ruff now checks the whole tree in CI and in `make lint` instead of only
modules/ and tests/. scripts/ and the root-level scripts ship to users
too and were going unlinted; the wider scope flags nothing today, which
makes now the cheap time to widen it.
Coverage floor raised 35 to 50 against an actual 53.21%.
meshcore-cli was the only dependency with no version floor. It is still
required — meshcore_cli.next_cmd backs contact and channel operations
with no equivalent in the meshcore library — so it is pinned rather than
dropped, and the reason is recorded next to it.
Removes the dead [tool.pytest.ini_options] block: pytest.ini takes
precedence, so those settings were never in effect and could only drift
from the ones that are.
CONTRIBUTING covers dev setup, reproducing all six CI jobs locally, and
the house rules a newcomer would otherwise trip over: append-only
migrations, config changes needing config.ini.example updates, new docs
pages needing an mkdocs nav entry, the ruff pin, and PRs targeting dev.
SECURITY routes reports through GitHub private vulnerability reporting
rather than an email address, with a 10-day acknowledgement and 30-day
assessment window. Scope names what this codebase actually exposes, and
explicitly puts the MeshCore protocol, RF-layer attacks, and running the
viewer without a password out of scope.
Issue forms collect the details every radio bug report needs — version,
transport, hardware, install method — and the feature form asks up front
whether a proposal spends mesh airtime. Blank issues stay enabled since
Discussions is not turned on, so they are the only route for questions.
Dependabot covers GitHub Actions weekly, where a stale or compromised
action is a real supply-chain risk. pip and npm are grouped and monthly:
runtime deps are >= ranges, so version updates are mostly floor bumps,
and security fixes arrive through Dependabot alerts regardless.
Tests (all four Python versions) failed on
test_over_budget_same_state_omits_prefix while passing locally. Root
cause: CI installed only ".[test]", leaving out the optional geo extra
(us, pycountry). normalize_us_state() returns (None, None) when `us` is
absent, so "Washington" no longer normalizes to "WA" and the AQI
prefix-budget path wrongly concluded the resolved state differed from
default_state, keeping the "Seattle, WA: " prefix.
Install ".[test,geo]" in both the test matrix and the mypy job. This
also un-skips ~27 geo-dependent tests that were silently skipping in CI
and which pass with the extra present.
Also ignore _debug/, a local scratch directory for captured configs and
logs that should never be committed.
- Added a `--strict` option to `validate_config.py` to fail on "Unknown section" messages, aimed at CI validation of example configs.
- Updated GitHub Actions workflow to validate shipped example configs against the canonical section list using the new strict mode.
- Expanded the `CANONICAL_NON_COMMAND_SECTIONS` in `config_validation.py` to include additional sections for improved validation accuracy.
- Introduced a regression test to ensure example configs do not trigger unknown section warnings, maintaining consistency with the canonical list.
- Updated the Makefile and GitHub Actions workflow to install ruff version 0.15.15, ensuring consistent linting behavior across environments.
- Added a required-version entry for ruff in pyproject.toml to prevent drift in lint rules.
- Modified the base_service.py method to return None instead of passing, improving clarity.
- Removed an unnecessary blank line in the test_packet_capture_transport_reconnect.py file.
Updated the GitHub Actions workflow to exclude the dist directory from shellcheck checks, ensuring cleaner linting results.
fix(command_manager): reorder datetime import
Moved the datetime import to the correct position in command_manager.py for better code organization.
fix(reload_config): improve config value retrieval
Refactored the _read_config_value function in reload_config.sh to ensure default values are returned correctly when the key is not found in the config file.
fix(tests): adjust imports in test_scheduler_logic
Updated import statements in test_scheduler_logic.py for consistency and clarity.
- Rewrite test_subscribe_packets/messages_emits_status_ack to match the
silent subscription UX from 1ee84f2.
- Reconcile Python version: requires-python>=3.10, ruff target py310, CI
matrix adds 3.13, pyupgrade UP0xx ignored pending a separate typing-rewrite
PR; fix two B905 zip(strict=...) lints.
- Issue #80 fix in find_recent_rf_data: return None when correlation_key is
provided but unmatched; prefer the longest observed path among samples
sharing a packet_hash; narrow the no-key fallback to a configurable
rf_fallback_window (default 2s).
