ci: Continuous Improvement and Security Enhancements

[NITISH-R-G]

I noticed the codebase lacked continuous validation in CI despite having a robust local script. I've updated the GitHub Actions workflow to run the full suite (including new additions like bandit and openenv-core) on PRs. I also modernized syntax (using X | None instead of Optional[X], removing blind except Exception:, adding mypy ignores for dynamically evaluated Gradio methods) and fixed the .gitignore to prevent caching issues. This ensures the repo remains clean and strictly typed as it grows.

---

PR created automatically by Jules for task 3709136281791188684 started by @NITISH-R-G

Summary by Sourcery

Strengthen CI and security tooling while modernizing typing and minor utilities across the EV grid oracle codebase.

New Features:

• Add Bandit-based security scanning and OpenEnv environment validation to the CI pipeline.

Bug Fixes:

• Normalize clamping helpers to avoid overflows by consistently bounding values with min-based logic.
• Prevent EV slot counts from exceeding station capacity when scenario modifiers reduce total slots.
• Ensure deterministic city graph connectivity reporting and stable hashing by using safer encoding defaults.

Enhancements:

• Adopt modern Python type syntax (X | None, Literal, TypedDict) and clean up unused typing imports across core modules and visualizations.
• Clarify oracle vs baseline behavior selection in Gradio demo and multi-agent server flows for improved readability and maintainability.
• Tighten role metrics aggregation, reward hack tracking, and routing utilities to be more idiomatic and robust.
• Relax Ruff configuration to focus on targeted rule sets while ignoring noisy checks.

CI:

• Expand the code-quality GitHub Actions workflow to install additional tooling, run pytest with explicit PYTHONPATH, pin jscpd, and exclude build artifacts from duplicate-code checks.

Documentation:

• Update the cycle report to document CI modernization, including security scanning and OpenEnv validation requirements.

Tests:

• Integrate Bandit and coverage-aware helpers into the health dashboard tooling for richer test and security reporting.

Chores:

• Adjust .gitignore entries (not shown in diff body) to reduce caching issues and keep the repository clean.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 727ea330-3e28-447a-8176-47dbd430cb22

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Reviewer's Guide

Modernizes typing and control flow across env, parsing, oracle, viz, and server modules, tightens reward logic, updates CI for security and OpenEnv validation, and adds mypy/ruff-specific tweaks while keeping behavior stable, plus minor docs and import hygiene.

Sequence diagram for Gradio demo step_once baseline vs oracle flow

sequenceDiagram
    actor User
    participant GradioUI
    participant step_once
    participant baseline_policy
    participant OracleAgent

    User->>GradioUI: click step/run
    GradioUI->>step_once: step_once(sess, mode, oracle_lora_repo)

    alt mode == ambient
        step_once->>step_once: ActionType.load_shift
    else mode == Untrained Baseline
        step_once->>baseline_policy: baseline_policy(state, sess.env.city_graph)
        baseline_policy-->>step_once: EVGridAction
        step_once->>step_once: update sess.last_action_text
    else mode == Oracle Agent
        step_once->>step_once: normalize oracle_lora_repo
        step_once->>OracleAgent: OracleAgent(lora_repo_id=oracle_lora_repo or None)
        step_once->>OracleAgent: act(state, prompt, sess.env.city_graph)
        OracleAgent-->>step_once: EVGridAction
        step_once->>step_once: update sess.last_action_text with tag
    end

    step_once->>sess.env: step(action)
    sess.env-->>step_once: EVGridObservation
    step_once-->>GradioUI: updated state, img, text, kpi

Loading

Flow diagram for updated backend code-quality CI pipeline

flowchart TD
    A[code-quality job start] --> B[Checkout repo]
    B --> C[Set up Python]
    C --> D[Install deps: ruff, mypy, vulture, radon, bandit, openenv-core]
    D --> E["Install package: editable .[dev,demo]"]
    E --> F[Ruff lint & format]
    F --> G[mypy type-check]
    G --> H[Bandit security scan]
    H --> I[Vulture dead code]
    I --> J[Radon complexity]
    J --> K[Pytest with PYTHONPATH=.]
    K --> L[openenv validate .]
    L --> M[Job complete]

