hermes-labs-ai/quick-gate-python

v0.3.2Apache-2.0

Python quality gate CLI for Ruff, Pyright, and pytest with bounded auto-repair and escalation artifacts

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

CLI commands now report missing, unreadable, or malformed inputs for run --changed-files, summarize --input, and repair --input as clear diagnostics with exit code 2 instead of exposing raw tracebacks.
Pre-commit hooks now install the gate tools they run. language: python installed PyGate's runtime dependencies only, so the first run in a clean environment reported every gate as missing (exit code 127) instead of gating anything: Ruff, Pyright, and pytest are [dev] extras and pre-commit's hook environment is isolated. Both hook ids now declare exact additional_dependencies pins — pygate installs Ruff and Pyright, pygate-full adds pytest and pytest-json-report.

The root GitHub Action can optionally render a bounded, status-only job summary with the final status, recognized check counts, repair state, PyGate version, and source link; the action smoke fixture covers the enabled path.
The repository root is now a portable Agent Plugin with one canonical skill, host manifests for Agent Plugins, Claude Code, and Gemini CLI, and local Claude Code and Codex marketplace entries plus install/readback guidance.
Added machine-readable CodeMeta software metadata.
Manifest regression coverage for the hook dependency pins, plus a check that .pre-commit-hooks.yaml passes pre-commit validate-manifest.
Added regression coverage for the action summary, clean CLI input errors, and plugin, marketplace, Gemini, and pre-commit integration surfaces.
README documentation of the hook pins, of the Node runtime the Pyright distribution fetches on a first run, and of the caller-owned project test dependencies that an isolated pygate-full environment cannot supply.

README and llms.txt now document portable plugin installs and native pre-commit routes; README also documents the action summary option and current version readback.
The documented pre-commit rev is an immutable commit (00e561917dd1772252773aef060c07c2b8719377, the working hook manifest) instead of the mutable main branch, matching the root action's pinning policy, and a regression test keeps it a 40-character commit SHA. llms.txt documents the hook route with the same pin.

Reject stale pytest JSON reports: the pytest gate clears an existing report before execution, so a failed or interrupted run (including custom pytest commands) can no longer be masked by a pre-existing report.
Preserve fixture setup and teardown failures as actionable test findings without duplicating test items.

python -m pygate.evidence: emit a pygate run evaluation as a Hermes Reliability Lab result envelope (tool, version, status, input hash, non-passing checks, native findings, exit code, timestamp, Git commit) with the ordinary gate-result/v1 payload embedded verbatim. No change to gate resolution or scoring.

Allow filenames containing consecutive dots (for example, version..py) in deterministic repair scope while continuing to reject parent-directory paths.

Updated Action pinning guidance after publication: v0.2.1 is the first release tag containing the root action.yml; the audited commit remains the reproducible supply-chain pin.

Added tests/test_fresh_repo_integration.py, a real-subprocess fresh-repository proof: it builds throwaway projects from the existing tests/action-fixture/ fixtures and runs the installed pygate binary (with real Ruff and Pyright, no mocked tool output) to demonstrate, end to end, that a clean project passes, a non-fixable type error fails the gate and repair correctly escalates, and a Ruff-fixable lint issue is auto-repaired back to a passing gate. Isolated behind a new integration pytest marker (addopts = "-m 'not integration'" in pyproject.toml) so it is excluded from the default pytest run and its "mocked tool output only" invariant. Run it explicitly with pytest -m integration.
Added a ci.yml integration job that installs .[dev] (which supplies pygate, ruff, and pyright on PATH) and runs pytest -m integration -v, so the real-subprocess proof above runs on every push and pull request against main, alongside (not in place of) the existing offline test job and the GitHub-composite-action proof in action-smoke.yml.
Added tests/test_docs_action_pin.py, a regression contract asserting that every documented root-action reference is a 40-character commit SHA and that all documented pins agree.

Corrected the root-action pin in llms.txt, which still referenced the superseded 1a70edc commit after the audited pin moved to 671e8db.
Replaced the "replace it with an immutable release tag when one exists" guidance in README.md, SECURITY.md, and llms.txt. The published v0.1.0, v0.1.1, and v0.2.0 tags predate the root action.yml, so following that guidance produced a workflow that cannot resolve the action.

This release does not change any gate, repair, or CLI behavior; the package version moves only because CI now runs an additional, previously-unwired proof and the docs/pin corrections above ship with it. It does not by itself change root-action pinning guidance: continue to pin the root action at an audited commit, not at a PyPI release tag, until the README's "Pinning policy" section is updated to name a tag cut at or after action.yml landed.

Added the side-effect-free pygate.api.evaluate primitive with argv-safe command execution, bounded timeouts, capped output, snapshot binding, and the gate-result/v1 contract.
Added explicit CLI artifact output via --output-dir; pygate run without it emits JSON without creating worktree state.

Standardized the cross-engine discriminator as "schema": "gate-result/v1" and aligned result/check status enums with QuickGate.js and HermesGate.
Made --changed-files optional for whole-project runs and made the composite action install its checked-out source instead of a registry version.

Updated project metadata: copyright holder, maintainer contact, and citation files.

Standardized copyright to Hermes Labs in LICENSE
Fixed stale GitHub URLs (hermes-labs-ai/pygate → hermes-labs-ai/quick-gate-python)
Added PyPI version badge to README

pygate run command with canary and full modes
Lint gate via ruff with JSON output parsing
Type-check gate via pyright with JSON output parsing
Test gate via pytest with json-report plugin
pygate summarize command producing agent-friendly briefs (JSON + Markdown)
pygate repair command with bounded deterministic repair loop
Deterministic fixes: ruff check --fix + ruff format on scoped files
Repair safeguards: workspace backup/restore, patch budget, no-improvement abort, time cap
7 escalation reason codes with structured evidence
Rich environment metadata capture (Python version, platform, venv, resolver, packages)
Configuration via pygate.toml or [tool.pygate] in pyproject.toml
Composite GitHub Action for CI integration
Structured artifacts: failures.json, run-metadata.json, agent-brief.json/md, repair-report.json, escalation.json