Merge branch 'main' into dependabot/uv/torchvision-0.27.0

Author: leseb

.github/scripts/update_constraint_deps.py

@@ -167,25 +167,29 @@ def main() -> int:
     # 2. Try updating >= floors in regular dependency arrays
     if dep_indices:
         any_changed = False
-        skip_reasons = []
+        has_floor = False
         for idx in dep_indices:
             new_line, changed, reason = update_constraint(lines[idx], args.dependency_name, args.dependency_version)
             if changed:
                 lines[idx] = new_line
                 any_changed = True
+                has_floor = True
                 print(f"UPDATED (dependencies): {reason}")
-            else:
-                skip_reasons.append(reason)
+            elif "no >= lower bound" not in reason:
+                has_floor = True
+                print(f"SKIP (dependencies): {reason}")
         if any_changed:
             pyproject_path.write_text("".join(lines))
             print("updated=true")
-        else:
-            for r in skip_reasons:
-                print(f"SKIP (dependencies): {r}")
+            return 0
+        if has_floor:
             print("updated=false")
-        return 0
+            return 0
+        # Found in dependencies but no >= floor anywhere — fall through to
+        # add to constraint-dependencies so the version floor is tracked somewhere
 
-    # 3. Not found anywhere — add to constraint-dependencies
+    # 3. Not found in constraint-dependencies, and either not in regular deps
+    #    or present without a >= floor — add to constraint-dependencies
     lines, changed, reason = insert_constraint(lines, args.dependency_name, args.dependency_version)
     if not changed:
         print(f"SKIP: {reason}")

.github/workflows/commit-constraint-updates.yml

@@ -187,7 +187,7 @@ jobs:
           repository: ${{ steps.pr-info.outputs.head_repo }}
           ref: ${{ steps.pr-info.outputs.head_ref }}
           fetch-depth: 0
-          token: ${{ github.token }}
+          token: ${{ secrets.RELEASE_PAT }}
 
       - name: Restore artifacts after checkout
         if: steps.download-update.outputs.skip != 'true' && steps.changes.outputs.skip != 'true' && steps.pr-info.outputs.skip != 'true' && steps.pr-info.outputs.is_fork_pr != 'true'
@@ -222,7 +222,7 @@ jobs:
         id: commit
         if: steps.download-update.outputs.skip != 'true' && steps.changes.outputs.skip != 'true' && steps.pr-info.outputs.skip != 'true'
         env:
-          GH_TOKEN: ${{ steps.pr-info.outputs.is_fork_pr == 'true' && secrets.RELEASE_PAT || github.token }}
+          GH_TOKEN: ${{ secrets.RELEASE_PAT }}
           PR_NUMBER: ${{ steps.pr-info.outputs.pr_number }}
           HEAD_REPO: ${{ steps.pr-info.outputs.head_repo }}
           HEAD_REF: ${{ steps.pr-info.outputs.head_ref }}
@@ -260,7 +260,8 @@ jobs:
             fi
           else
             echo "Pushing to same-repo PR branch: $HEAD_REF"
-            git push origin "HEAD:${HEAD_REF}"
+            git push "https://x-access-token:${GH_TOKEN}@github.com/${BASE_REPO}.git" \
+              "HEAD:${HEAD_REF}"
             echo "Successfully pushed constraint updates"
             echo "pushed=true" >> "$GITHUB_OUTPUT"
           fi

