cleveragents/cleveragents-core

Fork 3

[AUTO-INF-1] ci: dead_code nox session is redundant with security_scan — vulture runs twice per CI run #10192

New issue

Open

opened 2026-04-17 04:48:01 +00:00 by HAL9000 · 0 comments

HAL9000 commented

2026-04-17 04:48:01 +00:00

Owner

Metadata

Branch: fix/ci-remove-redundant-dead-code-session
Commit Message: fix(ci): remove redundant dead_code CI step — vulture already runs inside security_scan
Milestone: v3.2.0
Type: Type/Bug

Problem

The security CI job in .forgejo/workflows/ci.yml runs two nox sessions that both execute vulture dead-code detection:

nox -s security_scan — Step 4 of this session explicitly runs vulture:

# Step 4: Vulture dead-code detection
session.run(
    "vulture",
    "src/cleveragents",
    "vulture_whitelist.py",
    "--min-confidence", "80",
    "--exclude", "src/cleveragents/discovery",
)

nox -s dead_code — This session runs the identical vulture command:

session.run(
    "vulture",
    "src/cleveragents",
    "vulture_whitelist.py",
    "--min-confidence", "80",
    "--exclude", "src/cleveragents/discovery",
)

The security CI job in ci.yml runs both:

- name: Run security scan via nox
  run: nox -s security_scan 2>&1 | tee build/nox-security-output.log

- name: Run dead code detection via nox
  run: nox -s dead_code 2>&1 | tee -a build/nox-security-output.log

This means vulture runs twice in every CI run, wasting CI time and resources with no additional benefit.

Impact

Wasted CI time: vulture runs twice per CI run in the security job
Increased CI wall-clock time for every PR and push
No additional coverage or detection benefit from the duplicate run

Root Cause

The dead_code nox session was added as a standalone session for local developer use (nox -s dead_code). When it was also added to the security CI job, the fact that security_scan already includes vulture was overlooked.

Proposed Fix

Remove the "Run dead code detection via nox" step from the security CI job in .forgejo/workflows/ci.yml. The dead_code nox session should remain available for local developer use but should not be run separately in CI since security_scan already covers it.

Do NOT:

Remove the dead_code nox session from noxfile.py (it's useful locally)
Remove vulture from security_scan (it's the primary gate)
Weaken any security checks

DO:

Remove only the redundant CI step that calls nox -s dead_code in the security job

Files to Change

.forgejo/workflows/ci.yml — Remove the "Run dead code detection via nox" step from the security job

Background and Context

The dead_code nox session was introduced to give developers a quick local command for running vulture dead-code detection in isolation. However, when it was added to the security CI job alongside security_scan, the overlap was not noticed. The security_scan session already includes an identical vulture invocation as Step 4, making the separate dead_code CI step entirely redundant. Every CI run on every PR and push now executes vulture twice with no benefit.

Expected Behavior

The security CI job should run vulture exactly once — via nox -s security_scan. The dead_code nox session should remain in noxfile.py for local developer use only and should not be invoked as a separate CI step.

Acceptance Criteria

The security CI job no longer runs nox -s dead_code as a separate step
The security CI job still runs nox -s security_scan (which includes vulture)
The dead_code nox session remains available in noxfile.py for local use
All CI jobs still pass
No security checks are weakened or removed

Subtasks

Identify the exact step in .forgejo/workflows/ci.yml that calls nox -s dead_code within the security job
Remove that step from the security job YAML
Verify nox -s dead_code still exists and works in noxfile.py
Run CI locally or via a test branch to confirm all jobs pass
Confirm vulture still runs once (via security_scan) and no dead-code regressions are introduced

Definition of Done

This issue should be closed when:

The redundant nox -s dead_code step has been removed from the security CI job in .forgejo/workflows/ci.yml
The dead_code nox session remains intact in noxfile.py
All CI jobs pass on the fix branch
A PR has been merged to the main branch with the fix

Duplicate Check

Searched open issues for:

"dead_code redundant" — no matching issues found
"vulture twice" — no matching issues found
"security_scan dead_code" — no matching issues found
"CI optimization" — found "[AUTO-INF-1] Cut CI wall-clock via coverage merge & Helm caching" and "[AUTO-INF-1] ci: cache Helm binary in CI to eliminate per-job download overhead" — neither covers the dead_code redundancy specifically
Searched closed issues for "dead_code redundant" — no matching issues found

This issue is unique and not covered by any existing open or closed issue.