Loading

File-Level Changes

Change	Details	Files
Update GitHub Actions CI to run full quality and security suite and OpenEnv validation, and tune frontend duplicate-code detection.	Install bandit and openenv-core alongside existing Python tooling in CI. Add a Bandit security scan step using pyproject configuration. Run pytest with PYTHONPATH=. for correct package resolution. Add an OpenEnv openenv validate . step after tests. Pin jscpd to 4.0.0 and broaden ignore patterns to include build artifacts and virtual envs.	.github/workflows/code-quality.yml
Modernize typing and clamp helpers, and add minor logic fixes across core env, parsing, oracle agent, reward hack, traffic, grid sim, city graph, world-model verifier, road models, personas, and related utilities.	Replace Optional[...] / Tuple[...] annotations with `X	Noneandtuple[...]` throughout core env, parsing, oracle, viz, city, road, and training code. Simplify clamp logic to use min(...) patterns for upper bounds in normalization helpers and scoring functions. Ensure city graph connectivity error message builds components via sorted(...) directly on the generator. Use dict.fromkeys(...) for role metric initialization and iterate directly over dicts. Switch hashlib/sha1 and encode() calls to default encoding for minor cleanup and consistency. Tighten reward hack defer streak reset logic by removing unnecessary nested branch. Adjust regex flags from short forms (e.g., re.I) to explicit constants for clarity. Align RoadAction and EVGridAction model_validator return type annotations with concrete class types.
Clean up server imports and typing for demo/multi-agent session management and hashing, and silence mypy/ruff warnings where necessary.	Reorder imports in server app to group stdlib, third-party, and local modules; add missing imports for networkx and road models; and use OrderedDict type hints directly instead of string annotations. Avoid unused variable warnings by prefixing unused tuple members with underscores. Use .encode() without explicit utf-8 in hashing for ambient selection and BESCOM seed generation. Type _demo_sessions and _ma_sessions as OrderedDict[...] with concrete generics for stricter typing. Adjust ma_auto_step oracle guard unpacking to mark unused values and keep behavior unchanged.	server/app.py ev_grid_oracle/bescom_feed.py
Fix Gradio demo wiring and silence dynamic attribute typing errors with explicit mypy ignores.	Refactor mode branching in step_once to handle the baseline mode via an elif instead of nested if, while preserving behavior. Keep Oracle agent initialization and prompt building logic intact but flatten control flow for readability. Add # type: ignore[attr-defined] to Gradio UI component click wiring calls (start, step, run60, kpis_btn) to satisfy mypy where Gradio adds attributes dynamically.	viz/gradio_demo.py
Normalize typing and clamp logic in visualization and road tools, and minor import/order cleanups.	Update city_map and record scripts to use `EVGridAction	None` for last_action and normalize helper clamp logic with min(...) patterns. Introduce collections.abc.Callable where appropriate and remove legacy Optional imports. Tidy imports in road_router, build_road_graph, record_two_phase, record, and various tools for consistency. Adjust RoadRouter.load return annotation to use the class name directly.
Harden health dashboard tooling and OpenAI error handling, and align file IO with modern defaults.	Reorder imports in generate_health_dashboard and rely on default text mode/encoding for json file reads. Remove a no-op pass in the OpenAI error handler, keeping logging and static fallback logic. Mark subprocess usage with # nosec where appropriate to keep Bandit from flagging intended calls.	tools/generate_health_dashboard.py
Update sprint report documentation to reflect CI modernization and added security/OpenEnv checks.	Clarify that bandit (SAST) and openenv-core (environment validation) are part of the CI requirements. Describe updated workflow steps and expected outcomes around the strengthened CI pipeline. Note that DevOps/CI now enforces security and environment validity as part of the quality gate.	CYCLE_7_REPORT.md
Expand Ruff configuration to select additional rule families while ignoring project-acceptable ones.	Add a detailed ignore list covering specific Ruff/Ble/PLR/etc. codes tolerated in this codebase. Set select to include modernization, bugbear, comprehension, and other rule families relevant to the project.	.ruff.toml
Miscellaneous cleanups including type hints, regex flag clarity, and placeholder adjustments across tools and training artifacts.	Remove unused Optional imports from notebooks and scripts. Use explicit regex flags like re.IGNORECASE instead of shorthand. Ensure helper functions and placeholder env code in training notebooks match updated type signatures.	training/train_grpo.ipynb tools/road_reward_smoke.py

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[github-actions]

Failed to generate code suggestions for PR