fix: address PR #217 comments, remediate uv diagnostics, and add uv-check/lockfile quality gates

[dan-petty]

Summary

• PR feat(release): v0.2.19 #217 Comment: Fixed .devcontainer/Dockerfile build context issue by copying pyproject.toml and README.md before src/.
• System uv Collision: Reconciled duplicate uv installation between user home and system path.
• UV Diagnostics & Pydantic-AI Invariants: Resolved all uv check diagnostics across sandbox, console/table output, telemetry, streaming, and Pydantic-AI harness.
• Dependency Upgrades: Upgraded and locked outdated dependencies (click, gitpython, httpx2, httpcore2, pydantic, pydantic-core, qdrant-client, typer, uvicorn, ruff, types-PyYAML).
• CI Quality Gates: Added uv-check, lockfile, and outdated subcommands to devops ci and integrated them into the concurrent CI pipeline and GitHub Actions workflow.

[Copilot]

🟡 Changes recommended

Unresolved moderate issues affect CI coverage, binary safety, rendering options, input validation, and test reliability.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This PR refreshes dependencies, adds uv-based quality gates, fixes Dev Container setup, and remediates diagnostics across the CLI.

Changes:

• Adds uv check, lockfile, and outdated checks with documentation and workflow updates.
• Updates dependencies and lockfile.
• Fixes streaming, output, telemetry, sandbox, and Dev Container behavior.

File summaries

File	Reviewed changes and findings
uv.lock	Refreshed dependency resolutions.
tests/test_devcontainer.py	Added Dev Container coverage; moderate issue (2 votes) due to reliance on host /usr/local/bin paths.
tests/test_ci.py	Added CI command tests; moderate issue (1 vote) because the predicate does not verify the exact uv check command.
src/devops_cli/telemetry/tracer.py	Corrected span validity handling.
src/devops_cli/security/reference_extractor.py	Centralized excluded MIME types.
src/devops_cli/security/complexity.py	Reused repository file discovery.
src/devops_cli/sandbox/models.py	Adjusted DNS and whitelist fields.
src/devops_cli/output/models.py	Added table header options; moderate issue (2 votes) because payload rendering ignores them.
src/devops_cli/output/formatters/tables.py	Applied table rendering options; moderate issue (1 vote) because the early payload path ignores them.
src/devops_cli/output/console.py	Resolved typing and rendering checks.
src/devops_cli/lang/en/messages.py	Added CI labels.
src/devops_cli/lang/en/help.py	Added CI help text.
src/devops_cli/docker/sandbox.py	Added whitelist configuration fields.
src/devops_cli/config/defaults.py	Marked immutable defaults.
src/devops_cli/config/constants.py	Added MIME constants.
src/devops_cli/config/__init__.py	Exported the new constant.
src/devops_cli/commands/devcontainer.py	Reconciled uv binaries; moderate issue (2 votes) because existing binaries may be unconditionally deleted.
src/devops_cli/commands/ci.py	Added CI checks; moderate issue (3 votes) because outdated is missing from the concurrent pipeline, plus a nit (1 vote) for misleading uv check type-checking terminology.
src/devops_cli/ai/client/streaming.py	Adjusted thinking-tag validation; moderate issue (1 vote) because None can now raise an unhandled TypeError.
README.md	Updated command documentation.
pyproject.toml	Updated dependencies and uv/ty configuration.
docs/commands/ci.md	Documented CI commands.
docs/CLI_REFERENCE.md	Updated the CLI reference.
.github/workflows/ci.yml	Added uv and dependency checks.
.devcontainer/Dockerfile	Fixed package build context ordering.

Review details

Suppressed comments (4)

src/devops_cli/ai/client/streaming.py:41

• Removing the not thinking_tags guard changes invalid runtime input such as thinking_tags=None from the documented ValueError to an unhandled TypeError at len(thinking_tags). Keep the falsy guard (or validate the value's tuple/string shape before calling len) so the public validation contract remains consistent.

        if len(thinking_tags) != 2 or not thinking_tags[0] or not thinking_tags[1]:

src/devops_cli/commands/ci.py:701

• uv check validates uv project configuration/metadata; it does not perform Python static type checking. Describing this gate as type checking is misleading because the actual type checker remains the separate mypy step, so users may incorrectly assume type diagnostics are covered here.

    """Run uv check for fast static type checking and project validation."""

src/devops_cli/output/formatters/tables.py:70

• This early return invokes TablePayload.render() before applying the payload options below. TablePayload now exposes show_header and header_style, but its render() still hardcodes a bold header and never passes show_header, so any payload supplied through render_table silently ignores the new fields. Update the payload rendering path to honor those fields.

    render_fn = getattr(title, "render", None)
    if callable(render_fn):
        rendered = render_fn()
        if isinstance(rendered, Table):
            return rendered

tests/test_ci.py:250

• This predicate does not verify the uv check command: the raw command list for the format check already contains both uv and --check, so it can satisfy the condition even if the new command is wired incorrectly. Assert the exact command list (["uv", "check"] in called) instead.

            any("check" in c and "uv" in c for c in called),

• Files reviewed: 24/25 changed files
• Comments generated: 4
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.