pyproject.toml

@@ -341,22 +341,6 @@ convention = "google"
 "benchmarking/**/*.py" = ["D101", "S104", "S110", "S311"] # Ignore docstring and security rules for benchmarking scripts
 "client-sdks/**/*.py" = ["D101", "S110", "S112", "S113"] # Ignore docstring and security rules for client SDKs
 "scripts/**/*.py" = ["D101", "S110", "S112", "S603", "S607"] # Ignore docstring and security rules for scripts
-"src/ogx/providers/inline/scoring/basic/utils/ifeval_support.py" = [
-    "RUF001",
-]
-"src/ogx/providers/inline/scoring/basic/utils/ifeval_checkers_core.py" = [
-    "RUF001",
-]
-"src/ogx/providers/inline/scoring/basic/utils/ifeval_checkers_format.py" = [
-    "RUF001",
-]
-"src/ogx/providers/inline/scoring/basic/utils/ifeval_word_list.py" = [
-    "RUF001",
-]
-"src/ogx/providers/inline/scoring/basic/scoring_fn/fn_defs/regex_parser_multiple_choice_answer.py" = [
-    "RUF001",
-    "PLE2515",
-]
 "src/ogx/apis/**/__init__.py" = [
     "F403",
 ] # Using import * is acceptable (or at least tolerated) in an __init__.py of a package API
@@ -396,30 +380,26 @@ exclude = [
     # All files now have type annotations! 🎉
     #
     # ============================================================================
-    # Section 2: Files that need strict typing issues fixed (109 files)
+    # Section 2: Files that need strict typing issues fixed (91 files)
     # ============================================================================
     # These files have some type hints but fail strict type checking due to
     # incomplete annotations, Any usage, or other strict mode violations.
     #
-    # Core files (4 files)
-    "^src/ogx/core/server/quota\\.py$",
+    # Core files (3 files)
     "^src/ogx/core/server/routes\\.py$",
     "^src/ogx/core/server/server\\.py$",
     "^src/ogx/core/store/registry\\.py$",
-    # CLI files (8 files)
+    # CLI files (7 files)
     "^src/ogx/cli/stack/_list_deps\\.py$",
     "^src/ogx/cli/stack/list_apis\\.py$",
     "^src/ogx/cli/stack/list_deps\\.py$",
     "^src/ogx/cli/stack/list_providers\\.py$",
     "^src/ogx/cli/stack/run\\.py$",
     "^src/ogx/cli/stack/utils\\.py$",
     "^src/ogx/cli/subcommand\\.py$",
-    "^src/ogx/cli/utils\\.py$",
-    # Providers - Inline (27 files)
+    # Providers - Inline (22 files)
     "^src/ogx/providers/inline/batches/reference/__init__\\.py$",
     "^src/ogx/providers/inline/batches/reference/batches\\.py$",
-    "^src/ogx/providers/inline/eval/builtin/__init__\\.py$",
-    "^src/ogx/providers/inline/eval/builtin/eval\\.py$",
     "^src/ogx/providers/inline/file_processor/pypdf/__init__\\.py$",
     "^src/ogx/providers/inline/file_processor/pypdf/adapter\\.py$",
     "^src/ogx/providers/inline/file_processor/pypdf/pypdf\\.py$",
@@ -440,10 +420,7 @@ exclude = [
     "^src/ogx/providers/inline/vector_io/qdrant/__init__\\.py$",
     "^src/ogx/providers/inline/vector_io/sqlite_vec/__init__\\.py$",
     "^src/ogx/providers/inline/vector_io/sqlite_vec/sqlite_vec\\.py$",
-    # Providers - Remote (43 files)
-    "^src/ogx/providers/remote/eval/nvidia/__init__\\.py$",
-    "^src/ogx/providers/remote/eval/nvidia/config\\.py$",
-    "^src/ogx/providers/remote/eval/nvidia/eval\\.py$",
+    # Providers - Remote (40 files)
     "^src/ogx/providers/remote/files/openai/__init__\\.py$",
     "^src/ogx/providers/remote/files/s3/__init__\\.py$",
     "^src/ogx/providers/remote/inference/anthropic/__init__\\.py$",
@@ -484,30 +461,19 @@ exclude = [
     "^src/ogx/providers/remote/vector_io/infinispan/infinispan\\.py$",
     "^src/ogx/providers/remote/vector_io/oci/__init__\\.py$",
     "^src/ogx/providers/remote/vector_io/oci/oci26ai\\.py$",
-    # Providers - Utils (26 files)
+    # Providers - Utils (15 files)
     "^src/ogx/providers/utils/bedrock/client\\.py$",
     "^src/ogx/providers/utils/bedrock/config\\.py$",
     "^src/ogx/providers/utils/bedrock/refreshable_boto_session\\.py$",
-    "^src/ogx/providers/utils/common/data_schema_validator\\.py$",
     "^src/ogx/providers/utils/common/data_url\\.py$",
-    "^src/ogx/providers/utils/datasetio/url_utils\\.py$",
     "^src/ogx/providers/utils/inference/embedding_mixin\\.py$",
     "^src/ogx/providers/utils/inference/inference_store\\.py$",
     "^src/ogx/providers/utils/inference/model_registry\\.py$",
     "^src/ogx/providers/utils/inference/openai_compat\\.py$",
     "^src/ogx/providers/utils/inference/openai_mixin\\.py$",
     "^src/ogx/providers/utils/inference/prompt_adapter\\.py$",
-    "^src/ogx/providers/utils/kvstore/kvstore\\.py$",
-    "^src/ogx/providers/utils/kvstore/postgres/postgres\\.py$",
-    "^src/ogx/providers/utils/kvstore/redis/redis\\.py$",
     "^src/ogx/providers/utils/memory/vector_store\\.py$",
     "^src/ogx/providers/utils/responses/responses_store\\.py$",
-    "^src/ogx/providers/utils/scheduler\\.py$",
-    "^src/ogx/providers/utils/scoring/aggregation_utils\\.py$",
-    "^src/ogx/providers/utils/scoring/base_scoring_fn\\.py$",
-    "^src/ogx/providers/utils/telemetry/dataset_mixin\\.py$",
-    "^src/ogx/providers/utils/telemetry/trace_protocol\\.py$",
-    "^src/ogx/providers/utils/telemetry/tracing\\.py$",
     "^src/ogx/providers/utils/tools/mcp\\.py$",
     "^src/ogx/providers/utils/tools/ttl_dict\\.py$",
     "^src/ogx/providers/utils/vector_io/vector_utils\\.py$",
@@ -519,7 +485,7 @@ exclude = [
     "^src/ogx/testing/api_recorder\\.py$",
     #
     # ============================================================================
-    # Directory Excludes (35 directories)
+    # Directory Excludes (19 directories)
     # ============================================================================
     # These are entire directories excluded from type checking. Files within
     # these directories need to be analyzed individually and moved to Section 1
@@ -528,23 +494,13 @@ exclude = [
     # Core directories
     "^src/ogx/core/routers/",
     "^src/ogx/core/routing_tables/",
-    # Provider directories - Inline
-    "^src/ogx/providers/inline/datasetio/localfs/",
-    "^src/ogx/providers/inline/scoring/basic/",
-    "^src/ogx/providers/inline/scoring/braintrust/",
-    "^src/ogx/providers/inline/scoring/llm_as_judge/",
     # Provider directories - Remote
-    "^src/ogx/providers/remote/agents/sample/",
-    "^src/ogx/providers/remote/datasetio/huggingface/",
-    "^src/ogx/providers/remote/datasetio/nvidia/",
     "^src/ogx/providers/remote/inference/bedrock/",
     "^src/ogx/providers/remote/inference/nvidia/",
     "^src/ogx/providers/remote/inference/oci/",
     "^src/ogx/providers/remote/inference/passthrough/",
     "^src/ogx/providers/remote/inference/runpod/",
-
     "^src/ogx/providers/remote/inference/watsonx/",
-    "^src/ogx/providers/remote/post_training/nvidia/",
     "^src/ogx/providers/remote/tool_runtime/bing_search/",
     "^src/ogx/providers/remote/tool_runtime/brave_search/",
     "^src/ogx/providers/remote/tool_runtime/model_context_protocol/",

