ci: sync the dev group in the workflows that run ci_unit.sh (ADR-1122) - #910

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Claude finished @cdeust's task in 2m 19s —— View job

PR #910 review (1 of 3)

• Read the diff, uv-locked-install, ci_unit.sh, ci_mutation_diff.py and pyproject.toml
• Ran five reviews: code quality, performance, tests, docs, security
• Checked the main claims myself: memory-exact-review runs on workflow_dispatch only, and the set: lines on origin/main lack --group dev
• Posted the review: ci: sync the dev group in the workflows that run ci_unit.sh (ADR-1122) #910 (comment)

No Blockers. The review lists three Notes: the CHANGELOG wording for memory-exact-review, the substring match in the test, and the mutation-gate runtime and missing timeout in supersession-delete-parity.

I could not run the new test because running pytest needed an approval this job did not have. Reading the origin/main workflows shows it would fail there.

Verdict: approve

Review 1 of 3 (ADR-1119)

I reviewed code quality, performance, tests, docs and security, and found no Blockers.

• Fix: uv-locked-install runs uv sync --no-default-groups (action.yml:40), and mutmut is only in [dependency-groups] dev (pyproject.toml:648-650). Adding --group dev to the set: line installs it, so the gate at scripts/ci_unit.sh:76 can find it.
• Regression test: on origin/main, both set: lines end at --group lint, so the new test would fail there. It is collected by the normal run (testpaths = ["tests_py"]).
• Security: mutmut 3.8.1 is hash-pinned in uv.lock. The set: values are fixed strings, the triggers stay pull_request/workflow_dispatch, and contents: read is unchanged.

Notes, no action before merge

• CHANGELOG.md: memory-exact-review.yml only runs on workflow_dispatch, so GITHUB_BASE_REF is empty there and ci_mutation_diff.py:275-277 skips the gate. Only supersession-delete-parity could hit "Failed to spawn: mutmut".
• test_mutation_workflows_install_mutmut.py:32: "--group dev" in value is a substring check, so --group devtools would also pass. A token match such as re.findall(r"--group[ =](\S+)", ...) would be exact.
• supersession-delete-parity.yml head step: the full mutation gate now runs serially (MUTMUT_MAX_CHILDREN=1). It repeats the work of the ci.json unit job, and the job has no timeout-minutes. Consider GITHUB_BASE_REF= on that step or adding a timeout.

Verdict: approve