fix(ci): the auditor ran the whole suite on a Python it cannot import on

[Ikalus1988]

User description

The auditor — the repository's real merge gate — pinned Python 3.10 while running the whole test
suite. Two test files import tomllib, stdlib only from 3.11, so pytest died during collection:

E   ModuleNotFoundError: No module named 'tomllib'
ERROR tests/test_worker_compat_dates.py
!!!!!!!!!!!!!!!!!!!! Interrupted: 1 error during collection !!!!!!!!!!!!!!!!!!!!
##[error]Test suite failed
Audit failed: test suite has issues.

and the verdict blamed the contribution for a runner version. The required matrix has always been
3.11/3.12/3.13 — this job was the outlier.

Measured on the open backlog (2026-09-25)

I checked all 11 open PRs by fetching each one's latest audit job log:

PR	audit	cause
#1999, #2020, #1982	failure	exactly this — tomllib collection error on 3.10
#2037	failure	a genuine DCO failure (different, untouched)
#2090, #2068	none	the audit never ran at all (different, untouched)
#2002, #1817, #1801, #1716, #1544	success	—

So this is 3 PRs, not "all of them" — the number is worth stating precisely, because the point is that
those three reds carried no information about their content.

Two changes

1. python-version: "3.11" — the version the repository actually tests.

2. The red now names its cause. The test step publishes pytest's exit code, and the summary
branches on it:

exit	message
2	"pytest could not COLLECT the suite … no test ran at all. This is normally the runner, not the contribution: check the python-version this job pins."
1	"test suite has failing tests"
4 / 5	usage error / collected no tests
other	the old catch-all, as fallback only

Audit failed: test suite has issues. was the only message for days while no test ran. A red gate
has to name its cause, or the reader has to go and find it — several thousand log lines up.

Gates

tests/test_workflow_python_floors.py (new) derives the suite's floor from the imports in tests/
(STDLIB_FLOORS: tomllib → 3.11) and fails any job that runs pytest below it, or on a version the
matrix never tests. Derived, not declared: a hand-written "the suite needs 3.11" is stale the moment
somebody uses except* or datetime.UTC. It also resolves ${{ matrix.python-version }} instead of
skipping it — a resolver that gave up there would drop the job that defines "tested" — and has a test
that the matrix job stays visible.

tests/test_audit_report_truth.py gains 6 tests that execute the real Post Audit Report step
(that file's existing harness) and read its stdout. Because the harness substitutes ${{ … }} into the
script, it cannot notice if the test step stops writing the output, so a structural test pins that
line too.

Evidence

$ python3 -m pytest tests/ -q     →  2215 passed, 15 skipped

Mutations, all red: auditor back to 3.10 · floor table emptied · floor entry nothing imports ·
matrix below the floor · matrix expressions silently unresolved · versions compared as strings
("3.10" < "3.9" — the trap that would have let this through) · case statement replaced by the old
catch-all · exit code no longer published · "it is the runner" hint dropped · a real failure relabelled
a collection error.

Three mutations were equivalent, and are recorded rather than papered over: a no-op edit to the
version parser, a behaviour-preserving rewrite of it, and (in an earlier separate version of these
tests) restoring a string that a real call site had already made harmless. In the one case where a
mutation showed a test was pinning a shape rather than a behaviour, the test was rewritten.

Left alone on purpose

pyproject.toml still says requires-python = ">=3.10". Only the test suite needs 3.11 — the
package itself may genuinely run on 3.10 — so changing that claim is a support-policy decision, and it
is yours rather than mine.

