[mnriem]

Description

Combine Ruff, Markdown lint, ShellCheck, and the committed dependency audit into one Ubuntu job with shared checkout, Python, and uv setup. This removes three jobs from each push and pull request without removing checks.

Keep checks in separately named steps so independent checks still run after another check fails, while preserving the job's failure status. Preserve full Git history for dependency comparisons and handle whitespace checks on manual runs.

Leave the pytest matrix, scheduled dependency-audit matrix, CodeQL jobs, and extension version guard unchanged. Update contributor guidance and workflow tests for the consolidated job.

Testing

Set up this checkout's .venv and editable install using the local development guide. Run commands from the checkout root.

• Tested locally with .venv/bin/specify --help (Windows PowerShell: .\.venv\Scripts\specify.exe --help)
• Ran relevant existing tests with .venv/bin/python -m pytest tests -q (Windows PowerShell: .\.venv\Scripts\python.exe -m pytest tests -q); use affected test paths for focused checks and LC_ALL=en_US.UTF-8 on macOS
• Tested with a sample project (if applicable)

Commands and results:

• .venv/bin/specify --help — passed.
• LC_ALL=en_US.UTF-8 .venv/bin/python -m pytest tests/test_security_workflow.py tests/test_github_workflows.py -q — passed, 198 tests.
• uvx [email protected] check tests/test_security_workflow.py tests/test_github_workflows.py — passed.
• git diff --check — passed.

A sample project is not applicable to this CI-only behavior change. The full pytest suite and the consolidated job on GitHub Actions were not run locally; combined-job runtime has not been measured.

AI Disclosure

• I did not use AI assistance for this contribution
• I did use AI assistance (fill in the disclosure below)

AI disclosure: GitHub Copilot using GPT-6.1 Sol (model ID: gpt-6.1-sol), autonomous execution within user-directed scope; reasoning-effort setting was not exposed. The agent investigated workflow timings, authored the workflow, test, and contributor-documentation changes, ran local checks, and prepared the commit and pull request.

[Copilot]

🟡 Changes recommended

The whitespace check silently skips changes when manually dispatched on a merge commit, allowing introduced trailing whitespace to pass undetected.

1 open issue

• Check whitespace in merge commits · New

What changed in this PR

Consolidates Spec Kit’s lint and committed dependency-audit checks into one Ubuntu job, reducing repeated setup while retaining separate check steps.

Changes:

• Shares checkout, Python, and uv setup, with conditions that let independent checks continue after failures.
• Preserves full Git history and adds whitespace checking for manual runs.
• Updates contributor guidance and workflow tests while preserving the pytest and scheduled audit matrices.

File	Description
tests/​test_security_workflow.py	Tests consolidated checks, prerequisites, and audit configuration.
tests/​test_github_workflows.py	Updates job lookup and adds whitespace-check cases.
CONTRIBUTING.md	Documents the combined job and independent checks.
.github/​workflows/​test.yml	Removes the Ruff job; retains pytest.
.github/​workflows/​security.yml	Removes the workflow after relocating its audit jobs.
.github/​workflows/​lint.yml	Combines lint and audit checks and hosts the scheduled audit matrix.

_{Review effort: Balanced (auto)}

[mnriem]

Fixed in 5bb6002: manually dispatched whitespace checks now use first-parent merge diffs while retaining root-commit handling. Added clean and trailing-whitespace cases for manual runs on merge and root commits; the merge regression failed before the fix and passes afterward. All 202 targeted workflow tests pass. Posted on behalf of @mnriem by GitHub Copilot using GPT-6.1 Sol (gpt-6.1-sol), autonomous execution within user-directed scope; reasoning-effort setting was not exposed. AI assistance covered the workflow fix, regression tests, local validation, and this summary.

[Copilot]

🟢 Approval recommended

No outstanding review findings block the consolidation of lint and dependency-audit checks.

No open issues 🎉

1 resolved since last review

• Check whitespace in merge commits

_{Review effort: Balanced (auto)}

[Copilot]

🟡 Changes recommended

Markdownlint can execute repository-provided JavaScript before both dependency audits in the same workspace, allowing audited files to be altered so successful results may not reflect committed requirements.

1 open issue

• Run dependency audits before executable Markdown configuration · New

_{Review effort: Balanced (auto)}