ci: make ruff actually lint the Python it claimed to lint

[JasonYeYuhe]

The gap

The repo-wide ruff check . was neither repo-wide nor reachable. Two independent defects in helper-ci.yml, either one sufficient on its own to hide every non-helper Python file:

1. paths: filtered to helper/**, three named scripts and one Swift file — a change to scripts/*.py never started the workflow;
2. the ruff step ran under working-directory: helper, so even when the workflow did start, ruff check . resolved to helper/.

Worth stating plainly because it changes the fix: widening the path filter alone — the obvious reading — would have changed nothing. Both had to go.

Measured cost: 91 ruff errors no CI run had ever reported. PR #433 was the demonstration case, landing two F541s on main. Those two are already gone (overwritten by #436) — the errors were transient, the hole they came through was not.

What's here

ruff.toml (new, repo root) — excludes archive/ only; AGENTS.md lists it under Archived or historical and it carried 11 of the 91. select is written out explicitly as ruff 0.15.11's current defaults, verified rule-for-rule identical (59 rules), so this PR changes no rule selection today but a future pin bump changes rule behaviour without silently changing the rule set.

The remaining 80 errors fixed — zero suppressed. No # noqa was needed.

rule	n	treatment
E701/E702	38	statements split
F541	18	dropped the f prefix
F401	12	import removed
F841	8	dead binding removed
E401	8	imports split
E722	2	→ except Exception:
E731	1	lambda → def

python-lint.yml (new) — runs ruff check . from the repo root on **/*.py, registered in ci-gate.yml's GATES so it blocks. helper-ci.yml's ruff step and pin are removed rather than duplicated: **/*.py is a strict superset of helper/, and two pinned ruff versions in two workflows is the copied-constant drift this repo has been bitten by before.

The ruff==0.15.11 pin carries over verbatim, 2026-07-30 incident note included. Bumping it stays its own task.

Behaviour is proven unchanged, not assumed

The 38 statement splits were driven off ruff's own reported offsets, with an assertion that each offset really was the ; or : claimed — then checked against a real oracle:

• pet_golden_oracle.py → 32KB PetGoldenVectors.json, byte-identical before/after
• pet_art_gen.py → 36 SVG frames, byte-identical before/after
• ci_check_android_strings_parity.py — executed, not just compiled (it's live in android-ci.yml): passes
• pet_normalize_assets.py --selftest — passes, and a negative control confirms the if got != expect: ok = False line I split still flips the result and exits 1
• every removed import confirmed unreferenced: math in pet_art_gen.py is re-imported locally as _m; json in appstore_metadata.py survived only as r.json() method calls
• resubmit.py's discarded probe keeps its network call, drops only the unused binding

Not runtime-verified: the ASC operational scripts (resubmit.py, submit_v1_*.py, appstore_metadata.py) need live App Store Connect credentials. They are byte-compiled only. Their changes are import removals, dead-binding removals and except: → except Exception:.

The gate was verified by making it fail

Per this repo's rule about guards that never run — a green check is not evidence. On a throwaway branch, two deliberately-broken files:

##[error]scripts/_ruff_gate_probe.py:3:8: F401 `os` imported but unused
##[error]CLI Pulse Bar/scripts/_ruff_gate_probe_spaces.py:4:12: F821 Undefined name
Process completed with exit code 1.

Python Lint | completed | failure — and the log shows ruff 0.15.11 actually executing.

The second probe is deliberately under a directory with spaces: CLI Pulse Bar/scripts/ holds ~24 of the repo's Python files, and a glob that silently skipped it would have recreated this exact bug. It was flagged.

Exactly 2 error lines were emitted and 0 files under archive/ — which also proves ruff.toml was read on the runner, since without it archive/'s 11 errors would have appeared.

Scratch branch deleted. On this branch: Python Lint green (log confirms ruff ran), Helper CI green with 971 passed, 1 skipped — pytest intact after losing its neighbour step.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.