---

PR Type

Bug fix, Tests

---

Description

• Pin auditor Python to 3.11 (tomllib is stdlib ≥3.11)

• Name the cause in audit failure messages via pytest exit code

• Add derived floor test preventing any job pinning below it

• Add tests verifying collection-error vs test-failure messages

---

Diagram Walkthrough

flowchart LR
  A["pr-checks.yml: python-version 3.10 → 3.11"] -- "captures" --> B["PYTEST_EXIT → GITHUB_OUTPUT"]
  B -- "branches on exit code" --> C["verdict names cause: collect/fail/usage/empty"]
  D["test_workflow_python_floors.py"] -- "derives floor from imports" --> E["fails any pytest job below 3.11"]
  F["test_audit_report_truth.py"] -- "asserts" --> C
  E -- "regression guard" --> A

Loading

File Walkthrough

	Relevant files
Bug fix	pr-checks.yml Bump auditor Python to 3.11 and name failure cause              .github/workflows/pr-checks.yml Set setup-python to python-version: "3.11" (was 3.10) with explanatory comment Capture PYTEST_EXIT from pytest and publish to $GITHUB_OUTPUT Branch the audit failure message on exit code (2/4/5/1/other) so the cause is named +31/-2
Tests	test_workflow_python_floors.py Derive and enforce a Python floor for pytest jobs                tests/test_workflow_python_floors.py Derive suite floor from tomllib imports in tests/ Assert every pytest job pins ≥ the floor and a tested matrix version Reject jobs that pin Python without setup-python (lists them) Compare versions as tuples, not strings (avoids "3.10" < "3.9") +235/-0  test_audit_report_truth.py Assert audit verdict names its cause by exit code                tests/test_audit_report_truth.py Add PYTEST_EXIT to the substituted expression map Split run_report into run_report_streams that returns stdout too Assert collection error (exit 2) is named and points at runner Assert genuine test failure (exit 1) still says "failing tests" Parametrize exit codes 4 and 5 with their named messages Assert empty exit falls back to the catch-all message +79/-9

---

[github-actions]

#1999 已经有落地的工作，这条 PR 不需要继续

@Ikalus1988 谢谢你来收 #1999。它不是没人做：

• 已经在 main 上满足它的工作：PR ci(gates): a weekly audit that proves the key gates can still fail (#2045) #2054（已合并）

重复投稿不会被合并，也不会重复支付：赏金结在合并了的那一条上。（2026-09-21 的 #1942 就同时收到三条 PR #1959/#1968/#1980。）

回主线的路

• 如果 main 上那份确实不够：开一条新 PR 只做增量修改（在已存在的文件上追加/修正，不要整文件替换），正文里写清「现在缺什么、我补什么」。同名替换会被按重复关掉。
• 如果内容一样：关掉这条，把独有内容（实测输出、版本号、命令、field report）作为评论补到已经合并的那份工作下面——本仓给报料者补回执用的就是这条路。
• 如果你认为「已满足」的判断是错的：在 fix(mcp): the search surface returned unreadable results, leaked drafts, and crashed on real error text #1999 下面对着验收标准逐条说缺哪一条，维护者会重开或另开一条。
• 想继续收赏金：去 https://github.com/Ikalus1988/MisakaNet/issues?q=is%3Aissue+is%3Aopen+label%3Aready 挑一条还没有 PR 的 issue，按第一条路走。

这条回执由 .github/workflows/bounty-claim-guard.yml 自动生成（issue #2043）。它只评论、不拦 PR——CI 里它永远不是阻塞项；PR 正文或引用变化时会就地更新这一条，不会再评论一条新的。

[github-actions]

PR Genius Analysis

• Risk Level: medium_risk
• PR Size: +345/-11 (356 lines, medium)
• Impact: 3 files changed (.github, tests)
• Rules: 8 core + 5 repo-specific

Checklist

• ci_passing (PENDING) — checks are still running
• dco_signoff (PASS) — all commits signed
• tests_updated (PASS) — 2 test file(s) changed
• issue_reference (PASS) — linked issue found

Anti-Patterns Detected

• workflow_change (medium)

Suggestions

• Verify workflow syntax with act or push to a test branch.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	misakanet-web	bb0636b	Commit Preview URL Branch Preview URL	Sep 25 2026, 02:55 AM

[github-actions]

Standalone PR Review

PR-Agent could not safely update the persistent review. This standalone result will not replace the canonical review.

