chore: add DeepSource config scoped to hand-written code - #96
Merged
Conversation
abhishekmishragithub
added a commit
that referenced
this pull request
Aug 8, 2026
The .deepsource.toml is added directly to main in #96 so analysis activates without waiting for this release. Removed here to avoid a duplicate add.
Enables DeepSource analysis on the repo. The SDK is mostly Fern-generated, so generated surfaces (raw_client, client, socket_client, types, errors, core, environment, package __init__) are excluded so findings focus on hand-written code: crew, cli, helpers, tools, telemetry. Python analyzer with mypy type checking (line length 120 to match ruff), plus the secrets and test-coverage analyzers.
abhishekmishragithub
force-pushed
the
chore/deepsource-config
branch
from
August 8, 2026 03:41
38b3827 to
e38a13d
Compare
abhishekmishragithub
added a commit
that referenced
this pull request
Aug 9, 2026
#95) * release: 5.10.0 — adapters, tools, crew ownership, telemetry, CLI DevX Consolidated feature release (previously split across feat/framework-adapters, feat/crew-config-ownership, feat/tools-framework, feat/telemetry, feat/cli-devx): - integrations: optional pipecat + livekit adapters (smallestai[pipecat]/[livekit]), lazy re-exports of the framework-native plugins. - tools: smallestai.tools framework + ExaSearchTool (smallestai[exa]); plugs into a crew ToolRegistry in one line. - cli: agent-crew init prints crew-vs-platform ownership; new agent-crew doctor; SDKSystemUpdateOutputAgentSettingsEvent deprecated. - telemetry: anonymous, opt-out usage telemetry via PostHog (no PII/secrets, SMALLESTAI_TELEMETRY=0 / DO_NOT_TRACK=1). - cli: welcome banner on bare `smallestai` (no more "Missing command" error) + new `smallestai mcp` command for the MCP server. Third-party libraries are optional extras, lazy-imported; core deps unchanged. Version 5.10.0. Full custom test suite green; mypy clean on new files. * fix(deps): scope optional framework deps by python + regen lock CI (poetry) failed to resolve the optional extras: pipecat-ai requires Python >=3.11 and livekit-plugins-smallestai >=3.10, but the SDK supports python ^3.9, so `version = "*"` had no match across the range. Add python markers so poetry only resolves them on compatible interpreters, drop the nonexistent pipecat-ai[smallest] extra, and regenerate poetry.lock to match pyproject. * fix(tests): type: ignore optional-framework imports in adapter/tool tests The compile CI step is `mypy .`. The adapter/tool tests import pipecat/livekit/exa in their 'if installed' branches; those aren't installed in CI, so mypy flagged import-not-found. Mark them type: ignore[import-not-found], matching the source modules. Verified with mypy 1.13.0 (the CI-pinned version): 0 errors, 1021 files. * style: ruff lint + format across hand-written files Apply ruff --fix (unused imports, import sorting) and ruff format to the hand-written code (examples, tests, scripts, cli/crew/helpers/tools/integrations). Generated Fern output was already ruff-formatted and is untouched. Makes the tree conform to the new ruff CI gate + pre-commit hooks. * chore(dev): pre-commit hooks + CI lint/security gates - .pre-commit-config.yaml: ruff (lint+format) + gitleaks. - CI: new lint job (ruff check + ruff format --check) and security job (gitleaks secret scan + pip-audit dependency CVEs); both gate publish. - .gitleaks.toml allowlists the write-only PostHog phc_ key. - .deepsource.toml (scoped to hand-written code) ready if the DeepSource app is enabled. Verified locally: ruff clean, gitleaks 'no leaks found', pip-audit 'no known vulnerabilities'. * ci: make pip-audit report-only (pre-existing transitive CVE backlog) pip-audit flags advisories in pinned transitive deps (pytest, requests, urllib3, starlette, setuptools, python-dotenv) that predate this branch. Keep it surfacing CVEs in CI but non-blocking (continue-on-error) so it doesn't gate the release on pre-existing debt; gitleaks + ruff remain hard gates. Bump the deps in a follow-up, then flip pip-audit to blocking. * fix(cli): correct MCP server package + env var in `smallestai mcp` The