Fix CI fallout from the samples submodule move, pin the ruff rule set, update deps

[pleasantone]

Summary

CI was red on two independent counts. This fixes both and refreshes dependencies.

1. The samples submodule move left the repo dangling. dd6cc4a deleted samples/ in favour of the gpxsamples submodule, but nothing was repointed — the test suite, docs, Makefile, and .gcloudignore all still referenced samples/. The suite was at 14 failures + 13 collection errors, and actions/checkout doesn't fetch submodules by default, so CI had no GPX inputs at all.

The move also stranded six files that were not copied into the submodule: the golden .txt CLI outputs and default-config.json. Those are small text fixtures the docs literalinclude, so they're restored here rather than pushed into the submodule. Sample data is now split by role:

	contents
gpxsamples/ (submodule)	the large .gpx inputs
samples/ (this repo)	golden .txt outputs + default-config.json

tests/conftest.py owns both paths and fails collection with an actionable message when the submodule was never initialized, rather than emitting a wall of FileNotFoundError. Read the Docs still builds without the submodule, since every literalinclude target is back in-repo.

2. Ruff was linting against a moving target. The project had no [tool.ruff] config, so it inherited ruff's implicit default rule set — which grows with every release. Ruff 0.16 turned up 28 violations that no code change introduced. The rule set is now declared explicitly, so a routine ruff upgrade no longer breaks the build on its own.

Changes

• test: — repoint the suite at gpxsamples/ via new tests/conftest.py helpers. Use sys.executable instead of whatever python resolves to on PATH, and absolute sample paths instead of cwd-relative ones, so the suite no longer depends on how it was invoked.
• ci: — submodules: true on the test job's checkout (lint and the GAE deploy don't need it). New make submodules target that the test targets depend on; gpxsamples/ excluded from the GAE upload.
• chore(lint): — pin [tool.ruff.lint] to E, W, F, I, UP, B, C4, SIM, RUF (ignoring E501) and fix all 28 findings: import ordering, __all__ sorting, deprecated typing.Tuple/List, subprocess argument style, and leaked file handles in the tests. Drop .flake8, dead since ruff replaced flake8.
• build(deps): — bump the click floor to 8.4.2 in requirements.txt (what GAE installs from). Every other runtime floor already matched its latest release; added floors for the lint/test tooling so CI resolves the versions these rules were checked against.
• docs: — usage examples now invoke gpxsamples/*.gpx; CLAUDE.md records the directory split.

Incidental fix

samples/default-config.json had silently drifted from the code — it still carried a \Dinner regex typo that the classifier fixed at some point, so the published docs showed a config the program no longer produces. --dump-config is now regenerated by --generate and asserted by a test, so it can't drift again.

Verification

ruff check .   →  All checks passed!
mypy src/      →  Success: no issues found in 4 source files
pytest         →  66 passed

The five golden .txt files regenerate byte-identical, which confirms none of this changed program behavior — default-config.json is the only regenerated file that differs.

---

Generated by Claude Code

Summary by Sourcery

Repoint tests, docs, and tooling to use the new gpxsamples submodule for GPX inputs while restoring and validating in-repo CLI output fixtures, and pin lint/test tooling to stable configurations so CI remains green across upgrades.

Bug Fixes:

• Fix test suite to load GPX sample inputs from the gpxsamples submodule instead of the removed samples directory.
• Restore and keep in-sync the default-config.json and golden CLI output fixtures used by tests and documentation.
• Eliminate leaked file handles in WSGI upload tests by wrapping sample data in in-memory streams.

Enhancements:

• Introduce shared test helpers in tests/conftest.py to centralize sample paths and fail fast when the gpxsamples submodule is missing.
• Update CLI tests to use sys.executable, pathlib paths, and absolute sample locations for more robust and reproducible invocation.
• Reorder and clean up imports and all declarations for consistency with the configured lint rules.

Build:

• Add a Makefile submodules target and make test-related targets depend on GPX sample submodule checkout.
• Update Makefile demos and docs to reference gpxsamples paths for GPX inputs instead of the old samples directory.
• Bump the click runtime dependency floor in requirements.txt to 8.4.2.
• Declare minimum versions for pytest, responses, mypy, ruff, and types-* tooling in pyproject.toml.

