fix(scan_github): skip test files before temp-write to prevent _is_test_file bypass

scan_github writes each file to a random temp path (e.g. /tmp/tmpXXX.py),
losing the original filename.  The call-site checker's _is_test_file check
on call.file then always sees a non-test name and never suppresses test-file
violations.  Corpus batch 25: celery/django-celery-beat had 50/54
save_without_update_fields violations in t/unit/test_*.py — all FPs.

Fix: skip test-named files in the GitHub path loop before download+extraction,
mirroring _is_test_file logic (basename test_ prefix, _test.py suffix, or
test/tests/testing directory component).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Your Name

scan_github.py

@@ -223,6 +223,16 @@ def scan_repo(
 
     # Process up to max_files to avoid runaway on monorepos
     for path in py_files[:max_files]:
+        # Skip test files: temp file loses original name so _is_test_file in the
+        # call-site checker won't fire — skip here at the source instead.
+        _basename = path.split("/")[-1]
+        _parts = path.split("/")
+        if (
+            _basename.startswith("test_")
+            or _basename.endswith("_test.py")
+            or any(p in {"test", "tests", "testing"} for p in _parts)
+        ):
+            continue
         source = fetch_file_content(owner, repo, path, default_branch, session)
         if not source:
             continue

test_checker.py

@@ -635,6 +635,26 @@ def test_update(self):
     assert not v, f"save() in test files must not be flagged: {v}"
 
 
+def test_save_in_subdir_test_file_not_flagged(tmp_path):
+    # Regression: celery/django-celery-beat t/unit/test_schedulers.py leaked through
+    # scan_github because temp files lose the original name, making _is_test_file miss
+    # basename-prefixed test files nested under non-test directories (t/unit/).
+    # The fix: skip test-named files in scan_github *before* writing the temp file.
+    # Locally, check_codebase detects test files correctly via basename.
+    test_dir = tmp_path / "t" / "unit"
+    test_dir.mkdir(parents=True)
+    (test_dir / "test_schedulers.py").write_text(
+        "import django.db.models\n"
+        "def test_update():\n"
+        "    m = MyModel.objects.get(pk=1)\n"
+        "    m.enabled = True\n"
+        "    m.save()\n"
+    )
+    violations = check_codebase(tmp_path)
+    v = [v for v in violations if v.context == "save_without_update_fields"]
+    assert not v, f"save() in t/unit/test_*.py must not be flagged: {v}"
+
+
 def test_objects_get_not_flagged_as_optional(tmp_path):
     # Corpus: EvalAI — token = JwtToken.objects.get(user=user); token.refresh_token
     # Model.objects.get() raises DoesNotExist, never returns None.