published MCP server is @developer-smallestai/smallest-mcp-server (npm), not @smallest-ai/mcp-server (which 404s), and it reads ATOMS_API_KEY (not SMALLEST_API_KEY). Aligned the command, config snippet, and claude-mcp-add lines to the published package + the docs. `mcp run` bridges ATOMS_API_KEY from SMALLEST_API_KEY if only the latter is set. Caught while writing the public docs. * docs(integrations): livekit adapter exposes both STT and TTS The published livekit-plugins-smallestai (livekit/agents repo) exports STT + TTS. Updated the adapter docstring example to import both, and the test to assert both forward. No code change (the adapter is a passthrough); pipecat STT+TTS already correct. * revert(integrations): drop pipecat/livekit adapters from 5.10 The docs already have canonical LiveKit + Pipecat integration pages using the native packages (livekit-plugins-smallestai, pipecat-ai[smallest], both STT + TTS). A smallestai.integrations re-export is a redundant second path, so remove it: the module, its test, the [pipecat]/[livekit] extras, and the fernignore entry. Kept the tools framework (Exa) - it has no canonical equivalent. Consolidated the changelog into a single accurate 5.10.0 entry and fixed the MCP package name there too. * chore: move DeepSource config to its own PR (#96) The .deepsource.toml is added directly to main in #96 so analysis activates without waiting for this release. Removed here to avoid a duplicate add. * feat(api): add user.get_subscription; remove dead atoms.organization Regenerated from the updated atoms OpenAPI (generator 5.12.12): - add `client.atoms.user.get_subscription()` -> GetSubscriptionUserResponse (plan id, credits, per-plan limits, feature flags) - remove `client.atoms.organization` — the underlying GET /organization returned 404 on the public API and was never functional Isolated to the subscription + organization delta (two-pass regen diff, so no unrelated spec drift is pulled in). Verified: mypy clean (1011 files), custom tests pass, and the user wire tests (incl. subscription) pass. * chore: ruff-format the get_subscription example in reference.md CI lint runs ruff 0.16.1, which formats python code blocks inside markdown; the spliced example block needed reformatting. * feat(api): add remaining Voice Agents + Speech endpoints (5.10 completeness) Regenerated from the combined atoms + waves specs (generator 5.12.12), applied as a delta so the branch's existing waves streaming-TTS layer is untouched. Voice Agents (atoms): - account.get_account_details, account.update_organization_name - web_call.start_web_chat_conversation, web_call.start_web_call_conversation - campaigns.export_campaign_logs, campaigns.export_campaign_results_by_audience_member Speech (waves): - post_call_analysis.analyze, post_call_analysis.generate - voices.get_all_voice_models - analytics.* (ASR/TTS logs, usage/credits/concurrency/ws timeseries, webhook logs) - ops.get_waves_health Verified: mypy clean (1076 files), ruff check + format clean (0.16.1), full pytest 354 passed / 4 skipped (incl. wire tests for every new endpoint). reference.md is left for the next canonical regen; the SDK code and the docs-site API reference cover the full surface. * chore(security): allowlist generated wire-test fixtures in gitleaks wiremock/wiremock-mappings.json is generated test data; its web-call stub responses carry example (non-real) LiveKit JWTs that gitleaks flags. Allowlist the fixture path so the secret scan stays green.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
.deepsource.tomlso DeepSource analysis activates on the repo (the GitHub app is already configured).The SDK is mostly Fern-generated, so generated surfaces are excluded to keep findings on hand-written code (
crew,cli,helpers,tools,telemetry):raw_client.py,client.py,socket_client.py,types/**,errors/**,core/**,environment.py, package__init__.pyAnalyzers (reference):
type_checker = mypy,max_line_length = 120(matches ruff)Standalone so DeepSource starts reading
mainimmediately, rather than waiting for the 5.10 release. Will be removed from the 5.10 release branch to avoid a duplicate add.