This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch v3-3-test
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/v3-3-test by this push:
new f5fee914d20 Restore static checks on v3-3-test (#73046)
f5fee914d20 is described below
commit f5fee914d2015f3840ab858e5ed331e3f6ab4a84
Author: Jarek Potiuk <[email protected]>
AuthorDate: Sun Sep 13 04:55:47 2026 +0630
Restore static checks on v3-3-test (#73046)
Upgrading ruff to 0.16 and zizmor to 1.30 on this branch brought the new
tool versions without the changes main made alongside them, so every
--all-files static check run since has been red:
Ruff 0.16 widened its default rule set from roughly 250 to 510 rules.
main pins the base set explicitly so a tooling bump cannot enable rules
nobody chose; without that pin ruff reports 6278 violations here. Two of
them cascade: ruff's autofix rewrites setattr() calls to attribute
assignment, which then fails mypy, and reformatting those rewrites makes
ruff-format report a hundred files.
Zizmor 1.30 added two audits. self-repository cannot be satisfied in this
repository - main documents why - and unsound-ternary points at a real
bug, since a && '' || b never yields the empty string.
Claude-Session: https://claude.ai/code/session_01DcRW9x8n7Jor7ftsKFxQHD
---
.github/workflows/publish-docs-to-s3.yml | 2 +-
.github/workflows/run-unit-tests.yml | 4 ++--
.github/zizmor.yml | 18 ++++++++++++++++++
pyproject.toml | 11 +++++++++++
.../airflow_shared/plugins_manager/plugins_manager.py | 6 ++++--
.../src/airflow/sdk/execution_time/schema/AGENTS.md | 9 ++++++---
6 files changed, 42 insertions(+), 8 deletions(-)
diff --git a/.github/workflows/publish-docs-to-s3.yml
b/.github/workflows/publish-docs-to-s3.yml
index e81d5a5b153..8d7dbac0a9c 100644
--- a/.github/workflows/publish-docs-to-s3.yml
+++ b/.github/workflows/publish-docs-to-s3.yml
@@ -88,7 +88,7 @@ jobs:
AIRFLOW_VERSION: ${{ inputs.airflow-version || '' }}
APPLY_COMMITS: ${{ inputs.apply-commits || '' }}
outputs:
- include-docs: ${{ inputs.include-docs == 'all' && '' ||
inputs.include-docs }}
+ include-docs: ${{ case(inputs.include-docs == 'all', '',
inputs.include-docs) }}
destination-location: ${{ steps.parameters.outputs.destination-location
}}
destination: ${{ steps.parameters.outputs.destination }}
extra-build-options: ${{ steps.parameters.outputs.extra-build-options }}
diff --git a/.github/workflows/run-unit-tests.yml
b/.github/workflows/run-unit-tests.yml
index 415cad01d93..458ee33ca10 100644
--- a/.github/workflows/run-unit-tests.yml
+++ b/.github/workflows/run-unit-tests.yml
@@ -142,8 +142,8 @@ jobs:
timeout-minutes: ${{ fromJSON(inputs.job-timeout-minutes) }}
# yamllint disable rule:line-length
name: "\
- ${{ inputs.test-scope == 'All' && '' || inputs.test-scope ==
'Quarantined' && 'Qrnt' || inputs.test-scope }}\
- ${{ inputs.test-scope == 'All' && '' || '-' }}\
+ ${{ case(inputs.test-scope == 'Quarantined', 'Qrnt', inputs.test-scope
== 'All', '', inputs.test-scope) }}\
+ ${{ case(inputs.test-scope == 'All', '', '-') }}\
${{ inputs.test-group == 'providers' && 'prov' || inputs.test-group}}:\
${{ inputs.test-name }}${{ inputs.test-name-separator }}${{
matrix.backend-version }}:\
${{ matrix.python-version}}:${{ matrix.test-types.description }}"
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
index ef9fbc6d507..c0429fd3442 100644
--- a/.github/zizmor.yml
+++ b/.github/zizmor.yml
@@ -19,3 +19,21 @@
rules:
secrets-outside-env:
disable: true
+ # This audit wants every in-repo `uses: ./...` rewritten to GitHub's
+ # self-repository form (`uses: $/...`). Two things outside this repository's
+ # control block that, and both were confirmed by pushing the conversion:
+ #
+ # * `$/` makes the runner fetch apache/airflow as an action repository, and
+ # that download cannot materialise the symlinks this repository commits --
+ # it aborts on `.claude/skills/airflow-translations`, whose target is not
+ # tracked, before any job runs.
