From 15b2c3689182ddaeb051e1659456586e4d4ba115 Mon Sep 17 00:00:00 2001
From: joshbouncesecurity <josh@bouncesecurity.com>
Date: Mon, 4 May 2026 21:22:51 +0300
Subject: [PATCH 1/2] ci: add ruff lint with F821/F811 rules

Adds a ruff lint step to the test workflow with two rules:
F821 (undefined name) and F811 (redefined unused name). Python
won't report an undefined name until that code path executes,
so a missing import or typo can ship undetected. F821 + F811
catch that statically with zero false positives and no style
noise.

Lint runs before pytest so CI fails fast on missing imports.

Also fixes a pre-existing F821 in core/analyzer.py: the
analyze() function called tracker.add_prior_usage() without
defining tracker locally; replaced with get_global_tracker()
to match the pattern used elsewhere in the file.

Refs #16 (item 2).
---
 .github/workflows/test.yaml        | 4 ++++
 libs/openant-core/core/analyzer.py | 2 +-
 libs/openant-core/pyproject.toml   | 9 +++++++++
 3 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 33c0dd2f..ddc216d3 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -37,6 +37,10 @@ jobs:
         working-directory: libs/openant-core
         run: pip install -r requirements.txt && pip install ".[dev]"
 
+      - name: Lint Python (undefined names, syntax errors)
+        working-directory: libs/openant-core
+        run: ruff check .
+
       - name: Cache JS parser node_modules
         id: cache-node-modules
         uses: actions/cache@v4
diff --git a/libs/openant-core/core/analyzer.py b/libs/openant-core/core/analyzer.py
index 7fb59661..79a813b9 100644
--- a/libs/openant-core/core/analyzer.py
+++ b/libs/openant-core/core/analyzer.py
@@ -390,7 +390,7 @@ def _usage_dict():
 
     # Inject prior usage into tracker so step_report captures the total
     if _summary_input_tokens or _summary_output_tokens:
-        tracker.add_prior_usage(
+        get_global_tracker().add_prior_usage(
             _summary_input_tokens, _summary_output_tokens, _summary_cost_usd)
 
     # Write initial summary
diff --git a/libs/openant-core/pyproject.toml b/libs/openant-core/pyproject.toml
index 266e7dba..a77ba8be 100644
--- a/libs/openant-core/pyproject.toml
+++ b/libs/openant-core/pyproject.toml
@@ -21,6 +21,7 @@ dependencies = [
 [project.optional-dependencies]
 dev = [
     "pytest>=8.0.0",
+    "ruff>=0.8.0",
 ]
 
 [project.scripts]
@@ -30,6 +31,14 @@ openant = "openant.cli:main"
 requires = ["hatchling"]
 build-backend = "hatchling.build"
 
+[tool.ruff]
+target-version = "py311"
+
+[tool.ruff.lint]
+# Only rules that catch actual bugs (will break at runtime)
+# F821: undefined name, F811: redefined unused name
+select = ["F821", "F811"]
+
 [tool.hatch.build.targets.wheel]
 packages = [
     "openant",

From c806c27ef4b6bfbd87e4407e198fb39ccecd1b28 Mon Sep 17 00:00:00 2001
From: joshbouncesecurity <josh@bouncesecurity.com>
Date: Sun, 10 May 2026 15:45:02 +0300
Subject: [PATCH 2/2] ci: move ruff lint to dedicated single-OS job, add F823

- Extracts ruff check into a standalone `lint` job on ubuntu-latest,
  parallel to the matrix jobs instead of running 3x inside them
- Installs only ruff (no runtime deps needed for static parsing)
- Adds F823 (local var referenced before assignment) to rule set

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/test.yaml      | 23 +++++++++++++++++++----
 libs/openant-core/pyproject.toml |  4 ++--
 2 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index ddc216d3..954b4834 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -5,6 +5,25 @@ on:
   pull_request:
 
 jobs:
+  lint:
+    name: Lint (Python)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - name: Install ruff
+        run: pip install ruff
+
+      - name: Lint Python (undefined names, syntax errors)
+        working-directory: libs/openant-core
+        run: ruff check .
+
   python-tests:
     name: Python tests (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
@@ -37,10 +56,6 @@ jobs:
         working-directory: libs/openant-core
         run: pip install -r requirements.txt && pip install ".[dev]"
 
-      - name: Lint Python (undefined names, syntax errors)
-        working-directory: libs/openant-core
-        run: ruff check .
-
       - name: Cache JS parser node_modules
         id: cache-node-modules
         uses: actions/cache@v4
diff --git a/libs/openant-core/pyproject.toml b/libs/openant-core/pyproject.toml
index a77ba8be..bf0377a8 100644
--- a/libs/openant-core/pyproject.toml
+++ b/libs/openant-core/pyproject.toml
@@ -36,8 +36,8 @@ target-version = "py311"
 
 [tool.ruff.lint]
 # Only rules that catch actual bugs (will break at runtime)
-# F821: undefined name, F811: redefined unused name
-select = ["F821", "F811"]
+# F821: undefined name, F811: redefined unused name, F823: local var referenced before assignment
+select = ["F821", "F811", "F823"]
 
 [tool.hatch.build.targets.wheel]
 packages = [