Quality work

.github/copilot-setup-steps.yml

@@ -0,0 +1,15 @@
+steps:
+  - name: Install uv
+    uses: astral-sh/setup-uv@v4
+  - name: Install Rust toolchain
+    uses: dtolnay/rust-toolchain@stable
+  - name: Install cargo-audit
+    run: cargo install --locked cargo-audit
+  - name: Install Python
+    run: uv python install
+  - name: Build extension and install project
+    run: uv sync --dev && uv run maturin develop --release
+  - name: Install ruff and pip-audit globally
+    run: uv tool install ruff && uv tool install pip-audit
+  - name: Pre-download embedding model
+    run: uv run python -c "from sentence_transformers import SentenceTransformer; SentenceTransformer('BAAI/bge-small-en-v1.5'); print('Model cached successfully')"

.github/workflows/quality.yml

@@ -0,0 +1,57 @@
+name: Quality Gate
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+
+env:
+  TRANSFORMERS_OFFLINE: "1"
+  HF_DATASETS_OFFLINE: "1"
+
+jobs:
+  quality-gate:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
+
+      - uses: astral-sh/setup-uv@v4
+
+      - name: Install cargo-audit
+        run: cargo install --locked cargo-audit
+
+      - name: Set up Python
+        run: uv python install
+
+      - name: Install dependencies
+        run: uv sync --dev
+
+      - name: Build extension
+        run: uv run maturin develop --release
+
+      - name: Rust format check
+        run: cargo fmt --check
+
+      - name: Rust lint (clippy)
+        run: cargo clippy -- -D warnings
+
+      - name: Python lint
+        run: uv run ruff check .
+
+      - name: Python format check
+        run: uv run ruff format --check .
+
+      - name: Tests + coverage
+        run: uv run pytest --cov --cov-report=xml --cov-fail-under=60
+
+      - name: Python security audit
+        run: uv run pip-audit
+
+      - name: Rust security audit
+        run: cargo audit

pyproject.toml

@@ -6,8 +6,12 @@ readme = "README.md"
 requires-python = ">=3.12"
 dependencies = [
     "fastmcp>=3.2.0",
+    "authlib>=1.6.11",
+    "cryptography>=46.0.7",
     "lancedb==0.30.0",
     "sentence-transformers>=5.3.0",
+    "python-multipart>=0.0.27",
+    "urllib3>=2.7.0",
 ]
 
 [project.optional-dependencies]
@@ -19,6 +23,7 @@ contextwell = "contextwell.server:run"
 [dependency-groups]
 dev = [
     "maturin>=1.12.6",
+    "pip-audit>=2.0.0",
     "pytest>=9.0.2",
     "pytest-cov>=7.1.0",
     "rank-bm25>=0.2.2",
@@ -110,4 +115,3 @@ omit = ["tests/*", "*/__pycache__/*"]
 [tool.coverage.report]
 skip_empty = true
 show_missing = true
-

src/lib.rs

@@ -29,7 +29,11 @@ impl MemoryRecord {
     }
 
     fn __repr__(&self) -> String {
-        format!("MemoryRecord(id={:?}, score={:.4})", &self.id[..8.min(self.id.len())], self.score)
+        format!(
+            "MemoryRecord(id={:?}, score={:.4})",
+            &self.id[..8.min(self.id.len())],
+            self.score
+        )
     }
 }
 

tests/test_integration.py

@@ -1496,11 +1496,7 @@ def test_file_import_source_single_definition_keeps_definition_boundary(tmp_path
 
     source_file = tmp_path / "single_def.py"
     source_file.write_text(
-        "import os\n\n\n"
-        "def only_one() -> int:\n"
-        "    a = 1\n"
-        "    b = 2\n"
-        "    return a + b\n",
+        "import os\n\n\ndef only_one() -> int:\n    a = 1\n    b = 2\n    return a + b\n",
         encoding="utf-8",
     )