something the workflow file can change.

Two options (maintainer-only):

1. Per-PR: open the stuck PR's Checks/Actions tab and click "Approve and run". Once a contributor has a merged PR, their future runs trigger automatically.
2. Permanent: Settings → Actions → General → "Fork pull request workflows from outside collaborators" — relax it to only require approval for brand-new GitHub accounts. Slight security trade-off (anyone's fork PR can consume runner minutes), your call.

One thing I'd advise against: switching the trigger to pull_request_target would make runs start automatically, but it executes untrusted fork code with elevated repo permissions — a known security foot-gun, so I didn't do that.

[guyash1]

Closes#23.

Adds .github/workflows/ci.yml running make check (ruff + mypy + pytest) and make validate (offline validation of the flagship example) on every pull request and on pushes to main.

Per the issue's non-goals: single Python version as pinned in pyproject.toml (3.11), no version matrix, no caching tuning beyond pip cache in setup-python. A concurrency group cancels superseded runs of the same branch to save runner minutes.

Also includes a small cleanup commit fixing 5 pre-existing lint/mypy errors that were already on main (two unused imports, two overlong lines, one missing type annotation) — without it, the new CI would be red on its own PR.

Making the check job a required status check via branch protection on main remains a maintainer action (repo settings), as noted in the issue.

[Asaf-prog]

Please, the pipeline did not trigger automatically. Please fix it.

[guyash1]

Hi @Asaf-prog — I looked into it. The workflow itself is fine (it ran and passed on several PRs this week, e.g. #39 and #41). The runs that didn't start — like #42 right now — are stuck in action_required: GitHub's default protection that requires a maintainer to approve workflow runs for first-time contributors submitting from forks. That's a repo setting, not something the workflow file can change.

Two options (maintainer-only):

1. Per-PR: open the stuck PR's Checks/Actions tab and click "Approve and run". Once a contributor has a merged PR, their future runs trigger automatically.
2. Permanent: Settings → Actions → General → "Fork pull request workflows from outside collaborators" — relax it to only require approval for brand-new GitHub accounts. Slight security trade-off (anyone's fork PR can consume runner minutes), your call.

One thing I'd advise against: switching the trigger to pull_request_target would make runs start automatically, but it executes untrusted fork code with elevated repo permissions — a known security foot-gun, so I didn't do that.