+ # * ASF infrastructure's allowlist check does not recognise the syntax and
+ # reports every `$/...` reference as an action missing from the allowlist.
+ #
+ # The audit's own threat model -- a privileged workflow loading a local
action
+ # out of a checkout untrusted code could have altered first -- does not reach
+ # us either, since no Airflow workflow runs on `pull_request_target` or
+ # `workflow_run`. Revisit if the symlinks go away and ASF Infra teaches the
+ # allowlist about `$/`.
+ self-repository:
+ disable: true
diff --git a/pyproject.toml b/pyproject.toml
index d5ee724ee41..35184d08d77 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -596,6 +596,10 @@ extend-exclude = [
[tool.ruff.lint]
typing-modules = ["airflow.typing_compat"]
external = ["MIG"]
+# Pin the base rule set instead of inheriting Ruff's default, which Ruff
changes
+# between releases (0.16 widened it from ~250 to ~510 rules). Everything
Airflow
+# actually opts into lives in extend-select below.
+select = ["E4", "E7", "E9", "F"]
extend-select = [
# Enable entire ruff rule section
"I", # Missing required import (auto-fixable)
@@ -704,6 +708,13 @@ ignore = [
"COM812",
"COM819",
"E501", # Formatted code may exceed the line length, leading to
line-too-long (E501) errors.
+ # New in Ruff 0.16, inside sections Airflow selects wholesale. Deferred so
a tooling
+ # bump does not also carry semantic changes; both need per-site judgement.
+ "ISC004", # Implicit string concat in a collection literal; 109 sites,
unsafe autofix
+ # LOG004 is not a mechanical replacement: switching to `.error()` where an
exception is
+ # in flight silently drops the traceback, while leaving `.exception()`
where none is
+ # only prints a bare `NoneType: None`. Review already caught one bad guess
in 13.
+ "LOG004", # `.exception()` outside an exception handler; 13 sites
]
unfixable = [
# PT022 replace empty `yield` to empty `return`. Might be fixed with a
combination of PLR1711
diff --git
a/shared/plugins_manager/src/airflow_shared/plugins_manager/plugins_manager.py
b/shared/plugins_manager/src/airflow_shared/plugins_manager/plugins_manager.py
index e8dea0d1294..baebc9f63cb 100644
---
a/shared/plugins_manager/src/airflow_shared/plugins_manager/plugins_manager.py
+++
b/shared/plugins_manager/src/airflow_shared/plugins_manager/plugins_manager.py
@@ -28,7 +28,7 @@ import os
import sys
import types
from pathlib import Path
-from typing import TYPE_CHECKING, Any
+from typing import TYPE_CHECKING, Any, cast
if TYPE_CHECKING:
if sys.version_info >= (3, 12):
@@ -177,7 +177,9 @@ def is_valid_plugin(plugin_obj) -> bool:
)
if is_airflow_plugin and plugin_obj.__name__ != "AirflowPlugin":
- plugin_obj.validate()
+ # The MRO check above establishes this by name; `inspect.isclass` only
narrows to
+ # `type[object]`, which does not carry `validate`.
+ cast("type[AirflowPlugin]", plugin_obj).validate()
return True
return False
diff --git a/task-sdk/src/airflow/sdk/execution_time/schema/AGENTS.md
b/task-sdk/src/airflow/sdk/execution_time/schema/AGENTS.md
index 0d844efe7ac..84c821bad2b 100644
--- a/task-sdk/src/airflow/sdk/execution_time/schema/AGENTS.md
+++ b/task-sdk/src/airflow/sdk/execution_time/schema/AGENTS.md
@@ -83,11 +83,14 @@ head shape *is* the schema for the new body.
)
```
-3. Reference the new `VersionChange` from the bundle in
- `versions/__init__.py`:
+3. Reference the new `VersionChange` from the bundle returned by
+ `get_bundle()` in `versions/__init__.py`:
```python
- Version("2026-06-16", AddRetryDelay, AddSentryTraceField),
+ return VersionBundle(
+ HeadVersion(),
+ Version("2026-06-16", AddRetryDelay, AddSentryTraceField),
+ )
```
4. The `generate-supervisor-schemas-snapshot` prek hook will