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

[github-actions]

✅ Merged! Thanks again, @Ikalus1988.

fix(ci): the auditor ran the whole suite on a Python it cannot import on (+345 lines, 3 files)

Quick question — did any MisakaNet lesson help you this time?
→ Share feedback

No need to reply if nothing comes to mind. ⚡

[github-actions]

🎉 Merged — Thank you!

Your contribution has been merged into main.

PR: #2183 — fix(ci): the auditor ran the whole suite on a Python it cannot import on

What's next:

• Your code is now part of MisakaNet's failure-lesson corpus (now 411 lessons)
• Feel free to pick up another issue labeled good first issue or status: competition
• Questions? Ask in this thread or open a Discussion

Welcome to the MisakaNet contributor community! 🧠

[Ikalus1988]

🧾 Audit Report — PR #2183 (bb0636b)

📊 Quality Score

⚠️ Quality score unavailable; continuing with hard gates.

🔏 DCO Audit

✅ All commits signed-off.

📏 PR Size

Metric	Value
Files Changed	3
Lines Added	345

🔐 Secret Scan

✅ No hardcoded secrets detected.

📦 Dependency Audit

⏭️ Skipped; no Python/JS dependency files changed.

🧪 Test Suite

✅ PASS — 56% coverage

📋 Lesson Schema

✅ All lessons valid.

⚖️ Verdict

✅ All gates passed. Ready for merge.

---

Scope: full | Triggered by bb0636b | View run

[github-actions]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Possible issue	Parse imports with AST, not regex The regex misses multi-line parenthesized imports like import (\n tomllib,\n) — after import\s+ it expects a module name starting with a letter/underscore, but the next character is (. The PR's whole premise is "the floor is derived — add any import and the floor moves by itself"; missing this form means a future test file using parenthesized imports would silently leave the auditor pinning a Python that breaks collection (the exact bug this PR is preventing), and test_every_floor_entry_is_actually_used would then fail with a false positive saying tomllib isn't used. Switch to ast.parse() and walk ast.Import / ast.ImportFrom so every valid form is detected. (Add import ast at the top.) tests/test_workflow_python_floors.py [52-55] def _imports(text: str) -> set[str]: - found = set(re.findall(r"(?m)^\s*import\s+([a-zA-Z_][\w.]*)", text)) - found |= set(re.findall(r"(?m)^\s*from\s+([a-zA-Z_][\w.]*)\s+import", text)) - return {name.split(".")[0] for name in found} + try: + tree = ast.parse(text) + except SyntaxError: + return set() + names: set[str] = set() + for node in ast.walk(tree): + if isinstance(node, ast.Import): + for alias in node.names: + names.add(alias.name.split(".")[0]) + elif isinstance(node, ast.ImportFrom) and node.module: + names.add(node.module.split(".")[0]) + return names Suggestion importance[1-10]: 6 __ Why: Valid concern: the regex does miss parenthesized multi-line import (tomllib,) forms, directly undermining the PR's stated premise that the floor is derived from real imports. Switching to ast.parse() would make the derivation robust to legitimate Python import styles. Not a critical bug (the current tomllib usage is a simple import tomllib), but a meaningful strengthening of the gate's own guarantee.	Low
General	Match existing yaml import pattern The companion test tests/test_audit_report_truth.py uses yaml = pytest.importorskip("yaml", reason="PyYAML parses the workflow") rather than a bare import yaml, indicating PyYAML is treated as optional there. A bare import yaml fails at module load if PyYAML is missing, preventing all tests in this file from being collected rather than skipping gracefully — which would silently disable this whole CI floor gate if PyYAML happens to be absent. Use pytest.importorskip to match the existing pattern. tests/test_workflow_python_floors.py [26-27] import pytest -import yaml +yaml = pytest.importorskip("yaml", reason="PyYAML parses the workflow files") + Suggestion importance[1-10]: 4 __ Why: Consistency improvement to match tests/test_audit_report_truth.py. The argument is reasonable (if PyYAML is absent the gate should skip, not silently break the entire test file's collection), though the counter-argument is that PyYAML is core to reading workflows so a hard failure may be preferable. Minor consistency/style change rather than a defect.	Low