Automated by CleverAgents Bot
Agent: new-issue-creator

## Metadata - **Branch**: `fix/ci-remove-redundant-dead-code-session` - **Commit Message**: `fix(ci): remove redundant dead_code CI step — vulture already runs inside security_scan` - **Milestone**: v3.2.0 - **Type**: Type/Bug ## Problem The `security` CI job in `.forgejo/workflows/ci.yml` runs **two** nox sessions that both execute vulture dead-code detection: 1. `nox -s security_scan` — Step 4 of this session explicitly runs vulture: ```python # Step 4: Vulture dead-code detection session.run( "vulture", "src/cleveragents", "vulture_whitelist.py", "--min-confidence", "80", "--exclude", "src/cleveragents/discovery", ) ``` 2. `nox -s dead_code` — This session runs the **identical** vulture command: ```python session.run( "vulture", "src/cleveragents", "vulture_whitelist.py", "--min-confidence", "80", "--exclude", "src/cleveragents/discovery", ) ``` The `security` CI job in `ci.yml` runs both: ```yaml - name: Run security scan via nox run: nox -s security_scan 2>&1 | tee build/nox-security-output.log - name: Run dead code detection via nox run: nox -s dead_code 2>&1 | tee -a build/nox-security-output.log ``` This means **vulture runs twice** in every CI run, wasting CI time and resources with no additional benefit. ## Impact - Wasted CI time: vulture runs twice per CI run in the `security` job - Increased CI wall-clock time for every PR and push - No additional coverage or detection benefit from the duplicate run ## Root Cause The `dead_code` nox session was added as a standalone session for local developer use (`nox -s dead_code`). When it was also added to the `security` CI job, the fact that `security_scan` already includes vulture was overlooked. ## Proposed Fix Remove the "Run dead code detection via nox" step from the `security` CI job in `.forgejo/workflows/ci.yml`. The `dead_code` nox session should remain available for local developer use but should not be run separately in CI since `security_scan` already covers it. **Do NOT**: - Remove the `dead_code` nox session from `noxfile.py` (it's useful locally) - Remove vulture from `security_scan` (it's the primary gate) - Weaken any security checks **DO**: - Remove only the redundant CI step that calls `nox -s dead_code` in the `security` job ## Files to Change - `.forgejo/workflows/ci.yml` — Remove the "Run dead code detection via nox" step from the `security` job ## Background and Context The `dead_code` nox session was introduced to give developers a quick local command for running vulture dead-code detection in isolation. However, when it was added to the `security` CI job alongside `security_scan`, the overlap was not noticed. The `security_scan` session already includes an identical vulture invocation as Step 4, making the separate `dead_code` CI step entirely redundant. Every CI run on every PR and push now executes vulture twice with no benefit. ## Expected Behavior The `security` CI job should run vulture exactly once — via `nox -s security_scan`. The `dead_code` nox session should remain in `noxfile.py` for local developer use only and should not be invoked as a separate CI step. ## Acceptance Criteria - [ ] The `security` CI job no longer runs `nox -s dead_code` as a separate step - [ ] The `security` CI job still runs `nox -s security_scan` (which includes vulture) - [ ] The `dead_code` nox session remains available in `noxfile.py` for local use - [ ] All CI jobs still pass - [ ] No security checks are weakened or removed ## Subtasks - [ ] Identify the exact step in `.forgejo/workflows/ci.yml` that calls `nox -s dead_code` within the `security` job - [ ] Remove that step from the `security` job YAML - [ ] Verify `nox -s dead_code` still exists and works in `noxfile.py` - [ ] Run CI locally or via a test branch to confirm all jobs pass - [ ] Confirm vulture still runs once (via `security_scan`) and no dead-code regressions are introduced ## Definition of Done This issue should be closed when: - The redundant `nox -s dead_code` step has been removed from the `security` CI job in `.forgejo/workflows/ci.yml` - The `dead_code` nox session remains intact in `noxfile.py` - All CI jobs pass on the fix branch - A PR has been merged to the main branch with the fix ### Duplicate Check Searched open issues for: - "dead_code redundant" — no matching issues found - "vulture twice" — no matching issues found - "security_scan dead_code" — no matching issues found - "CI optimization" — found "[AUTO-INF-1] Cut CI wall-clock via coverage merge & Helm caching" and "[AUTO-INF-1] ci: cache Helm binary in CI to eliminate per-job download overhead" — neither covers the dead_code redundancy specifically - Searched closed issues for "dead_code redundant" — no matching issues found This issue is unique and not covered by any existing open or closed issue. --- **Automated by CleverAgents Bot** Agent: new-issue-creator

HAL9000 added the

labels

2026-04-17 04:49:44 +00:00

HAL9000 referenced this issue