ci: require one fast Dylint gate on every PR

[zackees]

Runs one Linux Dylint workspace pass on every PR with Soldr published 6.0.3/nightly-2026-05-28 tools. Other platform lint jobs retain their Python/Rust formatting/Clippy checks but explicitly skip Dylint. Local ./lint still runs Dylint by default; --skip-dylint is CI-only opt-out for the other jobs. Lint script tests: 9 passed. This deliberately removes native-platform Dylint coverage as requested.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Warning

Review limit reached

Next included review available in 36 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 01663710-0410-462e-80b0-2719e62cfaff

📥 Commits

Reviewing files that changed from the base of the PR and between 96ea031 and caaca5e.

📒 Files selected for processing (8)

• .github/workflows/_lint.yml
• Cargo.toml
• dylints/ban_std_pathbuf/.cargo/config.toml
• dylints/ban_std_pathbuf/README.md
• dylints/ban_std_pathbuf/rust-toolchain.toml
• lint
• tests/unit/test_dylint_version_check.py
• tests/unit/test_lint_script.py

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: ed625827-a8d1-4bd0-932a-4f99b8aa44ee

📥 Commits

Reviewing files that changed from the base of the PR and between 2441aa3 and 96ea031.

📒 Files selected for processing (6)

• .github/workflows/linux-arm-lint.yml
• .github/workflows/macos-arm-lint.yml
• .github/workflows/macos-x86-lint.yml
• .github/workflows/windows-x86-lint.yml
• lint
• tests/unit/test_lint_script.py

💤 Files with no reviewable changes (4)

• .github/workflows/macos-arm-lint.yml
• .github/workflows/macos-x86-lint.yml
• .github/workflows/windows-x86-lint.yml
• .github/workflows/linux-arm-lint.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The four native lint workflows no longer require the ci-full label condition to invoke the shared lint workflow. The lint script now fails when Dylint prerequisites are missing, including on local hosts. Tests cover both changes.

Changes

Dylint enforcement

Layer / File(s)	Summary
Run native lint workflows on pull requests .github/workflows/linux-arm-lint.yml, .github/workflows/macos-arm-lint.yml, .github/workflows/macos-x86-lint.yml, .github/workflows/windows-x86-lint.yml, tests/unit/test_lint_script.py	The four workflows remove the ci-full condition for the shared lint job. A parameterized test checks the pull-request trigger, shared workflow call, and absence of the label condition.
Fail when local Dylint prerequisites are missing lint, tests/unit/test_lint_script.py	The lint script exits with an error when prerequisites are missing instead of succeeding with a local skip. Tests check the local and CI error messages.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature · Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to 96ea0

Ordinary pull requests now reach the native Dylint jobs, and local lint runs fail when Dylint prerequisites are unavailable. No concrete merge-blocking issue is established; normal CI should confirm native-runner diagnostics.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to 96ea0

Ordinary pull requests will now run checked-out code on four native CI jobs. Dylint will fail rather than silently skip, but the broader CI execution path warrants confirmation of token permissions and cache isolation. No exploit was established.

Retained concerns

• Medium · security · inferred: Unlabelled PR code now reaches four native lint jobs that use a repository token during setup and shared native build caches. The effective security impact depends on token permissions and cache isolation not established by the available evidence; this is an expanded exposure, not a verified compromise.

Security review details

Security Blast Radius

• inferred — The newly reachable execution scope is up to four native CI jobs for an ordinary PR, not a changed production service or data store. Superseded PR runs are configured for cancellation.

Security Findings and Attack Paths

• inferred — An author able to submit a PR can cause its head revision to be linted without obtaining the former ci-full label. The available evidence does not demonstrate token misuse, cache poisoning, or access beyond the CI job.

Trust Boundaries and Controls

• observed — The shared job verifies the checked-out SHA before linting, while its setup action receives github.token. The visible workflow source does not bound that token with an explicit permissions declaration; effective repository settings are not supplied.

Resilience and Maintainability Implications

• observed — The Dylint prerequisite check fails closed, and the shared workflow attempts installation and verification before linting. This supports check integrity but does not establish successful execution on every native runner.

Hardening Proposals

• proposed — Before relying on the broader PR trigger, confirm the effective PR token permissions and native cache isolation, and explicitly scope job permissions if inherited access exceeds what lint needs.

🚥 Pre-merge checks | ✅ 3 | ❌ 1 | ❓ 1

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 1 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.
Linked Issues check	❓ Inconclusive	The changes implement the main #274 code paths. The Linux ARM, macOS ARM/x86, and Windows workflows now call _lint.yml for pull requests without the ci-full condition. ./lint now exits nonzero f…	Provide native Linux, Windows, and macOS CI evidence for a real Dylint run and representative OS-specific violation checks. Verify the missing, wrong-version, missing-rustup, and incompatible-nightly cases and their actionable errors after …

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary changes: requiring cross-platform Dylint for ordinary pull requests and enforcing Dylint availability in linting.
Out of Scope Changes check	✅ Passed	The pull request changes only the four platform lint workflow gates, the local ./lint Dylint failure behavior, and focused tests for those changes. These changes directly support #274. No unrelated …

Full details: Linked Issues check

Explanation

The changes implement the main #274 code paths. The Linux ARM, macOS ARM/x86, and Windows workflows now call _lint.yml for pull requests without the ci-full condition. ./lint now exits nonzero for missing or wrong-version cargo-dylint and for missing rustup after the earlier lint stages. The added tests cover the workflow declarations and the local missing-prerequisite result. The available evidence does not establish that native runners execute the real Dylint check for each OS, that representative OS-specific violations fail the required checks, or that an incompatible nightly produces the required actionable error. Native CI results and those prerequisite cases are required to decide compliance with the remaining #274 criteria.

Resolution

Provide native Linux, Windows, and macOS CI evidence for a real Dylint run and representative OS-specific violation checks. Verify the missing, wrong-version, missing-rustup, and incompatible-nightly cases and their actionable errors after the independent lint stages run.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 1 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}