CI:

• Ensure the test job checks out git submodules with an appropriate token so the private gpxsamples repo is available in CI.
• Upgrade astral-sh/setup-uv actions to v9.0.0 in CI and publish workflows.

Documentation:

• Document the split between gpxsamples and samples in CLAUDE.md and add a README under samples explaining fixture layout and submodule usage.
• Update usage and contributor docs to reference gpxsamples-based command examples and the pinned Ruff rule set.

Tests:

• Add a regression test ensuring --dump-config output matches the versioned default-config.json fixture and wire sample regeneration into generate-samples.
• Refine GPX table unit and sourcery tests with modern typing and import ordering aligned to the new lint configuration.

Chores:

• Configure Ruff with an explicit, pinned rule set and isort settings for first-party modules, and remove the obsolete .flake8 config file.

[sourcery-ai]

Reviewer's Guide

Wire tests/docs to the new gpxsamples submodule, stabilise linting with a pinned Ruff ruleset, and refresh tooling/deps while keeping CLI golden outputs and default-config fixtures in-repo and aligned with the current CLI behavior.

Sequence diagram for CI test job checking out submodules and running tests

sequenceDiagram
    participant GH as GitHubActions
    participant CO as actions_checkout@v7
    participant GHAPI as GitHub
    participant UV as setup_uv@v9_0_0
    participant PY as pytest

    GH->>CO: checkout repo<br/>submodules true<br/>token GPXSAMPLES_TOKEN || github.token
    CO->>GHAPI: clone gpxtable repo
    CO->>GHAPI: clone gpxsamples submodule
    GH->>UV: setup-uv with python 3_12
    GH->>PY: run pytest (tests use gpxsamples and samples via conftest)

Loading

File-Level Changes

Change	Details	Files
Route tests and docs through the gpxsamples submodule and shared test helpers, keeping golden outputs and default-config in a local samples directory.	Introduce tests/conftest.py with shared BASE_DIR/GPX_DIR/EXPECTED_DIR paths and gpx_sample/expected_output helpers plus a submodule-presence check. Update CLI tests to use Path-based paths, sys.executable, conftest helpers, absolute sample locations, and a regression test asserting --dump-config matches samples/default-config.json. Refactor WSGI tests to read GPX fixtures via gpx_sample, avoid leaking file handles using io.BytesIO uploads, and tighten InvalidSubmission tests. Restore samples/* fixtures (golden .txt outputs and default-config.json) with a README explaining the split between gpxsamples inputs and in-repo outputs.	tests/conftest.py tests/test_cli.py tests/test_wsgi.py samples/README.md samples/basecamp-route.txt samples/basecamp-tracks.txt samples/basecamp.txt samples/default-config.json samples/ich-north-fixed.txt samples/scenic2.txt
Stabilise linting and type-checking by pinning Ruff rules, updating imports/typing, and aligning all ordering.	Add [tool.ruff] and [tool.ruff.lint] configuration with an explicit rule set, E501 ignore, and isort known-first-party entries for gpxtable and conftest. Modernise typing annotations (tuple/list builtins) in tests and fix import ordering in tests and package modules to satisfy Ruff. Align gpxtable.all ordering with import order and adjust CLI imports accordingly. Remove the obsolete .flake8 configuration file now that Ruff is the sole linter.	pyproject.toml tests/test_gpxtable.py tests/test_gpxtable_sourcery.py src/gpxtable/__init__.py src/gpxtable/cli.py src/gpxtable/gpxtable.py .flake8
Ensure submodules and GPX inputs are available in local workflows and CI, and document required secrets and usage.	Add a Makefile submodules target using git submodule update --init --recursive and make test/test-cli/generate-samples depend on it; update demo commands to use gpxsamples paths. Update developer docs (CLAUDE.md) to describe the gpxsamples vs samples split, how to init submodules, and required Actions secrets including GPXSAMPLES_TOKEN. Adjust .gcloudignore and docs to align with the new samples/gpxsamples layout (ensuring GAE uploads exclude the submodule while docs still literalinclude in-repo fixtures).	Makefile CLAUDE.md .gcloudignore docs/usage.rst
Fix CI by fetching submodules for tests and updating uv action versions in workflows.	Update GitHub Actions workflows to use astral-sh/setup-uv@v9.0.0. Configure actions/checkout in the test job to fetch submodules and use GPXSAMPLES_TOKEN (with fallback to github.token) so private gpxsamples can be cloned. Keep lint/deploy workflows unchanged regarding submodules as they do not require GPX inputs.	.github/workflows/python-app.yml .github/workflows/publish.yaml
Refresh test/lint/runtime dependency floors to match the versions used during verification.	Bump pytest, pytest-flask, responses, mypy, ruff, and type stubs minimum versions in pyproject.toml tests/lint extras. Raise the click minimum version in requirements.txt to 8.4.2 to align with the environment used for verification and GAE. Ensure dev extra pulls in the updated tests/lint/web extras consistently.	pyproject.toml requirements.txt

