ci: reject Git sources in root pyproject.toml

[TomCC7]

Contribution path

• Small, safe change that does not need a tracking issue

Problem

The root pyproject.toml can acquire Git source overrides such as the pinned GraspGenX checkout. We want CI to enforce a published-package policy for this PyPI project.

Solution

Add a check at the start of the existing lint job, before dependency installation. Python's standard-library TOML parser detects git keys in [tool.uv.sources], including separate source tables and conditional source lists, and reports the offending package names. Comments and index sources are allowed. The existing required ci-complete job already depends on lint.

This draft intentionally fails on the existing graspgenx Git source. That dependency needs to be addressed before merging; this PR only adds the guard.

How to Test

Run the workflow step locally from the repository root:

sed -n '/      - name: Reject Git sources in root pyproject.toml/,/      - name: Install uv/p' .github/workflows/ci.yml | sed '1,2d;$d;s/^          //' | bash -e

Verified eight cases locally: existing GraspGenX source, index sources, absent sources, commented Git source, separate source table with a quoted key, conditional Git source, malformed TOML, and the current file with the Git override removed. All produced the expected exit status. YAML parsing, git diff --check, and commit hooks passed.

AI assistance

Implemented and verified by Codex (GPT-6).

Checklist

• I have read and approved the CLA.

— Codex

[greptile-apps]

Confidence Score: 4/5

Not safe to merge: the required lint check deterministically stops before lint dependencies can be installed.

Findings

1.  Current source blocks checks ▶

Summary

• This change adds a root-manifest Git-source restriction to the lint workflow. The repository currently declares graspgenx as a Git source, so the required lint check stops before dependencies are installed.

_{Reviews (1) · Last reviewed commit: "ci: reject Git sources in root pyproject..."}

[greptile-apps]

Current source blocks checks

The root manifest still configures graspgenx from Git, and this new check rejects every source with a git entry. Because it runs before lint dependencies are installed, the required lint check exits immediately and cannot complete until this source is removed, published, or explicitly handled.

Artifacts

Evidence from the check

• The executable script is the exact CI guard logic extracted from workflow lines 257–274, showing what was run against the root manifest.

Command output from the check

• Running the extracted guard from the repository root exited 1 and rejected graspgenx, proving lint stops before dependency installation.

Command output from the check

• The captured root manifest declaration identifies graspgenx as a Git source, tying it directly to the guard failure.

_{Ran code and verified through T-Rex}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

@@            Coverage Diff             @@
##             main    #4113      +/-   ##
==========================================
- Coverage   78.63%   78.63%   -0.01%     
==========================================
  Files        1467     1467              
  Lines      138746   138746              
  Branches    11931    11931              
==========================================
- Hits       109108   109106       -2     
- Misses      26278    26280       +2     
  Partials     3360     3360              

Components	Coverage Δ
Tests	94.61% <ø> (ø)

Flag	Coverage Δ
OS-ubuntu-24.04-arm	74.83% <ø> (+<0.01%)	⬆️
OS-ubuntu-latest	75.53% <ø> (ø)
Py-3.10	75.30% <ø> (-0.01%)	⬇️
Py-3.11	75.51% <ø> (ø)
Py-3.12	75.51% <ø> (+<0.01%)	⬆️
SelfHosted-Large	30.76% <ø> (-0.01%)	⬇️
SelfHosted-macOS	34.98% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.