fix(ci): green the pipeline (ruff, mypy, test isolation)

[plosiewicz]

Summary

CI (.github/workflows/ci.yml) has been red since June 9. This branch fixes all five steps so the pipeline passes end-to-end.

What changed (commit by commit)

1. style(ci): ruff check --fix and ruff format — auto-fixed unused imports (call, pytest) and import-block ordering in Phase 7 test files; reformatted 14 files.
2. fix(ci): add proper type annotations for mypy strict (24 errors → 0):
   • cli.py: bare dict/list[dict] → dict[str, Any] / list[dict[str, Any]] on the run-summary helpers.
   • notify/dispatch.py: typed the Resend payload as resend.Emails.SendParams; typed the send() result as Any (the stub models it as a TypedDict, but the code and its tests consume it by attribute — result.id).
   • cutover_wipe.py: typed db as Any (duck-typed Arango connection, matching cli.py), dropped the now-redundant # type: ignore[union-attr] comments, annotated row.
   • ingest/google_auth.py: call the untyped impersonated_credentials.Credentials via an Any alias to avoid a spurious no-untyped-call.
   • No runtime behaviour changed; no # type: ignore suppressions of real issues; mypy config untouched.
3. test(ci): fix env-leak isolation for STORAGE_BACKEND from .env — test_settings_default_dev passed in isolation but failed in the full suite. Root cause: importing litellm (transitively via ingest.extractor) calls dotenv.load_dotenv() at import time, injecting a repo-root .env's STORAGE_BACKEND=gcs into os.environ during pytest collection — before any fixture runs. The existing _disable_dotenv_loading only patches pydantic-settings' env_file, so it can't undo that. Fix extends the existing scrub pattern with a session-scope autouse _scrub_config_env fixture that deletes every Settings/NotifySettings env-var name (secret + non-secret) at session start, restoring the documented "no creds, no config" baseline. Integration/live-LLM runs keep their .env (same bypass as the dotenv fixture). No skip/xfail, no assertion edits.
4. fix(ci): clear detect-secrets false positives — added # pragma: allowlist secret to fake test fixtures (re_test_key, user:secret@cluster.example); scoped the detect-secrets scan to exclude .planning/ design docs (planning prose that references env-var names and fake placeholders — all keyword false positives). Shipped code (src/tests/infra/dashboard/scripts) is still fully scanned.

Local verification (all five CI steps)

Step	Command	Result
1	ruff check src tests	✅ exit 0
2	ruff format --check src tests	✅ exit 0
3	mypy src	✅ 0 errors in 28 files
4	pytest	✅ 435 passed, 9 skipped
5	detect-secrets-hook --baseline .secrets.baseline $(git ls-files -- . ':!:.planning/**')	✅ exit 0

CI-environment notes

• pytest was verified via PYTHONPATH=src .venv/bin/python -m pytest (project convention; uv run re-breaks the editable install in this worktree). CI runs uv sync --all-extras --frozen on a clean checkout, where the editable install resolves correctly, so uv run pytest works there.
• All detect-secrets findings were audited and confirmed to be false positives before suppression — no real secrets were baselined or suppressed.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
feature-tracker-dashboard	Ready	Preview, Comment	Jun 15, 2026 6:45pm