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[pleasantone]

CI status: lint green, test blocked on submodule access

lint now passes — ruff and mypy are both clean in CI, confirming the rule-set pin and the 28 fixes.

test still fails, but not in pytest — it fails in actions/checkout, before any test runs:

Cloning into '/home/runner/work/gpxtable/gpxtable/gpxsamples'...
remote: Repository not found.
fatal: repository 'https://github.com/pleasantone/gpxsamples/' not found

The submodules: true change is working as intended; the clone itself is being refused. pleasantone/gpxsamples is a private repository, and the workflow's default GITHUB_TOKEN is scoped to pleasantone/gpxtable alone — it has no permission to clone a different private repo. "Repository not found" is how GitHub reports an unauthorized private repo.

This is not something the PR can fix on its own; it needs a repo-level decision:

1. Make gpxsamples public — submodules: true then works as committed, no further change and no secret to manage.
2. Keep it private and supply a token — add a PAT or fine-grained token with read access to both repos as an actions secret, and pass it to checkout (token: ${{ secrets.… }}, which covers submodules too). I can push this once the secret exists, since the secret name has to match.
3. Keep CI self-contained — move the six .gpx files the tests actually use (~4 MB of the ~12 MB) back into this repo and leave the rest in the submodule.

Everything else in the PR is verified locally against a real submodule checkout: ruff check clean, mypy clean, 66 tests passing.

---

Generated by Claude Code

[pleasantone]

Implemented option 2 in cefa280 — the test job's checkout now takes a PAT:

token: ${{ secrets.GPXSAMPLES_TOKEN || github.token }}

actions/checkout applies its token to submodule fetches as well, so one input covers both repos with no extra step. The || github.token fallback means a fork still checks out the main repo rather than failing outright on the primary checkout.

This job stays red until the secret exists. It needs a PAT with read access to both gpxtable and gpxsamples, saved as GPXSAMPLES_TOKEN under Settings → Secrets and variables → Actions. A fine-grained token scoped to just those two repos with Contents: Read-only is sufficient — no classic repo scope required.

Two things to keep in mind with this approach: a fine-grained PAT expires, and CI will start failing this same way when it does; and secrets aren't exposed to pull requests from forks, so an outside contributor's test job would still fail on the submodule. Requirement is documented in CLAUDE.md next to the release-please token.

lint is green, including through the astral-sh/setup-uv v9.0.0 bump.

---

Generated by Claude Code

[sourcery-ai]

Hey - I've found 3 issues, and left some high level feedback:

• The global pytest_configure hook in tests/conftest.py currently forces the presence of the gpxsamples submodule for every test run; if you want test_gpxtable.py or other pure-unit tests to be runnable without the submodule (e.g. via make test-unit), consider scoping this check to tests that actually use gpx_sample() (via marks, fixtures, or file-level imports) instead of failing the whole suite up front.
• Given that Makefile targets like test-unit and some docs describe unit tests as not needing GPX inputs, you might want to align this with the new submodule requirement by either dropping submodules from those flows or documenting that all pytest invocations now require git submodule update --init so there’s no inconsistency in developer expectations.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The global `pytest_configure` hook in `tests/conftest.py` currently forces the presence of the `gpxsamples` submodule for every test run; if you want `test_gpxtable.py` or other pure-unit tests to be runnable without the submodule (e.g. via `make test-unit`), consider scoping this check to tests that actually use `gpx_sample()` (via marks, fixtures, or file-level imports) instead of failing the whole suite up front.
- Given that `Makefile` targets like `test-unit` and some docs describe unit tests as not needing GPX inputs, you might want to align this with the new submodule requirement by either dropping `submodules` from those flows or documenting that all pytest invocations now require `git submodule update --init` so there’s no inconsistency in developer expectations.

