fix(ci): restore default-branch template validation and cruft updates

[williaby]

Why

Two independent CI failures originate on main, not in any PR. Both are visible
in the check rollup of every open PR in this repo.

1. ruff PLR0917 breaks template validation and integration tests

validate-template.yml installs ruff unpinned (pip install cookiecutter ruff basedpyright). ruff stabilised PLR0917 (too-many-positional-arguments), so a
ruff release, not a code change, turned main red.

Evidence, run 33684401670, job validate (3.12):

PLR0917 Too many positional arguments (11 > 4)
   --> hooks/post_gen_project.py:783:5
PLR0917 Too many positional arguments (7 > 4)
   --> hooks/post_gen_project.py:916:5
Found 2 errors.
##[error]Process completed with exit code 1.

Evidence, run 33684401693, job Integration Tests (api-service):

ℹ === Ruff Linting ===
src/api_service/middleware/security.py:123:9: PLR0917 Too many positional arguments (5 > 4)
Found 1 error.
✗ Ruff check failed

Affected contexts on every PR: validate (3.10) through validate (3.14),
Integration Tests (api-service), and Test Summary.

2. cruft-update.yml cannot install its dependencies

uv pip install --system cruft pyyaml targets the runner's system interpreter,
which Ubuntu 24.04 marks externally managed (PEP 668). Run 33722728236:

error: The interpreter at /usr is externally managed, and indicates the following:
hint: Virtual environments were not considered due to the `--system` flag
##[error]Process completed with exit code 2.

The scheduled job has failed on every daily run for weeks.

What changed

PLR0917, fixed at the source, not suppressed. ruff's documented remedy is to
make the excess parameters keyword-only, so that is what this does:

• hooks/post_gen_project.py: _collect_optional_features and
  _print_developer_tool_integrations are now keyword-only; both call sites in
  the same file were updated to keyword form.
• {{cookiecutter.project_slug}}/src/{{cookiecutter.project_slug}}/middleware/security.py:
  RateLimitMiddleware.__init__ tuning parameters are keyword-only. The only
  in-template call site (add_security_middleware, via app.add_middleware)
  already passed them by keyword, so generated projects are unaffected.

No # noqa, no rule added to ignore, no continue-on-error.

PEP 668. Both jobs in cruft-update.yml now create a uv venv under
RUNNER_TEMP and prepend its bin to GITHUB_PATH, so the later bare python
invocations resolve to an interpreter that actually has cruft and pyyaml.

Verification

Reproduced and re-verified locally with ruff 0.16.5, the version CI resolved:

• ruff check hooks/ and ruff format --check hooks/: pass (failed before).
• basedpyright hooks/: 0 errors. Worth noting: this step never ran in CI
  before, because ruff check aborted the shared run: block first.
• Generated all seven fixture configurations (minimal, cli-app,
  api-service, ml-project, full-featured, frontend-react,
  supply-chain) and ran ruff check . in each: all pass.
• pre-commit run --all-files: all 25 hooks pass.
• actionlint and yamllint on cruft-update.yml: clean, only pre-existing
  warnings.

The cruft workflow change cannot be exercised locally; it is scheduled-only and
will be confirmed by the next daily run after merge.

Out of scope

validate-template.yml installs cookiecutter, ruff, and basedpyright
unpinned, which is why a tool release could break main with no commit. Pinning
them is worth doing but is a separate decision and is not part of this PR.

Generated with Claude Code

Summary by CodeRabbit

• Chores

  • Improved automated update workflows by isolating tooling in a dedicated Python 3.12 environment.
  • Updated dependency installation for more reliable workflow execution.

• Refactor

  • Clarified configuration interfaces by requiring selected middleware and project-generation options to be provided by name.
  • No runtime behavior or error handling changes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: f70ad704-4820-4bbc-9c65-e891178fdf6f

📥 Commits

Reviewing files that changed from the base of the PR and between efcf21f and 1c3342d.

📒 Files selected for processing (3)

• .github/workflows/cruft-update.yml
• hooks/post_gen_project.py
• {{cookiecutter.project_slug}}/src/{{cookiecutter.project_slug}}/middleware/security.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The Cruft workflow now uses an isolated Python 3.12 environment. Post-generation helpers and rate-limit middleware configuration now require keyword arguments.

Changes

Cruft workflow environment

Layer / File(s)	Summary
Dedicated Cruft environment .github/workflows/cruft-update.yml	The check-updates and apply-updates jobs create ${RUNNER_TEMP}/cruft-venv, add it to GITHUB_PATH, and install cruft and pyyaml into the environment.

Keyword-only Python interfaces

Layer / File(s)	Summary
Post-generation helper contracts hooks/post_gen_project.py	_collect_optional_features and _print_developer_tool_integrations now use keyword-only parameters. Their call sites pass arguments by keyword.
Rate-limit middleware configuration {{cookiecutter.project_slug}}/src/{{cookiecutter.project_slug}}/middleware/security.py	RateLimitMiddleware.__init__ now requires rate-limit configuration parameters after app to be passed by keyword.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to fe1da

The workflow and keyword-only interface updates are internally consistent, with no actionable merge-blocking risk identified.

Suggested labels: template, hooks, ci, breaking-change

Poem

A rabbit sees a venv grow neat,
With Cruft and YAML tucked inside.
Keyword paths make helpers clear,
Middleware settings hop beside.
The workflow runs on tidy feet,
And carrots mark the changes bright.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main CI changes: restoring default-branch template validation and cruft updates. It is concise and specific.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 2 files. (1 skipped: 1 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 2 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/fix-default-branch-ci-0

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟢 Approval recommended

The changes are targeted, internally consistent (signatures + call sites updated), and directly resolve the stated CI failures without introducing broader behavioral changes.

Pull request overview

This PR restores CI stability in this cookiecutter template repo by addressing two “main went red due to environment/tooling drift” failures: Ruff’s now-stable PLR0917 rule and Ubuntu runner PEP 668 restrictions impacting the scheduled cruft update workflow.

Changes:

• Fixes Ruff PLR0917 by converting high-arity helper functions and middleware tuning parameters to keyword-only arguments (instead of suppressing lint).
• Updates hook call sites to use keyword arguments to match the new keyword-only signatures.
• Fixes cruft-update.yml on Ubuntu 24.04+ by creating a uv-managed venv under RUNNER_TEMP, installing dependencies into it, and ensuring subsequent python invocations use that interpreter.

File summaries

File	Description
hooks/post_gen_project.py	Makes helper functions keyword-only and updates the internal call sites accordingly to satisfy Ruff PLR0917.
{{cookiecutter.project_slug}}/src/{{cookiecutter.project_slug}}/middleware/security.py	Makes RateLimitMiddleware tuning parameters keyword-only (preserving the existing keyword-based usage).
.github/workflows/cruft-update.yml	Reworks dependency installation to use a uv venv (avoids PEP 668 externally-managed system Python installs) and keeps later python steps using that venv.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.