tschm / pytest-alembic / 33149190887

100%

main: 100%

push

github

ci: resolve coveralls and tomli from the lockfile instead of installing them ad hoc.

Two steps installed CI-only packages from outside the lockfile: every `test` row ran
`uv pip install tomli coveralls`, and `finish` ran a bare `pip install tomli coveralls`
with no checkout and no uv at all. Every other tool CI uses is either locked or a
SHA-pinned action, so these two were the one place a third-party release could change
what CI ran with no commit to this repo.

They now live in a `ci` dependency group, which puts them in `uv.lock`, inside
`make audit-all`'s `--all-groups` sweep, and in dependabot's view.

The `test` row syncs them with `--only-group --inexact` so the group is added without
disturbing the sqlalchemy and pytest pins the earlier steps installed -- the re-sync
trap that #239 fixed for `uv run` applies just as well to a careless `uv sync` here. The
`finish` job gains the checkout and setup-uv steps it needs for the lockfile to be
present.

`make deps` gains `--group ci` for the reason it already passes `--group docs`: so deptry
introspects the real package rather than guessing its module name.

Part of #250; the second half of that issue (the scanning workflows) needs repository
settings access and is not part of this change.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

196 of 196 branches covered (100.0%)

Branch coverage included in aggregate %.

885 of 885 relevant lines covered (100.0%)

7.95 hits per line