ci: add lint + test + PyPI publish workflows; fix all ruff violations

- Add .github/workflows/ci.yml: ruff lint gate + pytest on Python 3.9-3.12
- Add .github/workflows/publish.yml: build & publish to PyPI on tag push (OIDC)
- Add ruff and pytest to dev dependencies in pyproject.toml
- Fix all ruff E701/E741/F841/F811 violations across orca_cli/ and tests/
- Remove duplicate backup command block in volume.py

Author: kallioli

.github/workflows/ci.yml

@@ -0,0 +1,48 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  lint:
+    name: Lint (ruff)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install ruff
+        run: pip install ruff
+
+      - name: Run ruff
+        run: ruff check .
+
+  test:
+    name: Tests (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    needs: lint
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.9", "3.10", "3.11", "3.12"]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: |
+          pip install poetry
+          poetry install --with dev
+
+      - name: Run tests
+        run: poetry run pytest tests/ -v --tb=short

.github/workflows/publish.yml

@@ -0,0 +1,40 @@
+name: Publish to PyPI
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  ci:
+    name: Lint + Tests
+    uses: ./.github/workflows/ci.yml
+
+  publish:
+    name: Build & Publish
+    runs-on: ubuntu-latest
+    needs: ci
+    environment: pypi
+    permissions:
+      id-token: write  # required for OIDC trusted publisher
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install poetry
+        run: pip install poetry
+
+      - name: Set version from tag
+        run: |
+          TAG=${GITHUB_REF#refs/tags/v}
+          poetry version "$TAG"
+
+      - name: Build package
+        run: poetry build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

orca_cli/commands/aggregate.py

@@ -5,7 +5,7 @@
 import click
 
 from orca_cli.core.context import OrcaContext
-from orca_cli.core.output import output_options, print_list, print_detail, console
+from orca_cli.core.output import console, output_options, print_detail, print_list
 
 
 def _nova(client) -> str:

orca_cli/commands/application_credential.py

@@ -5,7 +5,7 @@
 import click
 
 from orca_cli.core.context import OrcaContext
-from orca_cli.core.output import output_options, print_list, print_detail, console
+from orca_cli.core.output import console, output_options, print_detail, print_list
 
 
 def _iam(client) -> str:
@@ -98,7 +98,7 @@ def app_credential_create(ctx, name, description, secret, expires_at, unrestrict
     console.print(f"[green]Application credential '{a.get('name')}' ({a.get('id')}) created.[/green]")
     if a.get("secret"):
         console.print(f"  [cyan]Secret:[/cyan] {a['secret']}")
-        console.print(f"  [bold yellow]This secret will NOT be shown again.[/bold yellow]")
+        console.print("  [bold yellow]This secret will NOT be shown again.[/bold yellow]")
 
 
 @application_credential.command("delete")

orca_cli/commands/audit.py

@@ -7,7 +7,6 @@
 from orca_cli.core.context import OrcaContext
 from orca_cli.core.output import console
 
-
 _DANGEROUS_PORTS = {22, 3389, 3306, 5432, 6379, 27017, 9200, 11211}
 _DANGEROUS_LABELS = {
     22: "SSH", 3389: "RDP", 3306: "MySQL", 5432: "PostgreSQL",
@@ -88,7 +87,7 @@ def audit(ctx: click.Context) -> None:
             # Server in error
             if srv.get("status") == "ERROR":
                 findings.append(("LOW", f"Server: {srv_name}", srv_id,
-                                 f"Server in ERROR state"))
+                                 "Server in ERROR state"))
 
             # Check if server has floating IP (publicly reachable)
             has_floating = False

orca_cli/commands/auth.py

@@ -7,15 +7,15 @@
 import click
 
 from orca_cli.core.config import (
-    load_config,
+    _find_clouds_yaml,
+    _load_clouds_yaml,
     config_is_complete,
     get_active_profile_name,
     list_profiles,
-    _find_clouds_yaml,
-    _load_clouds_yaml,
+    load_config,
 )
 from orca_cli.core.context import OrcaContext
-from orca_cli.core.output import console, output_options, print_detail
+from orca_cli.core.output import console
 
 
 @click.group()
@@ -122,7 +122,6 @@ def auth_token_debug(ctx: click.Context, raw: bool) -> None:
 
     from rich.table import Table
     from rich.tree import Tree
-    from rich.text import Text
 
     user = td.get("user", {})
     project = td.get("project", {})

orca_cli/commands/backup.py

@@ -5,7 +5,7 @@
 import click
 
 from orca_cli.core.context import OrcaContext
-from orca_cli.core.output import output_options, print_list, print_detail, console
+from orca_cli.core.output import console, output_options, print_detail, print_list
 
 
 def _freezer(client) -> str:
@@ -172,10 +172,10 @@ def job_show(ctx: click.Context, job_id: str, output_format: str,
         for i, a in enumerate(actions):
             fa = a.get("freezer_action", {})
             fields.append((f"  Action {i + 1}", fa.get("action", "")))
-            fields.append((f"  Path", fa.get("path_to_backup", "") or fa.get("restore_abs_path", "") or "—"))
-            fields.append((f"  Container", fa.get("container", "") or "—"))
-            fields.append((f"  Storage", fa.get("storage", "") or "—"))
-            fields.append((f"  Mode", fa.get("mode", "") or "—"))
+            fields.append(("  Path", fa.get("path_to_backup", "") or fa.get("restore_abs_path", "") or "—"))
+            fields.append(("  Container", fa.get("container", "") or "—"))
+            fields.append(("  Storage", fa.get("storage", "") or "—"))
+            fields.append(("  Mode", fa.get("mode", "") or "—"))
 
     print_detail(fields, output_format=output_format, fit_width=fit_width,
                  max_width=max_width, noindent=noindent, columns=columns)

orca_cli/commands/catalog.py

@@ -5,7 +5,7 @@
 import click
 
 from orca_cli.core.context import OrcaContext
-from orca_cli.core.output import output_options, print_list, console
+from orca_cli.core.output import console, output_options, print_list
 
 
 @click.command("catalog")

orca_cli/commands/cluster.py

@@ -5,8 +5,7 @@
 import click
 
 from orca_cli.core.context import OrcaContext
-from orca_cli.core.output import output_options, print_list, print_detail, console
-from orca_cli.core.validators import validate_id
+from orca_cli.core.output import console, output_options, print_detail, print_list
 
 
 def _magnum(client) -> str:
@@ -253,7 +252,7 @@ def template_create(ctx: click.Context, name: str, image_id: str, external_netwo
     if docker_volume_size:
         body["docker_volume_size"] = docker_volume_size
     if labels:
-        body["labels"] = dict(l.split("=", 1) for l in labels)
+        body["labels"] = dict(item.split("=", 1) for item in labels)
 
     data = client.post(f"{_magnum(client)}/clustertemplates", json=body)
     console.print(f"[green]Template '{data.get('name')}' ({data.get('uuid')}) created.[/green]")

orca_cli/commands/compute_service.py

@@ -5,7 +5,7 @@
 import click
 
 from orca_cli.core.context import OrcaContext
-from orca_cli.core.output import console, output_options, print_detail, print_list
+from orca_cli.core.output import console, output_options, print_list
 
 
 @click.group("compute-service")