lint

Author: elazarg

.github/workflows/ci.yml

@@ -7,10 +7,42 @@ on:
     branches: [ main, master ]
 
 jobs:
+  backend-lint:
+    name: Backend Lint & Type Check
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+
+      - name: Install linting tools
+        run: |
+          python -m pip install --upgrade pip
+          pip install ruff mypy bandit
+
+      - name: Run ruff (linting)
+        run: ruff check app/
+
+      - name: Run ruff (formatting check)
+        run: ruff format --check app/
+
+      - name: Run mypy (type checking)
+        run: mypy app/ --ignore-missing-imports
+
+      - name: Run bandit (security scan)
+        run: bandit -r app/ -x app/tests --skip B101
+
   backend-test:
-    name: Backend (Python 3.12)
+    name: Backend Tests
     runs-on: ubuntu-latest
-    
+    needs: backend-lint
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -19,21 +51,52 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: '3.12'
-          cache: 'pip' # Caches dependencies based on pyproject.toml
+          cache: 'pip'
 
       - name: Install dependencies
-        # pygambit requires Rust/Cargo which is pre-installed on ubuntu-latest
         run: |
           python -m pip install --upgrade pip
           pip install -e ".[dev]"
 
-      - name: Run tests
+      - name: Run tests with coverage
         run: |
-          pytest -v
+          pytest -v --cov=app --cov-report=xml --cov-report=term-missing
+
+      - name: Upload coverage report
+        uses: codecov/codecov-action@v4
+        with:
+          files: ./coverage.xml
+          fail_ci_if_error: false
+        continue-on-error: true
+
+  frontend-lint:
+    name: Frontend Lint & Type Check
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ./frontend
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
 
-  frontend-build:
-    name: Frontend (Node 18)
+      - name: Set up Node.js 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Type check
+        run: npx tsc --noEmit
+
+  frontend-test:
+    name: Frontend Tests
     runs-on: ubuntu-latest
+    needs: frontend-lint
     defaults:
       run:
         working-directory: ./frontend
@@ -42,16 +105,49 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Set up Node.js 18
+      - name: Set up Node.js 20
         uses: actions/setup-node@v4
         with:
-          node-version: '18'
+          node-version: '20'
           cache: 'npm'
           cache-dependency-path: frontend/package-lock.json
 
       - name: Install dependencies
         run: npm ci
 
-      - name: Build and Typecheck
-        # Runs "tsc && vite build" as defined in package.json
+      - name: Run tests
+        run: npm test
+
+      - name: Build
         run: npm run build
+
+  security-audit:
+    name: Security Audit
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Audit npm dependencies
+        working-directory: ./frontend
+        run: npm audit --audit-level=high
+        continue-on-error: true  # Don't fail on audit issues, just report
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Check Python dependencies with pip-audit
+        run: |
+          pip install pip-audit
+          pip-audit --ignore-vuln GHSA-xxxx || true  # Report but don't fail
+        continue-on-error: true

CLAUDE.md

@@ -52,8 +52,27 @@ docker compose exec app pytest tests/ -v --tb=short --ignore=tests/integration
 # Run integration tests (requires all services running)
 docker compose exec app pytest tests/integration/ -v --tb=short
 
