ci: lint with ruff's pyflakes rules, and fix what they find

[AlexS-scale]

What and why

CI does no static check of the Python code. This change adds ruff check with the pyflakes rules (F) to the unit job and fixes the 113 findings on main. The unit job is a required check, so the lint gate applies to all pull requests at once.

The findings:

• Undefined names (18). 17 annotations name a type that their module does not import, which a type checker reports. Each module now imports the type where it keeps its type-only imports, most of them under TYPE_CHECKING. That resolves the static finding only: typing.get_type_hints still cannot resolve a TYPE_CHECKING name at run time. One test patched get_config to return an undefined FakeConfig. The validator does not call get_config on that path, so the patch did nothing. The change removes it.
• Unused imports (54). Removed. bundle/__init__.py gets __all__ for its 14 re-exports, as the other packages have. The two re-exports in env/gateway/gateway.py are intentional; they get noqa: F401.
• f-strings without placeholders (22). Now plain strings.
• Unused variables (11). Removed. Where the call has an effect, the call stays. VerifyA2ASystemPromptStep read the registered agent and did not use it; the read is removed. In test_describe.py, the test name says that the report gives the config file's path, but the test did not check the path. Now it does.
• Redefinitions (8). Two duplicate imports are removed. Six tests request a fixture that their module imports from another module, which pyflakes reads as a redefinition. Those modules now import the fixture with a same-name alias (import local_stack as local_stack), which marks an intentional re-export. Their old noqa: F401 goes, and F811 still finds a duplicate test name.

ruff==0.16.10 is an exact pin in the dev extra, as griffelib is, because the findings change between releases. make lint runs the same check.

This change does not add type checking. On main, mypy reports 820 errors in 152 files, so type checking needs a separate plan.

How it was tested

• ruff check: no findings. A duplicate test name added to one of the fixture modules gives F811.
• make unit-test: 7812 passed, 16 skipped.
• check_plugin_api.py --base origin/main: no break to the plugin surface.

Confidence Score: 5/5

The PR appears safe to merge; no blocking issues were found.

Summary

Adds Ruff’s pyflakes checks to the required unit job and provides make lint.

• Pull requests run Ruff's pyflakes check before unit tests.
• Python cleanup leaves runtime behavior unchanged.
• Config description tests now check the reported file path.

_{Reviews (3) · Last reviewed commit: "Merge remote-tracking branch 'origin/mai..." · Reviewed by Greptile}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​ruff@​0.16.10

View full report