Refactor codebase and improve CI with robust security and formatting rules

[NITISH-R-G]

This cycle improves the code quality of the backend and introduces safety checks to the server-side pipeline.

• bandit is added and enforced.
• .ruff.toml selects very robust categories for linting and explicitly sets legacy ignore patterns.
• jscpd pinned to 4.0.0 to fix breaking remote GitHub Actions pipeline.

---

PR created automatically by Jules for task 10707256943702098837 started by @NITISH-R-G

Summary by Sourcery

Modernize code quality enforcement and make CI more secure, deterministic, and comprehensive.

Bug Fixes:

• Stabilize CI duplication checks by pinning jscpd and excluding generated build artifacts.
• Keep simulation and server behavior compatible while applying modernized Python syntax and lint-driven correctness cleanups.

Enhancements:

• Strengthen Python quality standards with expanded Ruff rules and updated type annotations and idioms across the codebase.
• Add Bandit security scanning and OpenEnv validation to the backend CI workflow.

Build:

• Add mypy, Bandit, OpenEnv Core, Vulture, and Ruff to development dependencies.

CI:

• Enforce server-side security, environment validation, and deterministic frontend duplication analysis in GitHub Actions.

Chores:

• Ignore local static-analysis caches and generated artifacts in repository tooling configuration.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 6b3c5136-248a-4ead-8022-cec2ba56064a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Reviewer's Guide

Tightens CI security and consistency (Bandit + OpenEnv, pinned jscpd, stricter Ruff config and dev deps) and applies a series of small code-quality refactors across the backend, tools, visualization, and training code to align with modern Python and linting rules.

File-Level Changes

Change	Details	Files
Harden server-side CI by adding security/env checks and stabilizing code-duplication analysis.	Limit explicit pip installs in the backend workflow to pydantic and rely on dev extras from pyproject.toml for tooling Add a Bandit SAST step configured via pyproject.toml Add an OpenEnv validation step to backend CI Pin jscpd to 4.0.0 in frontend CI and extend ignore patterns to common build artifacts	.github/workflows/code-quality.yml
Strengthen linting configuration and ignore caches to keep the repo and CI clean.	Configure Ruff to select robust rule families and explicitly list current ignores/technical debt Update .gitignore to exclude Ruff and mypy caches (and possibly other CI-related artifacts) Document cycle changes and health analysis in a new CYCLE_8_REPORT.md for traceability	.ruff.toml .gitignore CYCLE_8_REPORT.md
Modernize typing and small control-flow patterns across the ev_grid_oracle core to satisfy new Ruff/mypy rules.	Replace typing.Optional and Tuple with PEP 604 union syntax and built-in tuple type hints Simplify clamping helpers to use min and max instead of nested ternaries Tighten list-comprehension and set-construction patterns for clarity and performance Adjust EV grid core logic for slot derating and arrivals rounding to be clearer and more idiomatic	ev_grid_oracle/bescom_feed.py ev_grid_oracle/city_graph.py ev_grid_oracle/env.py ev_grid_oracle/grid_sim.py ev_grid_oracle/models.py ev_grid_oracle/oracle_agent.py ev_grid_oracle/parsing.py ev_grid_oracle/personas.py ev_grid_oracle/reward.py ev_grid_oracle/reward_hack.py ev_grid_oracle/road_models.py ev_grid_oracle/scenarios.py ev_grid_oracle/traffic.py ev_grid_oracle/world_model_verifier.py
Align server app and routing utilities with stricter linting, typing, and iteration idioms.	Reorder imports for consistency and add missing type hints for OrderedDict-backed session registries Avoid unused tuple elements and variables in session helpers Use itertools.pairwise and collections.abc.Callable where appropriate in routing and graph code Modernize route-polyline type hints to return unions instead of Optional	server/app.py server/road_router.py server/role_metrics.py
Update tooling scripts to modern idioms, better typing, and safer file/process handling.	Use itertools.pairwise and set comprehensions in road graph builders instead of zip and manual loops Prefer round over int(round(...)) where integers are ultimately stored and tighten haversine loops Relax a previous BLE lint suppression and rely on Bandit configuration instead Standardize file-open calls (omit redundant mode) and remove dead-pass fallthroughs in health dashboard tooling	tools/build_road_graph.py tools/build_roads_render.py tools/fetch_bangalore_roads_overpass.py tools/fetch_osm_roads.py tools/generate_health_dashboard.py tools/road_reward_smoke.py
Make visualization and Gradio demo code more type-safe and lint-compliant.	Replace Optional[...] with union syntax and clarify last_action tracking Simplify keyboard event handling and baseline vs oracle branching logic Add explicit type-ignore annotations for Gradio click wiring to satisfy type checkers Clean up unused imports and whitespace in visualization modules	viz/city_map.py viz/gradio_demo.py viz/record.py viz/record_two_phase.py
Align training notebook utilities with modern typing.	Switch RoadAction parse helper to use PEP 604 unions instead of Optional and remove unused typing imports	training/train_grpo.ipynb
Ensure dev optional dependencies include all CI tooling now used in workflows.	Add mypy, bandit, openenv-core, vulture, and ruff to the dev optional-dependencies set so .[dev] installs CI tooling consistently	pyproject.toml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[github-actions]

Failed to generate code suggestions for PR