molecule-ai/molecule-core
52
0
Fork 2
Code Issues 175 Pull Requests 20 Actions 5 Packages Projects Releases Wiki Activity

[RCA] Suppression-comment audit 2026-05-24 #1769

New Issue
Closed
opened 2026-05-24 03:40:57 +00:00 by agent-researcher · 1 comment
agent-researcher commented 2026-05-24 03:40:57 +00:00
Member
Copy Link
Copy Source

MECHANISM: A bounded production-path scan of molecule-core@e5521c76 found a small set of lint/type suppressions where the local code path does not explain why the warning is safe. These are not runtime failures by themselves; the failure mode is future review drift, where # noqa / # type: ignore hides a real regression because the suppression lacks a local invariant. The main code paths are CI/operator scripts: .gitea/scripts/sop-checklist.py, scripts/ops/check_migration_collisions.py, and scripts/wheel_smoke.py.

EVIDENCE: Suppression hits reviewed outside tests/: .gitea/scripts/sop-checklist.py:640 (type: ignore[import-not-found]), .gitea/scripts/sop-checklist.py:660 (noqa: C901), .gitea/scripts/sop-checklist.py:1019 and :1026 (noqa: SLF001), scripts/ops/check_migration_collisions.py:94 (noqa: S310), and scripts/wheel_smoke.py:30-32,41-42,51 (noqa: F401). Several other suppressions are already justified inline, e.g. prod-auto-deploy.py:250 says "operator-friendly errors" and main-red-watchdog.py:228 says "intentional placeholder".

RECOMMENDED FIX SHAPE: Responsible repo/file set is molecule-ai/molecule-core, limited to the CI/operator scripts above. Add line-local rationale for each remaining suppression or replace the pattern with a typed/testable wrapper where the suppression is no longer needed. This should stay a documentation/guardrail cleanup, not a behavioral patch, unless the maintainer finds a suppression masking a real unsafe call.

MECHANISM: A bounded production-path scan of `molecule-core@e5521c76` found a small set of lint/type suppressions where the local code path does not explain why the warning is safe. These are not runtime failures by themselves; the failure mode is future review drift, where `# noqa` / `# type: ignore` hides a real regression because the suppression lacks a local invariant. The main code paths are CI/operator scripts: `.gitea/scripts/sop-checklist.py`, `scripts/ops/check_migration_collisions.py`, and `scripts/wheel_smoke.py`. EVIDENCE: Suppression hits reviewed outside `tests/`: `.gitea/scripts/sop-checklist.py:640` (`type: ignore[import-not-found]`), `.gitea/scripts/sop-checklist.py:660` (`noqa: C901`), `.gitea/scripts/sop-checklist.py:1019` and `:1026` (`noqa: SLF001`), `scripts/ops/check_migration_collisions.py:94` (`noqa: S310`), and `scripts/wheel_smoke.py:30-32,41-42,51` (`noqa: F401`). Several other suppressions are already justified inline, e.g. `prod-auto-deploy.py:250` says "operator-friendly errors" and `main-red-watchdog.py:228` says "intentional placeholder". RECOMMENDED FIX SHAPE: Responsible repo/file set is `molecule-ai/molecule-core`, limited to the CI/operator scripts above. Add line-local rationale for each remaining suppression or replace the pattern with a typed/testable wrapper where the suppression is no longer needed. This should stay a documentation/guardrail cleanup, not a behavioral patch, unless the maintainer finds a suppression masking a real unsafe call.
agent-researcher commented 2026-05-26 03:09:32 +00:00
Author
Member
Copy Link
Copy Source

RCA — root cause

A small set of production-path lint/type suppressions are still uncommented or under-explained, so the risk is review drift rather than an immediate runtime failure. The affected paths are CI/operator scripts where a future real regression could be hidden behind # noqa or # type: ignore without a local invariant.

Evidence

  • .gitea/scripts/sop-checklist.py:639 — yaml import uses type: ignore[import-not-found]; fallback parser exists but the suppression rationale is not line-local.
  • .gitea/scripts/sop-checklist.py:659 — _parse_minimal_yaml carries noqa: C901, matching a deliberately complex hand-rolled parser.
  • .gitea/scripts/sop-checklist.py:1018 and :1025 — private _req / _team_id_cache access uses noqa: SLF001 inside team lookup fallback.
  • scripts/ops/check_migration_collisions.py:94 — urllib.request.urlopen is suppressed with noqa: S310 for Gitea API access.
  • scripts/wheel_smoke.py:30, :41, and :51 — import smoke checks use noqa: F401 to assert published wheel surface names exist.

Suggested fix

Keep the fix scoped to molecule-ai/molecule-core CI/operator scripts: add line-local rationale beside each remaining suppression, or wrap the behavior so the suppression is no longer needed. This should be a guardrail/documentation cleanup unless maintainers find a suppression that is masking unsafe behavior.

Confidence

High — the referenced suppressions are present in the current tree and the failure mode is governance/review drift, not a failing test.

## RCA — root cause A small set of production-path lint/type suppressions are still uncommented or under-explained, so the risk is review drift rather than an immediate runtime failure. The affected paths are CI/operator scripts where a future real regression could be hidden behind `# noqa` or `# type: ignore` without a local invariant. ## Evidence - `.gitea/scripts/sop-checklist.py:639` — `yaml` import uses `type: ignore[import-not-found]`; fallback parser exists but the suppression rationale is not line-local. - `.gitea/scripts/sop-checklist.py:659` — `_parse_minimal_yaml` carries `noqa: C901`, matching a deliberately complex hand-rolled parser. - `.gitea/scripts/sop-checklist.py:1018` and `:1025` — private `_req` / `_team_id_cache` access uses `noqa: SLF001` inside team lookup fallback. - `scripts/ops/check_migration_collisions.py:94` — `urllib.request.urlopen` is suppressed with `noqa: S310` for Gitea API access. - `scripts/wheel_smoke.py:30`, `:41`, and `:51` — import smoke checks use `noqa: F401` to assert published wheel surface names exist. ## Suggested fix Keep the fix scoped to `molecule-ai/molecule-core` CI/operator scripts: add line-local rationale beside each remaining suppression, or wrap the behavior so the suppression is no longer needed. This should be a guardrail/documentation cleanup unless maintainers find a suppression that is masking unsafe behavior. ## Confidence High — the referenced suppressions are present in the current tree and the failure mode is governance/review drift, not a failing test.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/ci
CI/CD pipeline issues
 do-not-auto-merge
Opt out of autonomous merge-queue merging
 do-not-merge
hold from auto-merge (design review in progress)
 kind/infrastructure
Infrastructure-related issues
 merge-queue
Ready for serialized Gitea merge queue
 merge-queue-hold
Temporarily hold PR in merge queue
 platform/go
Go platform test issues
 release-blocker
Blocks the staging→main promotion / a release
 release-test
security
test-label-sre
tier:high
High risk per dev-sop §SOP-6 — ceo only, 24h cooldown
 tier:low
Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve
 tier:medium
Medium risk per dev-sop §SOP-6 — managers/ceo can approve
 triage-test
test
 wip
Work in progress — do not auto-merge
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 hongming-personal infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#1769
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?