ci: add lint, format-check, and security gates to CI pipeline

Add three new CI enforcement layers that were previously missing:
- ruff lint + format check job (was only in Makefile, never enforced in CI)
- pip-audit dependency vulnerability scanning job
- Expanded ruff rules: S (bandit/security), B (bugbear), UP (pyupgrade)

Fix all resulting lint violations across src/ and tests/:
- B904: add proper exception chains (raise from e)
- E501: wrap long lines in help strings and docstrings
- S110: annotate intentional try/except/pass with noqa + justification
- S101: replace assert with proper guard in invoke_cmd
- B007: prefix unused loop variable with underscore
- UP022: use capture_output instead of stdout/stderr=PIPE

Add matching Makefile targets (format-check, security) and pin pip-audit
in dev dependencies for reproducible local runs.

Change-Id: I94d2355be83f4c44b144f217d2a0d0d5b74f5e2f
Co-developed-by: Claude <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: congxiao-wxx

.github/workflows/ci.yml

@@ -19,6 +19,31 @@ env:
   PIP_DISABLE_PIP_VERSION_CHECK: '1'
 
 jobs:
+  # ---------------------------------------------------------------------
+  # Lint & format check with ruff.
+  # ---------------------------------------------------------------------
+  lint:
+    name: Lint (ruff)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+          cache: 'pip'
+
+      - name: Install project + dev deps
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e ".[dev]"
+
+      - name: ruff check
+        run: ruff check src/ tests/
+
+      - name: ruff format check
+        run: ruff format --check src/ tests/
+
   # ---------------------------------------------------------------------
   # Static type check with mypy.
   # ---------------------------------------------------------------------
@@ -123,3 +148,26 @@ jobs:
           agentrun --version
           agentrun --help
           ar --version
+
+  # ---------------------------------------------------------------------
+  # Dependency vulnerability scan with pip-audit.
+  # Catches known CVEs in transitive dependencies before they ship.
+  # ---------------------------------------------------------------------
+  security:
+    name: Security (pip-audit)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+          cache: 'pip'
+
+      - name: Install project + dev deps
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e ".[dev]"
+
+      - name: Audit dependencies
+        run: pip-audit

Makefile

@@ -1,4 +1,4 @@
-.PHONY: help install dev lint test test-unit test-integration test-cov coverage clean build build-linux build-macos build-all
+.PHONY: help install dev lint format-check security test test-unit test-integration test-cov coverage clean build build-linux build-macos build-all
 
 PYTHON   ?= python3
 VENV     := .venv
@@ -26,6 +26,12 @@ dev: ## Install with dev dependencies
 lint: ## Run ruff linter
 	$(BIN)/ruff check src/ tests/
 
+format-check: ## Check code formatting (ruff format)
+	$(BIN)/ruff format --check src/ tests/
+
+security: ## Audit dependencies for known vulnerabilities
+	$(BIN)/pip-audit
+
 test: ## Run all tests (unit + integration)
 	$(BIN)/pytest tests/unit tests/integration -v
 

pyproject.toml

@@ -42,6 +42,7 @@ dev = [
     "ruff>=0.14.0",
     "mypy>=1.11.0",
     "types-PyYAML>=6.0",
+    "pip-audit>=2.7.0",
 ]
 
 [project.optional-dependencies]
@@ -52,14 +53,18 @@ dev = [
     "ruff>=0.14.0",
     "mypy>=1.11.0",
     "types-PyYAML>=6.0",
+    "pip-audit>=2.7.0",
 ]
 
 [tool.ruff]
 line-length = 88
 target-version = "py310"
 
 [tool.ruff.lint]
-select = ["E", "F", "I", "W"]
+select = ["E", "F", "I", "W", "S", "B", "UP"]
+
+[tool.ruff.lint.per-file-ignores]
+"tests/**" = ["S101", "S105", "S108", "S603", "S607"]
 
 [tool.mypy]
 # Start permissive: only check annotated code. Tighten incrementally by

src/agentrun_cli/_utils/config.py

@@ -23,7 +23,7 @@
 import json
 import os
 from pathlib import Path
-from typing import TYPE_CHECKING, Any, Optional
+from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
     from agentrun.utils.config import Config
@@ -42,7 +42,7 @@ def load_config() -> dict:
     """Load the config file. Returns an empty structure if the file is missing."""
     if not CONFIG_FILE.exists():
         return {"profiles": {}, "defaults": {"profile": "default", "output": "json"}}
-    with open(CONFIG_FILE, "r", encoding="utf-8") as f:
+    with open(CONFIG_FILE, encoding="utf-8") as f:
         return json.load(f)
 
 
@@ -54,27 +54,27 @@ def save_config(config: dict) -> None:
         f.write("\n")
 