+# Frontend tests
+npm test --prefix frontend
+
 # Frontend build (includes TypeScript check)
-cd frontend && npm run build
+npm run build --prefix frontend
+```
+
+### Linting & Code Quality
+
+Install dev dependencies first: `pip install -e ".[dev]"`
+
+```bash
+# Backend - run all linters
+ruff check app/                              # Linting
+ruff format app/                             # Auto-format code
+ruff format --check app/                     # Check formatting without changes
+mypy app/ --ignore-missing-imports           # Type checking
+bandit -r app/ -x app/tests --skip B101      # Security scan
+
+# Frontend
+npm run lint --prefix frontend               # TypeScript type check
 ```
 
 ## Plugin Architecture

app/conversions/__init__.py

@@ -3,15 +3,14 @@
 Provides conversions between game representations (e.g., EFG <-> NFG).
 """
 
+# Import converters for registration side effects
+from app.conversions import efg_nfg as _efg_nfg  # noqa: F401
 from app.conversions.registry import (
     Conversion,
     ConversionCheck,
     ConversionRegistry,
 )
 
-# Import converters for registration side effects
-from app.conversions import efg_nfg as _efg_nfg  # noqa: F401
-
 __all__ = [
     "Conversion",
     "ConversionCheck",

app/conversions/efg_export.py

@@ -110,12 +110,8 @@ def traverse(node_id: str) -> list[str]:
                 result.extend(traverse(target))
             else:
                 # No target - create dummy terminal
-                outcome_num = get_outcome_number(
-                    f"none_{node_id}_{action.get('label', '')}"
-                )
-                result.append(
-                    f't "" {outcome_num} "none" {{ {", ".join("0" for _ in players)} }}'
-                )
+                outcome_num = get_outcome_number(f"none_{node_id}_{action.get('label', '')}")
+                result.append(f't "" {outcome_num} "none" {{ {", ".join("0" for _ in players)} }}')
 
         return result
 

app/conversions/efg_nfg.py

@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-from typing import Mapping
+from collections.abc import Mapping
 
 from app.config import ConversionConfig
 from app.conversions.registry import Conversion, ConversionCheck
@@ -12,7 +12,7 @@
     resolve_payoffs,
 )
 from app.dependencies import get_conversion_registry
-from app.models import NormalFormGame, ExtensiveFormGame, Action, DecisionNode, Outcome
+from app.models import Action, DecisionNode, ExtensiveFormGame, NormalFormGame, Outcome
 
 # =============================================================================
 # EFG -> NFG Conversion
@@ -27,9 +27,7 @@ def check_efg_to_nfg(game: ExtensiveFormGame | NormalFormGame) -> ConversionChec
     if len(game.players) != 2:
         return ConversionCheck(
             possible=False,
-            blockers=[
-                f"Matrix view requires exactly 2 players (game has {len(game.players)})"
-            ],
+            blockers=[f"Matrix view requires exactly 2 players (game has {len(game.players)})"],
         )
 
     # Estimate strategy count WITHOUT enumerating (could be exponential!)

app/conversions/registry.py

@@ -7,8 +7,9 @@
 from __future__ import annotations
 
 from collections import deque
+from collections.abc import Callable
 from dataclasses import dataclass, field
-from typing import TYPE_CHECKING, Callable
+from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
     from app.models import AnyGame
@@ -62,9 +63,7 @@ def _find_conversion_path(
             neighbors.setdefault(src, []).append(tgt)
 
         # BFS to find shortest path
-        queue: deque[tuple[str, list[tuple[str, str]]]] = deque(
-            [(source_format, [])]
-        )
+        queue: deque[tuple[str, list[tuple[str, str]]]] = deque([(source_format, [])])
         visited = {source_format}
 
         while queue:
@@ -80,9 +79,7 @@ def _find_conversion_path(
 
         return None
 
-    def check(
-        self, game: "AnyGame", target_format: str, *, quick: bool = False
-    ) -> ConversionCheck:
+    def check(self, game: AnyGame, target_format: str, *, quick: bool = False) -> ConversionCheck:
         """Check if a game can be converted to target format.
 
         Supports chained conversions (e.g., MAID → EFG → NFG).
@@ -104,9 +101,7 @@ def check(
         if not path:
             return ConversionCheck(
                 possible=False,
-                blockers=[
-                    f"No conversion path from {source_format} to {target_format}"
-                ],
+                blockers=[f"No conversion path from {source_format} to {target_format}"],
             )
 
         # Quick check: only verify path exists and first step is possible
@@ -153,7 +148,7 @@ def check(
 
         return ConversionCheck(possible=True, warnings=all_warnings)
 
-    def convert(self, game: "AnyGame", target_format: str) -> "AnyGame":
+    def convert(self, game: AnyGame, target_format: str) -> AnyGame:
         """Convert a game to target format.
 
         Supports chained conversions (e.g., MAID → EFG → NFG).
@@ -175,17 +170,15 @@ def convert(self, game: "AnyGame", target_format: str) -> "AnyGame":
             check_result = conversion.can_convert(current_game)
 
             if not check_result.possible:
-                msg = (
-                    f"Cannot convert {src} to {tgt}: {', '.join(check_result.blockers)}"
-                )
+                msg = f"Cannot convert {src} to {tgt}: {', '.join(check_result.blockers)}"
                 raise ValueError(msg)
 
             current_game = conversion.convert(current_game)
 
         return current_game
 
     def available_conversions(
-        self, game: "AnyGame", *, quick: bool = True
+        self, game: AnyGame, *, quick: bool = True
     ) -> dict[str, ConversionCheck]:
         """Get all available conversions for a game.
 
@@ -212,9 +205,7 @@ def available_conversions(
                 continue
             check_result = self.check(game, target, quick=quick)
             # Only include if possible or has a path (even if blocked)
-            if check_result.possible or self._find_conversion_path(
-                source_format, target
-            ):
+            if check_result.possible or self._find_conversion_path(source_format, target):
                 results[target] = check_result
 
         return results

app/conversions/remote.py

@@ -38,7 +38,7 @@ def create_remote_conversion(
     """
     client = RemoteServiceClient(plugin_url, service_name=plugin_name)
 
-    def can_convert(game: "AnyGame") -> ConversionCheck:
+    def can_convert(game: AnyGame) -> ConversionCheck:
         """Check if this game can be converted."""
         if game.format_name != source_format:
             return ConversionCheck(
@@ -47,11 +47,11 @@ def can_convert(game: "AnyGame") -> ConversionCheck:
             )
         return ConversionCheck(possible=True)
 
-    def convert(game: "AnyGame") -> "AnyGame":
+    def convert(game: AnyGame) -> AnyGame:
         """Convert the game via remote plugin."""
         from app.models.extensive_form import ExtensiveFormGame
-        from app.models.normal_form import NormalFormGame
         from app.models.maid import MAIDGame
+        from app.models.normal_form import NormalFormGame
 
         endpoint = f"/convert/{source_format}-to-{target_format}"
         logger.debug("Converting via %s%s", plugin_url, endpoint)
@@ -67,12 +67,12 @@ def convert(game: "AnyGame") -> "AnyGame":
                 raise ValueError(
                     f"Cannot convert {source_format} to {target_format}: "
                     f"plugin service is unreachable. Ensure the {plugin_name} plugin is running."
-                )
-            raise ValueError(f"Conversion failed: {e.error.message}")
+                ) from e
+            raise ValueError(f"Conversion failed: {e.error.message}") from e
 
         game_dict = response.get("game")
         if not game_dict:
-            raise ValueError(f"Conversion response missing 'game' field")
+            raise ValueError("Conversion response missing 'game' field")
 
         # Convert to appropriate model based on format_name
         format_name = game_dict.get("format_name", target_format)
@@ -83,7 +83,7 @@ def convert(game: "AnyGame") -> "AnyGame":
                 return MAIDGame(**game_dict)
             return ExtensiveFormGame(**game_dict)
         except Exception as e:
-            raise ValueError(f"Failed to parse converted game: {e}")
+            raise ValueError(f"Failed to parse converted game: {e}") from e
 
     return Conversion(
         name=f"{source_format} to {target_format} (via {plugin_name})",