[acgetchell]

just update previously refreshed only the root Python lock, leaving the independent Semgrep project behind. This adoption pins the now-published research-repo-tools==0.2.3, declares tooling/semgrep in deps.python-projects, and routes Python updates through the shared --all-projects workflow.

Semgrep advances to exactly 1.182.0 while retaining its separate Python 3.14 selector/environment, wheel-only installation policy, patched MCP override, and certifi 2026.10.19 security fix. The root remains Python 3.15. Existing exact managed-tool pins and Cargo upgrade exclusions are preserved. Both lockfiles were regenerated through uv; committed configuration uses official registry artifacts without local-wheel or source overrides.

The release workflow's isolated shared-tool pins, contributor/release documentation, published-package hashes, scanner policy assertions, and real Just sequencing/failure tests now match this adoption. The existing dependency-audit workflow now also triggers for Python manifest/lock changes and audits both Python locks through the declared shared adapter, with read-only permissions and retained reports. Its native Cargo audit remains in place. Native Cargo packaging, registry approval, scientific checks, benchmark freshness, and historical evidence contracts retain their owning workflows.

Upstream v0.2.3 / PyPI 0.2.3 is commit 4085125526e21b2855eb7c61a52ee312782ae31a. Independently downloaded registry wheel/sdist hashes match the main-validated and GitHub-published files; the consumer package-identity test enforces those exact hashes and the installed version.

Validation on Linux in the selected dotfiles environment:

• Actual published-package just update-python-dependencies passed for root and scanner; both original interpreter prefixes, Python selectors, scanner manifest, exact tool declarations, and overrides were verified after the update.
• just lint-config, just markdown-fix followed by just markdown-ci (including spelling), and just doc-check (default/exact Rustdocs) passed.
• just semgrep passed 48 rules on 128 files with zero findings, and just semgrep-test passed using the isolated 1.182.0 scanner and actual installed 0.2.3 fixture CLI.
• just audit is locally blocked: managed OSV 2.7.0 exits 127 because POST https://api.osv.dev/v1/querybatch returns HTTP 403. Reports contain zero findings but do not establish a successful audit. No advisory checks or exception policy were weakened. The exact-head hosted Python and Cargo audits subsequently passed; Python report artifact ID 12389962302 retains the evidence.
• just python-ci passed all 107 installed-package integration tests, formatting, lint, fixture lint, and strict types.
• Native CI: Linux, macOS and Windows all passed full just ci. Hosted CodeQL, Clippy security analysis, zizmor, coverage and repository-rule analysis passed. The benchmark comparison remains running. CodeRabbit approved exact head fae5c9ebd7826ec2450045d2e6c5c27a3c91eeb1 without actionable findings.

Tracks #298 and acgetchell/research-repo-tools#122. Merged commit 719003fceb43c4206ca4053c8506679e6deaf49c has the same source tree as the validated head; normal main-push checks are running. Broader consumer rollout is separate and does not block the published upstream release.

Summary by CodeRabbit

• New Features

  • Added automated security auditing for Python dependencies, including tooling environments, with report uploads.
  • Python dependency updates now cover all supported projects through a unified workflow.

• Updates

  • Updated Semgrep to version 1.182.0.
  • Updated development and release tooling, including the research tools package and build utilities.

• Documentation

  • Refreshed contribution, release, tooling, and performance documentation to reflect current versions, lockfile handling, and audit coverage.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: acgetchell/la-stack/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: 9a2e78ee-6be7-4e41-8ccc-91cae1e8d717

📥 Commits

Reviewing files that changed from the base of the PR and between 6a51ffe and fae5c9e.

⛔ Files ignored due to path filters: 2

• tooling/semgrep/uv.lock is excluded by !**/*.lock
• uv.lock is excluded by !**/*.lock

📒 Files selected for processing: 12

• .github/workflows/audit.yml
• .github/workflows/release-benchmarks.yml
• CONTRIBUTING.md
• docs/RELEASING.md
• docs/code_organization.md
• docs/dev/performance-tooling-adoption.md
• justfile
• pyproject.toml
• tooling/README.md
• tooling/semgrep/pyproject.toml
• tooling/tests/test_maintenance_integration.py
• tooling/tests/test_toolchain_integration.py

Included review availability: This review used your included allowance. 3 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour.

📝 Walkthrough

The pull request adds Python lockfile auditing, extends dependency updates to the isolated Semgrep project, upgrades tooling and research-repo-tools, and updates related workflows, tests, documentation, and package hashes.

Changes: Python tooling maintenance

Layer / File(s)	Summary
All-project Python dependency updates pyproject.toml, justfile, tooling/semgrep/pyproject.toml, tooling/tests/*	The updater now uses deps update-python --all-projects and includes the isolated Semgrep project. Tests validate its Semgrep pin, Python constraint, MCP override, lockfile, and workflow behavior.
Python dependency auditing .github/workflows/audit.yml	The audit workflow detects Python dependency changes, audits both Python lockfiles, uploads reports, and scopes Rust audit permissions at job level.
Tooling and published package alignment .github/workflows/release-benchmarks.yml, CONTRIBUTING.md, docs/..., tooling/README.md, tooling/tests/test_toolchain_integration.py	Tooling versions, research-repo-tools references, Semgrep documentation, release hashes, and validation expectations now use the updated versions.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Possibly related issues

• acgetchell/research-repo-tools#122 — The pull request adopts research-repo-tools version 0.2.3 in workflows, configuration, tests, and documentation.
• acgetchell/la-stack#298 — The pull request implements the isolated Semgrep environment, all-projects update flow, preserved overrides, and validation updates.
• acgetchell/research-repo-tools#124 — The pull request consumes the published 0.2.3 artifacts and updates their recorded hashes, but does not publish them.

Possibly related PRs

• acgetchell/la-stack#297 — This pull request continues the tooling migration and updates the same package and release references from 0.2.2 to 0.2.3.

Merge Risk: ⚪ Minimal · up to fae5c

The version reference is accurate, and isolated Python dependency changes trigger the two-lock audit. No actionable issue remains from this review.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly summarizes the primary change: refreshing isolated Python projects with published research-repo-tools version 0.2.3.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.25%. Comparing base (6a51ffe) to head (fae5c9e).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #299      +/-   ##
==========================================
+ Coverage   98.24%   98.25%   +0.01%     
==========================================
  Files          14       14              
  Lines        7218     7218              
==========================================
+ Hits         7091     7092       +1     
+ Misses        127      126       -1     

Flag	Coverage Δ
unittests	98.25% <ø> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.