Pin ruff to 0.15.22 so CI stops breaking on linter releases - #6
Merged
Conversation
The lint step installed ruff unpinned, so the linter silently upgraded itself on every run. ruff 0.16.0, released 2026-07-23, promoted a number of rules into its default rule set (LOG015 root-logger calls, I001 import sorting, PLW1510 subprocess without check, and others depending on the repository). The result is a red build with no change to this repository at all. Fifteen repositories in the organisation are affected the same way; each of them lints clean on 0.15.22 and fails on 0.16.0. Pinning makes the lint result reproducible and turns the ruff upgrade into something Dependabot proposes and a human reviews, together with the code changes the new rules ask for — rather than something that lands unannounced in an unrelated pull request.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What broke
The lint step installed ruff unpinned:
so every CI run picked up whatever ruff had just been released. ruff 0.16.0 (2026-07-23) promoted several rules into its default set, and this repository went red with no change of its own.
How widespread
Every repository in the org that runs a blocking
ruff checkis affected — 15 of them. Verified by running each repo's own CI lint command under both versions:0.15.22(2026-07-16)0.16.0(2026-07-23)Four repositories had already gone red; the rest were waiting for their next push.
The fix
Pin ruff, so the lint result is reproducible:
Dependabot already watches this repository, so the 0.16.0 upgrade will now arrive as its own reviewable PR — together with the code changes the new rules ask for — instead of landing unannounced in an unrelated dependency bump.
Why not just fix the new findings instead
That is the right follow-up, but it should be a deliberate change: across the org the new rules produce several hundred findings (mostly
LOG015,I001,PLW1510). Doing it under time pressure, in a PR that is nominally about something else, is how the lint gate loses its meaning. Pin first, upgrade on purpose.