refactor(model_selection): resolve open CodeQL alerts; lock sf2-safe 22.2.0

src/spotforecast2/model_selection/boundary.py

@@ -63,6 +63,26 @@
 _logger = logging.getLogger(__name__)
 
 
+def _position_flag(pos: float, warn_frac: float) -> str:
+    """Classify a normalized boundary position as near-upper, near-lower, or interior.
+
+    Args:
+        pos: Position of the tuned value inside its dimension, normalized to
+            ``[0, 1]`` in the dimension's own scale.
+        warn_frac: Fraction of the range defining the "near-boundary" zone at
+            each end.
+
+    Returns:
+        ``"> upper"``, ``"< lower"``, or ``""`` (interior).
+    """
+    upper_zone = 1.0 - warn_frac
+    if pos > upper_zone:
+        return "> upper"
+    if pos < warn_frac:
+        return "< lower"
+    return ""
+
+
 def report_boundary_positions(
     params: Mapping[str, float | int],
     search_space: Mapping[str, Any],
@@ -158,11 +178,7 @@ def report_boundary_positions(
                 )
             else:
                 pos = (float(val) - low) / (high - low)
-            flag = (
-                "> upper"
-                if pos > 1 - warn_frac
-                else ("< lower" if pos < warn_frac else "")
-            )
+            flag = _position_flag(pos, warn_frac)
             log.info(
                 "  bound %-18s = %-11.5g in [%g, %g]%s  pos=%.2f%s",
                 key,
@@ -266,11 +282,7 @@ def boundary_report(
             )
         else:
             pos = (float(val) - low) / (high - low)
-        flag = (
-            "> upper"
-            if pos > 1 - warn_frac
-            else ("< lower" if pos < warn_frac else "")
-        )
+        flag = _position_flag(pos, warn_frac)
         rows.append(
             {
                 "param": name.replace("estimator__", ""),
@@ -298,7 +310,9 @@ def boundary_report(
                 "Use report_boundary_positions() instead if you have unprefixed keys.",
                 numeric_dims,
             )
-        return pd.DataFrame(columns=["param", "low", "high", "value", "scale", "position", "flag"])
+        return pd.DataFrame(
+            columns=["param", "low", "high", "value", "scale", "position", "flag"]
+        )
     return df.sort_values("position", ascending=False).reset_index(drop=True)
 
 
@@ -389,11 +403,7 @@ def suggest_bounds(
 
     """
     report = boundary_report(best_params, search_space, warn_frac=warn_frac)
-    flagged = {
-        row["param"]: row["flag"]
-        for _, row in report.iterrows()
-        if row["flag"]
-    }
+    flagged = {row["param"]: row["flag"] for _, row in report.iterrows() if row["flag"]}
     out: dict[str, Any] = {}
     for name, spec in search_space.items():
         if not (isinstance(spec, tuple) and len(spec) in (2, 3)):

tests/test_exog_providers_reexport.py

@@ -30,6 +30,8 @@
     "include_entsoe_renewable_forecast",
     "include_entsoe_net_load",
     "include_entsoe_day_ahead_price",
+    "include_football_match_window",
+    "include_energy_saving_window",
 }
 
 
@@ -46,7 +48,9 @@ def test_registry_reexported_from_preprocessing():
         build_providers_from_config,
     )
 
-    assert set(EXOG_PROVIDER_REGISTRY) == EXPECTED_FLAGS
+    # Superset, not equality: additive provider releases in sf2-safe must not
+    # break sf2's suite; removals of expected flags still fail.
+    assert EXPECTED_FLAGS <= set(EXOG_PROVIDER_REGISTRY)
     assert issubclass(CovidInfectionRateProvider, ExogFeatureProvider)
     assert callable(build_providers) and callable(build_providers_from_config)
     # silence unused-import linters for the re-export assertions

tests/test_multitask.py

@@ -814,8 +814,6 @@ class TestCacheHomeResolution:
     """BaseTask must resolve cache_home=None to get_cache_home()."""
 
     def test_cache_home_none_resolves_to_default(self, tmp_path, monkeypatch):
-        import logging
-
         from spotforecast2_safe.data.fetch_data import get_cache_home
 
         # Redirect the package default so the test never touches the