[CHORE](ci) Python under .github/ escapes every lint and type gate

[sethfitz]

Type

Task

Scope

Multi-theme or Platform

Skillset

dev ops

Description

The three Python files under .github/ are covered by no gate:

.github/workflows/scripts/package_versions.py
.github/actions/detect-version-bumps/detect_version_bumps.py
.github/actions/create-package-release/extract_release_notes.py

[tool.ruff] src, mypy's files, and the pytest paths in the Makefile all point at packages/. Nothing has ever applied the repo's own configuration to these files.

That is not hypothetical. Running the repo's ruff config over them today reports two lint errors and two files needing reformatting:

find .github -name '*.py' -print0 | xargs -0 uv run ruff check
find .github -name '*.py' -print0 | xargs -0 uv run ruff format --check

These files are release automation — they compute version bumps, extract release notes, and read package versions. They are not throwaway: detect_version_bumps.py and package_versions.py feed the publish path, so a mistake in them is a mistake in a release.

Why this is being filed now

It surfaced while justifying a new top-level tests/ directory in the #604 / #668 documentation PR. .github/ is the repo's existing home for repo-wide process code, so it was the natural prior art to compare against — and the comparison showed that confining process code there also places it outside every check. Flagged in that PR's description for discussion; not fixed there, as it is unrelated to the documentation work.

Suggested approach

• Add the paths to lint-only (and its format counterpart) and to mypy's files.
• Check whether [tool.ruff] src needs entries so first-party imports classify correctly in those files.
• Fix whatever the two lint errors turn out to require — they looked like import ordering, but confirm rather than assume.
• Decide whether these scripts warrant tests. They have none, and a release-path bug is expensive; that is a larger question than wiring up the linters and can be split out.

Acceptance

find .github -name '*.py' -print0 | xargs -0 uv run ruff check and ruff format --check both pass, and make check fails if a future edit breaks them.

[lowlydba]

These are likely to be hoisted to generic-ized versions in our public workflows repo - so I am intentionally not being precious with them now. Likely many will be re-written in something other than Python (either simple bash, or using TS due to the robust js libs GitHub has available).

Generally, I don't like to apply codebase-specific lint rules to CI though - what is not acceptable in the schema packages likely varies greatly compared to the concerns of CI/Actions.