- Issue #161: lower shipped max_response_hops default 10 -> 7.
- Add CHANGELOG.md, restructure BUGS.md around a ## v0.9.0 Fixed Bugs
table, prune crossed-out duplicate outstanding rows, and add a
Deferred-from-v0.9.0 triage section to TODO.md.
- Untrack coverage.json and add it to .gitignore.
Made-with: Cursor
Add scripts/check_log_injection.py to scan for unsanitized variables in
log calls and fail CI if new violations are introduced. Baseline is
committed at zero violations after fixing all 26 pre-existing ones.
Update TESTING.md with instructions for running the check locally.
- Modified the Dockerfile to set ownership of copied files directly during the copy operation, enhancing file permissions management.
- Updated the GitHub Actions workflow to limit the build platforms to linux/arm64 and linux/arm/v7, streamlining the build process for specific architectures.
These changes improve the efficiency and reliability of the Docker image build process.
Add .github/workflows/docker-build.yml triggered on push to main and
version tags. Builds linux/amd64, linux/arm64, and linux/arm/v7 via
QEMU. Attaches SBOM and provenance attestations to the image manifest.
Update Dockerfile with non-root user and current Python base image.
Add four jobs to .github/workflows/test.yml:
- lint: ruff check modules/ tests/ — zero violations enforced
- typecheck: mypy modules/ with incremental strict mode; per-module
disallow_untyped_defs where applicable
- lint-frontend: ESLint (eslint-plugin-html) + HTMLHint on templates/
- lint-shell: ShellCheck --severity=warning on all .sh files
Add [tool.ruff] and [tool.mypy] sections to pyproject.toml.
Add .eslintrc.json, .htmlhintrc, package.json for frontend tooling.
- pytest-timeout>=2.1.0 added; timeout=30s per test prevents runaway
tests from hanging CI
- asyncio_mode=auto in pyproject.toml [tool.pytest.ini_options]; async
tests run without per-test markers
- fail_under=27 in [tool.coverage.report] as the enforced coverage
floor; target 40% tracked in TASK-14
- CI test matrix updated for Python 3.9, 3.11, 3.12
- Added new pages to the documentation navigation, including Docker, Upgrade, and Guides sections.
- Updated mkdocs.yml to include the mkdocs-exclude plugin for better content management.
- Modified pyproject.toml to include mkdocs-exclude as a dependency.
- Adjusted GitHub Actions workflow to install the new dependency.
- Removed outdated link from the index.md documentation page.
- Enhanced .gitignore to allow test files in the tests/ directory and committed pytest.ini for test discovery.
- Added checks for missing sections in configuration files, specifically for Admin_ACL and Banned_Users, to prevent errors during bot startup.
- Updated generate_website.py and command_manager.py to handle cases where required sections are absent, returning empty lists instead of raising exceptions.
- Introduced optional dependencies for testing in pyproject.toml, ensuring a smoother development experience.
- Improved localization handling in core.py to default to English when the Localization section is missing, enhancing user experience.
- Deleted COMMANDS.md, DOCKER.md, WEB_VIEWER.md, and other related documentation files to streamline the project structure.
- Updated README.md and other documentation references to point to the new locations of the command and Docker instructions.
- Added optional dependencies for documentation generation in pyproject.toml.
Publish Docker image on push to main, master, dev and on v* tags.
Tag 'latest' is applied only for main and master branches.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Modified the Docker build workflow to enable the 'latest' tag only for the main or master branches, ensuring that the latest image is tagged appropriately based on the branch context.
- Added 'dev' branch to the trigger conditions for both push and pull_request events in the Docker build workflow, ensuring builds are initiated for development changes.
- Revised DOCKER.md to recommend building directly with `docker build` for improved compatibility on ARM devices and clarified the use of host network mode.
- Enhanced Dockerfile to utilize cache mounts for apt and pip installations, improving build efficiency and reducing redundant downloads.
- Updated GitHub Actions workflow to support multi-platform builds for both amd64 and arm64 architectures, ensuring broader compatibility.
- Added Docker deployment instructions to the README, including steps for creating data directories, updating configuration paths, and starting the application with Docker Compose.
- Updated .gitignore to include a new data directory structure, ensuring user-specific configurations, databases, and logs are ignored while maintaining the directory structure.
agessaman