 
-def get_profile(profile_name: Optional[str] = None) -> dict:
+def get_profile(profile_name: str | None = None) -> dict:
     """Return the settings dict for the given profile (or the default one)."""
     config = load_config()
     name = profile_name or config.get("defaults", {}).get("profile", "default")
     return config.get("profiles", {}).get(name, {})
 
 
-def set_profile_value(key: str, value: str, profile_name: Optional[str] = None) -> None:
+def set_profile_value(key: str, value: str, profile_name: str | None = None) -> None:
     """Set a single key inside a profile and save."""
     config = load_config()
     name = profile_name or config.get("defaults", {}).get("profile", "default")
     config.setdefault("profiles", {}).setdefault(name, {})[key] = value
     save_config(config)
 
 
-def get_profile_value(key: str, profile_name: Optional[str] = None) -> Optional[str]:
+def get_profile_value(key: str, profile_name: str | None = None) -> str | None:
     """Read a single key from the active profile."""
     return get_profile(profile_name).get(key)
 
 
-def _env(*names: str) -> Optional[str]:
+def _env(*names: str) -> str | None:
     """Return the first non-empty env var value, or None."""
     for name in names:
         val = os.getenv(name)
@@ -84,8 +84,8 @@ def _env(*names: str) -> Optional[str]:
 
 
 def build_sdk_config(
-    profile_name: Optional[str] = None,
-    region: Optional[str] = None,
+    profile_name: str | None = None,
+    region: str | None = None,
 ) -> "Config":
     """Build an ``agentrun.utils.config.Config`` from CLI context.
 
@@ -101,28 +101,35 @@ def build_sdk_config(
 
     profile = get_profile(profile_name)
 
-    ak = (profile.get("access_key_id")
-          or _env("AGENTRUN_ACCESS_KEY_ID", "ALIBABA_CLOUD_ACCESS_KEY_ID")
-          or None)
-    sk = (profile.get("access_key_secret")
-          or _env("AGENTRUN_ACCESS_KEY_SECRET", "ALIBABA_CLOUD_ACCESS_KEY_SECRET")
-          or None)
-    token = (profile.get("security_token")
-             or _env("AGENTRUN_SECURITY_TOKEN", "ALIBABA_CLOUD_SECURITY_TOKEN")
-             or None)
-    account = (profile.get("account_id")
-               or _env("AGENTRUN_ACCOUNT_ID", "FC_ACCOUNT_ID")
-               or None)
-    rid = (region
-           or profile.get("region")
-           or _env("AGENTRUN_REGION", "FC_REGION")
-           or None)
-    control_endpoint = (profile.get("control_endpoint")
-                        or _env("AGENTRUN_CONTROL_ENDPOINT")
-                        or None)
-    data_endpoint = (profile.get("data_endpoint")
-                     or _env("AGENTRUN_DATA_ENDPOINT")
-                     or None)
+    ak = (
+        profile.get("access_key_id")
+        or _env("AGENTRUN_ACCESS_KEY_ID", "ALIBABA_CLOUD_ACCESS_KEY_ID")
+        or None
+    )
+    sk = (
+        profile.get("access_key_secret")
+        or _env("AGENTRUN_ACCESS_KEY_SECRET", "ALIBABA_CLOUD_ACCESS_KEY_SECRET")
+        or None
+    )
+    token = (
+        profile.get("security_token")
+        or _env("AGENTRUN_SECURITY_TOKEN", "ALIBABA_CLOUD_SECURITY_TOKEN")
+        or None
+    )
+    account = (
+        profile.get("account_id")
+        or _env("AGENTRUN_ACCOUNT_ID", "FC_ACCOUNT_ID")
+        or None
+    )
+    rid = (
+        region or profile.get("region") or _env("AGENTRUN_REGION", "FC_REGION") or None
+    )
+    control_endpoint = (
+        profile.get("control_endpoint") or _env("AGENTRUN_CONTROL_ENDPOINT") or None
+    )
+    data_endpoint = (
+        profile.get("data_endpoint") or _env("AGENTRUN_DATA_ENDPOINT") or None
+    )
 
     # Propagate resolved values to env vars so that SDK-internal Config()
     # instances (created without explicit config) also pick them up.

src/agentrun_cli/_utils/error.py

@@ -14,13 +14,12 @@
 
 import functools
 import sys
-from typing import Callable
+from collections.abc import Callable
 
 import click
 
 from agentrun_cli._utils.output import echo_error
 
-
 EXIT_SUCCESS = 0
 EXIT_NOT_FOUND = 1
 EXIT_BAD_INPUT = 2

src/agentrun_cli/_utils/inner_client.py

@@ -5,14 +5,12 @@
 high-level SDK resource classes.
 """
 
-from typing import Optional
-
 from agentrun_cli._utils.config import build_sdk_config
 
 
 def get_agentrun_client(
-    profile_name: Optional[str] = None,
-    region: Optional[str] = None,
+    profile_name: str | None = None,
+    region: str | None = None,
 ):
     """Build a low-level AgentRun API client from CLI context.
 

src/agentrun_cli/_utils/output.py

@@ -8,8 +8,8 @@
 """
 
 import json
-import sys
-from typing import Any, List, Optional, Sequence
+from collections.abc import Sequence
+from typing import Any
 
 import click
 
@@ -19,7 +19,7 @@ def echo_json(data: Any) -> None:
     click.echo(json.dumps(data, indent=2, ensure_ascii=False, default=str))
 
 
-def echo_table(rows: Sequence[dict], columns: Optional[List[str]] = None) -> None:
+def echo_table(rows: Sequence[dict], columns: list[str] | None = None) -> None:
     """Render a list of dicts as a rich table.
 
