Skip to content

refactor(model_selection): resolve open CodeQL alerts; lock sf2-safe 22.2.0#217

Merged
bartzbeielstein merged 2 commits into
developfrom
fix/codeql-alerts
Jun 12, 2026
Merged

refactor(model_selection): resolve open CodeQL alerts; lock sf2-safe 22.2.0#217
bartzbeielstein merged 2 commits into
developfrom
fix/codeql-alerts

Conversation

@bartzbeielstein

Copy link
Copy Markdown
Collaborator

Summary

Fixes both open code-scanning alerts and brings the dependency lock back in line with the lecture consumer contract.

  • Alert chore: sync main into develop [skip ci] #85 (py/redundant-comparison, warning, model_selection/boundary.py): CodeQL mis-normalizes the inline pos > 1 - warn_frac / pos < warn_frac ternary and claims the second test is always true. The flag logic is now a shared _position_flag() helper with the threshold hoisted into a named variable — this removes the pattern CodeQL trips on and deduplicates identical logic in report_boundary_positions and boundary_report. No behavior change.
  • Alert chore(deps): bump spotforecast2-safe floor to >=6.0.0,<7.0 #84 (py/repeated-import, note, tests/test_multitask.py): removed the function-level import logging shadowing the module-level import.
  • Lock bump safe 22.1.0 → 22.2.0: the lecture qmd now passes include_football_match_window to ConfigEntsoe; the team4 consumer-contract gate flagged the stale lock. The exog-provider re-export test gains the two new event-window flags and asserts registry membership as a superset, so additive provider releases in sf2-safe no longer break this suite (removals still fail).

Both alerts are reported against main; they will auto-close on the next promotion.

Verification (full pre-push pipeline, all green)

  • uv run pytest tests/ -q — 1257 passed
  • uv run ruff check src/ tests/ — clean
  • uv run python docs/quartodoc_build.py && uv run quartodoc interlinks — OK
  • uv run quarto render --no-cache — 44/44 pages
  • uv tool run reuse lint — compliant

🤖 Generated with Claude Code

bartzbeielstein and others added 2 commits June 12, 2026 21:53
…ort (CodeQL)

Resolves both open code-scanning alerts:

- Alert 85 (py/redundant-comparison, warning): CodeQL mis-normalizes the
  inline "pos > 1 - warn_frac" / "pos < warn_frac" ternary in
  boundary_report and flags the second test as always true. Hoist the
  threshold into a named variable inside a shared _position_flag()
  helper, which also deduplicates the identical flag logic in
  report_boundary_positions and boundary_report.
- Alert 84 (py/repeated-import, note): remove the function-level
  "import logging" in tests/test_multitask.py that shadowed the
  module-level import.

No behavior change; black-format the module.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ntract)

The lecture qmd now passes include_football_match_window to ConfigEntsoe
(sf2-safe 22.2.0 event windows), which the team4 consumer-contract gate
correctly flagged against the 22.1.0 lock. Bump the lock (pin >=22,<23
already allows it) and sync the lockfile self-version to 8.1.0.

Add the two new provider flags (include_football_match_window,
include_energy_saving_window) to the exog-provider re-export test and
assert registry membership as a superset so additive provider releases
in sf2-safe no longer break sf2's suite; removals still fail.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@codecov

codecov Bot commented Jun 12, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@bartzbeielstein bartzbeielstein merged commit fbf1b1b into develop Jun 12, 2026
10 checks passed
@bartzbeielstein bartzbeielstein deleted the fix/codeql-alerts branch June 12, 2026 20:23
@bartzbeielstein

Copy link
Copy Markdown
Collaborator Author

🎉 This PR is included in version 8.1.1-rc.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

@bartzbeielstein

Copy link
Copy Markdown
Collaborator Author

🎉 This PR is included in version 8.1.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant