Summary

• Multi-stage Dockerfile (dev for dev containers / testing, prod for deployment) using ghcr.io/astral-sh/uv as base
• pyproject.toml with uv, Ruff, Mypy (strict), Pytest, Bandit, pip-audit configured in one file
• VS Code settings, recommended extensions, and debug launch configs wired up for Ruff + Mypy + pytest
• Dev container built from the dev Dockerfile target with non-root devuser, named .venv volume, and auto-sync on create
• GitHub Actions CI: lint (Ruff + Mypy), tests with coverage, pip-audit dependency scan, Docker build (with per-target GHA cache)
• GitHub Actions CodeQL: Python SAST on push/PR/weekly schedule
• CLAUDE.md AI context + .claude/commands/ slash commands (/test, /lint, /security, /build)
• uv.lock committed for reproducible installs

Changes reviewed and fixed before merge

• pythonpath = ["src"] added to pytest config so bare pytest works without editable install
• Pylance type checking set to "off" to defer entirely to the mypy extension (was "basic", inconsistent with strict = true in mypy)
• Coverage flags removed from addopts — passed explicitly in CI only, so local pytest runs aren't slowed by coverage every time
• Bandit removed from CI — CodeQL covers the same SAST categories with better data-flow analysis; bandit remains available locally via uv run bandit
• Docker GHA cache scopes added (scope=dev / scope=prod) to prevent the two build steps overwriting each other's cache
• enable-cache: true added to all setup-uv steps
• Dead targets = ["src"] removed from [tool.bandit] (not a valid pyproject.toml key for bandit)
• Confusing dev compose service removed — it was just a pytest runner with a misleading name
• Build-time uv sync removed from the dev Dockerfile stage — the .venv named volume always shadowed it; uv run auto-syncs on first use instead
• devuser (uid 1000) added to the dev stage; devcontainer now runs as non-root
• LICENSE added to the builder stage COPY so hatchling can read it during uv sync --no-dev
• Redundant mypy flags (warn_return_any, warn_unused_configs) removed — already implied by strict = true

Test plan

• CI passes (lint, test, security, docker build)
• CodeQL passes
• Open repo in VS Code → "Reopen in Container" builds and installs correctly
• uv run pytest passes locally after uv sync --all-groups
• docker compose run --rm test runs the test suite

https://claude.ai/code/session_01TiXyp1vCmxNP2ewP4s1TGH

Generated by Claude Code