     Falls back to JSON if ``rich`` is unavailable.
@@ -44,7 +44,7 @@ def echo_table(rows: Sequence[dict], columns: Optional[List[str]] = None) -> Non
     Console().print(table)
 
 
-def echo_quiet(data: Any, field: Optional[str] = None) -> None:
+def echo_quiet(data: Any, field: str | None = None) -> None:
     """Print only the most relevant value — useful for shell pipelines.
 
     Heuristic for picking the value:
@@ -68,7 +68,9 @@ def echo_quiet(data: Any, field: Optional[str] = None) -> None:
     click.echo(str(data))
 
 
-def format_output(ctx: click.Context, data: Any, quiet_field: Optional[str] = None) -> None:
+def format_output(
+    ctx: click.Context, data: Any, quiet_field: str | None = None
+) -> None:
     """Route *data* to the appropriate formatter based on ``ctx.obj["output"]``."""
     fmt = (ctx.obj or {}).get("output", "json")
 
@@ -92,7 +94,7 @@ def format_output(ctx: click.Context, data: Any, quiet_field: Optional[str] = No
         echo_json(data)
 
 
-def echo_error(error_type: str, message: str, hint: Optional[str] = None) -> None:
+def echo_error(error_type: str, message: str, hint: str | None = None) -> None:
     """Write a structured JSON error to stderr.
 
     When *hint* is provided it is included as a ``hint`` field in the JSON

src/agentrun_cli/_utils/super_agent_render.py

@@ -13,7 +13,6 @@
 import enum
 import json
 import sys
-from typing import Optional
 
 import click
 
@@ -24,9 +23,7 @@ class RenderMode(str, enum.Enum):
     TEXT_ONLY = "text-only"
 
 
-def pick_render_mode(
-    *, is_tty: bool, raw: bool, text_only: bool
-) -> RenderMode:
+def pick_render_mode(*, is_tty: bool, raw: bool, text_only: bool) -> RenderMode:
     """Resolve render mode from TTY + user flags.
 
     Raises ValueError if --raw and --text-only are both set.
@@ -43,7 +40,7 @@ def pick_render_mode(
 _TOOL_RESULT_PREVIEW_LIMIT = 200
 
 
-def _event_name(event, payload: dict) -> Optional[str]:
+def _event_name(event, payload: dict) -> str | None:
     """Resolve the AG-UI event type.
 
     The real server streams SSE with an empty ``event:`` field and puts the
@@ -65,18 +62,14 @@ def __init__(
         self,
         mode: RenderMode,
         *,
-        use_color: Optional[bool] = None,
+        use_color: bool | None = None,
         stream=None,
     ):
         self.mode = mode
-        self._conversation_id: Optional[str] = None
+        self._conversation_id: str | None = None
         self._out = stream if stream is not None else sys.stdout
         if use_color is None:
-            use_color = (
-                self._out.isatty()
-                if hasattr(self._out, "isatty")
-                else False
-            )
+            use_color = self._out.isatty() if hasattr(self._out, "isatty") else False
         self._use_color = use_color
 
     def set_conversation_id(self, conv_id: str) -> None:
@@ -95,7 +88,7 @@ def finish(self) -> None:
         """Called at stream end. Flushes anything buffered."""
         try:
             self._out.flush()
-        except Exception:
+        except Exception:  # noqa: S110 — broken-pipe on flush is harmless
             pass
 
     def finish_with_envelope(self) -> None:
@@ -110,7 +103,7 @@ def finish_with_envelope(self) -> None:
             self._out.write(json.dumps(envelope, ensure_ascii=False) + "\n")
             try:
                 self._out.flush()
-            except Exception:
+            except Exception:  # noqa: S110 — broken-pipe on flush is harmless
                 pass
 
     # ───────────────────────────────────────── internal renderers
@@ -164,9 +157,7 @@ def _render_pretty(self, event) -> None:
             msg = payload.get("message", "") if payload else ""
             self._write_error(f"✖ run error: {msg}\n")
         elif name == "RUN_FINISHED":
-            self._out.write(
-                "─────────────────────────────────────────────\n"
-            )
+            self._out.write("─────────────────────────────────────────────\n")
 
     def _write_meta(self, text: str) -> None:
         if self._use_color: