fix: use locked CI dependencies and simplify POST warnings

[marcinpsk]

CI dependency-group installs previously resolved package versions independently of uv.lock. Export checked lockfile requirements before each install. Move the branching plugin version into pyproject.toml and the generated lockfile. Align the coverage setup-uv action with the existing Dependabot-managed revision.

Simplify the pattern-warning POST handler to return the parent response once. Keep warning logic in a separate helper and retain save, redirect, and validation behavior.

Validation:

• Execute all six actual workflow install pipelines in a disposable environment. All 52 installed package versions match uv.lock; a stale manifest fails the pipeline.
• Full isolated NetBox suites passed: 1,608 tests without branching and 1,691 with branching. Retain configured parallel workers. Combined coverage is 98.60% (required: 97%).
• Check Ruff, lockfile consistency, repository hooks, and five devcontainer guards.
• The original changes passed two independent Astra high review rounds at f4bbcbf. The hash-enforcement follow-up changes 12 non-test lines, within the 40-line adversarial gate exemption.

This addresses the POST maintainability finding. The separate SonarCloud security-rating failure remains outside this change.

Summary by CodeRabbit

• Bug Fixes
  • Regex rules that match no module type now show a warning after a successful save. Invalid patterns and rules that were not saved no longer trigger this warning.
  • Successful rule creation and editing now return you to the saved rule’s detail page.

Mandatory --require-hashes checks apply to all six exported-requirements installs. Real red/green verification showed that old installers accepted unhashed requirements; the fix passes 30 cases, including rejection of missing hashes, incorrect hashes, floating versions, and stale manifests. The package versions and hashes still come from uv.lock.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 32 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: eeb3182f-f044-42ff-a8bb-122e172c80f9

📥 Commits

Reviewing files that changed from the base of the PR and between f4bbcbf and b23cedb.

📒 Files selected for processing (3)

• .github/workflows/lint-format.yaml
• .github/workflows/test-netbox-main.yaml
• .github/workflows/test.yaml

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 19b9ce7e-babe-430a-b6e2-a80a48e7c1be

📥 Commits

Reviewing files that changed from the base of the PR and between 2e6ab2f and f4bbcbf.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (7)

• .github/workflows/lint-format.yaml
• .github/workflows/test-netbox-main.yaml
• .github/workflows/test.yaml
• netbox_interface_name_rules/tests/test_ci_workflow.py
• netbox_interface_name_rules/tests/test_views.py
• netbox_interface_name_rules/views.py
• pyproject.toml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

CI workflows now install locked dependency groups through exported requirements, including a dedicated branching group. Rule form handling returns the parent save response and checks eligible saved regex rules for patterns that match no module type.

Changes

CI dependency installation

Layer / File(s)	Summary
Install exported locked requirements .github/workflows/lint-format.yaml, .github/workflows/test-netbox-main.yaml, .github/workflows/test.yaml, netbox_interface_name_rules/tests/test_ci_workflow.py	Lint, release, test, and coverage jobs install exported locked requirements. The workflow test checks that setup-uv references use a single pin.
Set up branching test dependency pyproject.toml, .github/workflows/test.yaml	The branching test matrix uses a boolean, and the workflow installs the dependency from the new ci-branching group.

Rule form handling

Layer / File(s)	Summary
Separate save response from warning check netbox_interface_name_rules/views.py, netbox_interface_name_rules/tests/test_views.py	The post handler returns the parent save response and checks for a zero-match warning only for eligible saved regex rules. Tests verify successful redirects and an HTTP 200 response for a rejected submission.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to f4bbc

No actionable issue is established for this change; it is mergeable after normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to f4bbc

The changed handler continues to delegate saving to the existing framework, and its warning check does not write data. No privilege expansion or newly introduced security vulnerability was established. Uncertainty remains around inherited authorization and transaction behavior when an advisory check fails after saving.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• observed — The warning helper queries rules through the model manager and enumerates module-type names without explicit object restrictions. Its output contains the submitted pattern and a zero-match warning, not matching object names or identifiers. Runtime tenant and permission scope is not established by this source.

Trust Boundaries and Controls

• observed — Attacker-controlled submitted fields reach warning evaluation only after the inherited save handler returns. Regex compilation uses the shared RE2-based safety compiler, and the warning helper catches ValidationError. Calling the parent is counterevidence to a local authorization bypass, but does not independently verify the parent’s permission enforcement.

Resilience and Maintainability Implications

• inferred — The timestamp-and-pattern predicate does not uniquely attribute a write to the current request, so concurrent same-pattern saves can affect advisory warning eligibility. Unexpected exceptions during the read-only check can also prevent response delivery; whether saved state remains committed depends on unavailable parent transaction behavior. Neither condition is established as introduced or worsened by this PR.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 44.44% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 9 functions across 3 files. (4 skipped: 4…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the two main changes: using locked CI dependencies and simplifying POST warning handling.

Full details: Docstring Coverage

Explanation

Docstring coverage is 44.44% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 9 functions across 3 files. (4 skipped: 4 unsupported.)

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the workflow lines,
Then hops where locked dependency shines.
A regex saves; its warning waits,
The form returns through proper gates.
One pin, one group, the burrow sings.}

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!