tests/unit/test_update_constraint_deps.py

@@ -54,6 +54,10 @@
     ]
 
     [dependency-groups]
+    dev = [
+        "ruff",
+        "black",
+    ]
     test = [
         "google-genai>=1.69.0",
     ]
@@ -455,6 +459,34 @@ def test_bare_dep_falls_through_to_constraint(self, tmp_path):
         assert "aiohttp>=3.14.0" in content
         assert "CVE-2026-34514" in content
 
+    def test_bare_dep_no_constraint_adds_to_constraints(self, tmp_path):
+        """A dep without a >= floor in dependencies and not in constraint-dependencies
+        gets added to constraint-dependencies."""
+        pyproject = tmp_path / "pyproject.toml"
+        pyproject.write_text(SAMPLE_PYPROJECT)
+
+        result = subprocess.run(
+            [
+                "python3",
+                str(_script_path),
+                "--dependency-name",
+                "ruff",
+                "--dependency-version",
+                "0.12.0",
+                "--pyproject",
+                str(pyproject),
+            ],
+            capture_output=True,
+            text=True,
+        )
+        assert result.returncode == 0
+        assert "updated=true" in result.stdout
+        assert "ADDED" in result.stdout
+        content = pyproject.read_text()
+        assert '"ruff>=0.12.0"' in content
+        # Original bare "ruff" in dev deps should be untouched
+        assert '    "ruff",\n' in content
+
     def test_missing_pyproject_returns_error(self, tmp_path):
         result = subprocess.run(
             [