## Individual Comments

### Comment 1
<location path="Makefile" line_range="74-89" />
<code_context>
 # ── CLI demos ────────────────────────────────────────────────────────────────

 demo-route:
-	gpxtable samples/basecamp-route.gpx
+	gpxtable gpxsamples/basecamp-route.gpx

 demo-tracks:
-	gpxtable --departure "07/30/2023 09:15:00" samples/basecamp-tracks.gpx
+	gpxtable --departure "07/30/2023 09:15:00" gpxsamples/basecamp-tracks.gpx

 demo-basecamp:
-	gpxtable samples/basecamp.gpx
+	gpxtable gpxsamples/basecamp.gpx

 demo-config:
 	gpxtable --dump-config

 demo-custom: /tmp/myconfig.json
-	gpxtable --config /tmp/myconfig.json samples/basecamp-route.gpx
+	gpxtable --config /tmp/myconfig.json gpxsamples/basecamp-route.gpx

 /tmp/myconfig.json:
</code_context>
<issue_to_address>
**suggestion (bug_risk):** Demo targets now depend on gpxsamples but don’t ensure the submodule is initialized.

Since these `demo-*` targets now read from `gpxsamples/`, they will fail in a fresh clone if the submodule hasn’t been initialized. Please add `submodules` as a dependency for `demo-route`, `demo-tracks`, `demo-basecamp`, and `demo-custom` so they behave consistently with `test`/`generate-samples`.

```suggestion
# ── CLI demos ────────────────────────────────────────────────────────────────

demo-route: submodules
	gpxtable gpxsamples/basecamp-route.gpx

demo-tracks: submodules
	gpxtable --departure "07/30/2023 09:15:00" gpxsamples/basecamp-tracks.gpx

demo-basecamp: submodules
	gpxtable gpxsamples/basecamp.gpx

demo-config:
	gpxtable --dump-config

demo-custom: submodules /tmp/myconfig.json
	gpxtable --config /tmp/myconfig.json gpxsamples/basecamp-route.gpx
```
</issue_to_address>

### Comment 2
<location path=".github/workflows/python-app.yml" line_range="26-28" />
<code_context>
     - uses: actions/checkout@v7
-    - uses: astral-sh/setup-uv@v8.2.0
+    - uses: astral-sh/setup-uv@v9.0.0
       with:
         enable-cache: true
         python-version: "3.12"
</code_context>
<issue_to_address>
**issue:** Fetching a private submodule in CI may still break for forks, even with the token fallback.

Because forks don’t have `GPXSAMPLES_TOKEN` and can’t use their default `github.token` to pull your private `gpxsamples` submodule, `actions/checkout` will still fail when `submodules: true` is set. To keep fork CI usable, consider enabling submodules only for the main repo (e.g., via `github.repository_owner`) or making tests gracefully skip submodule-dependent cases when the GPX inputs aren’t available.
</issue_to_address>

### Comment 3
<location path="samples/basecamp-route.txt" line_range="11" />
<code_context>
+| Peet's Coffee Northgate Mall   |       0 |    | 09:15 | Restaurant
+| Nicasio Square                 |      12 |    | 09:39 | Restroom (+0:15)
+| Pat's International            |      65 |  L | 11:41 | Restaurant (+1:00)
+| 76 Gureneville                 |   65/65 |  G | 12:41 | Gas Station (+0:15)
+| Willy's America                |      79 |    | 13:23 | Scenic Area (+0:05)
+| 76 Bodega Bay                  |  67/132 |  G | 15:14 | Gas Station (+0:15)
</code_context>
<issue_to_address>
**issue (typo):** Typo in place name: "Gureneville" vs "Guerneville" used elsewhere.

In `samples/basecamp.txt` the waypoint is spelled "76 Guerneville", so this entry in `samples/basecamp-route.txt` is likely incorrect. Please align the spelling to keep the fixtures consistent.

```suggestion
| 76 Guerneville                 |   65/65 |  G | 12:41 | Gas Station (+0:15)
```
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}