Commit `44cb7ee485`

44cb7ee485744ed7e22fe1b1bd31d4e8cead238a

parent: fab92e702d

Unsigned

cmc <hello@cleberg.net> · 2026-08-22 03:38 UTC

Check ruff in CI as well as the build

build.py runs 'ruff check --fix' and 'ruff format' on development builds, but CI
builds with ENV=prod, which skips them — so nothing was checking lint
automatically. These are the verifying forms of the same two commands against
the same ruff.toml: --no-fix and --check, because CI should report on the tree
rather than rewrite it.

Its own job, so a lint failure and a broken page stay distinct signals. ruff is
pinned for the same reason orgo is: a new release should add rules on your
schedule, not in the middle of an unrelated PR.

Layout: unified · split

.github/workflows/build.yml +22

		@@ -9,12 +9,34 @@ permissions:
9	9	contents: read
10	10
11	11	env:
	12	# Pinned so a new ruff release adds rules on your schedule, not mid-PR.
	13	RUFF_VERSION: "0.16.4"
12	14	# orgo is installed from crates.io, so nothing bumps this automatically —
13	15	# dependabot does not see `cargo install` in a workflow. Raise it by hand when
14	16	# a new orgo lands, which is also how you find out orgo broke the site.
15	17	ORGO_VERSION: "0.22.0"
16	18
17	19	jobs:
	20	# Separate from the build so a lint failure and a broken page are distinct
	21	# signals. build.py runs `ruff check --fix` and `ruff format` on development
	22	# builds; these are the verifying forms of the same two commands, reading
	23	# the same ruff.toml, so CI cannot disagree with a local dev build.
	24	lint:
	25	runs-on: ubuntu-latest
	26	steps:
	27	- uses: actions/checkout@v7
	28
	29	- name: Install ruff
	30	run: pipx install "ruff==$RUFF_VERSION"
	31
	32	- name: Lint
	33	run: \|
	34	ruff --version
	35	ruff check --no-fix
	36
	37	- name: Format
	38	run: ruff format --check --diff
	39
18	40	build:
19	41	runs-on: ubuntu-latest
20	42	steps:

Commit 44cb7ee485

Commit `44cb7ee485`