[DysektAI]

Summary

• Pin Pillow 13.0.0 with regenerated release hashes to address the Pillow 12.3.0 advisory chain.
• Restore workflow parsing: the inline --only-binary :all: command was invalid YAML; retain hash and binary-only enforcement in a block scalar.
• Add read-only, offline PR validation (no data downloads or release creation), with separate PR/release concurrency groups.
• Document Python >=3.11, matching Pillow 13 support.

Validation

• Baseline: the decoder-pin regression test failed with Pillow 12.3.0; actionlint rejected the original workflow at line 50.
• Strict hash-locked binary installation of Pillow 13.0.0 passed on Python 3.12.
• Five offline tests passed: security pin, PNG/WebP pixel/transparency compatibility, opaque RGB, invalid input rejection, and deterministic Data.zip independently validated with slot geometry preserved.
• Four conversion/metadata mutations were rejected by the corresponding tests.
• ruff check scripts, ruff format --check scripts, actionlint .github/workflows/build-release.yml, LSP diagnostics, and git diff --check passed.
• Local CodeRabbit review of commit 5db9b4c: completed, zero findings across all five changed files.

Risk / rollout

This is a major Pillow upgrade and drops Python 3.10 support; explicit maintainer merge approval is required. No generated production data, releases, billing settings, or security exceptions were changed. A full live upstream data rebuild was not run; hosted PR validation will exercise Python 3.13. The existing merge-to-master validation build does not publish a release.

Pillow release/security notes: https://pillow.readthedocs.io/en/stable/releasenotes/13.0.0.html

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Essentials
• Run ID: 15078c2e-9ad1-4ef0-8444-3f3ecde24e9d

Commits

Reviewing files that changed from the base of the PR and between 5db9b4c and 1e7f112.

Files selected for processing: 2

• .github/workflows/build-release.yml
• scripts/test_build_data.py

Included review availability: This review used your included allowance. 2 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour.

📝 Summary

Summary by CodeRabbit

• Documentation
  • Updated local build instructions to require Python 3.11 or later and include running the test suite.
  • Clarified the checks performed for pull requests, including offline tests that do not download upstream data or create releases.
• Tests
  • Added offline checks for image handling, invalid image data, and consistent bundle generation.
  • Pull requests now run formatting, compilation, and unit tests.
• Chores
  • Updated the supported Python target and pinned image library version.
  • Release builds now run unit tests.

The PR updates the Python and Pillow requirements, adds offline tests for image decoding and bundle generation, and configures pull request validation separately from release builds.

Changes: Python validation and release workflow

Layer / File(s)	Summary
Python and decoder requirements pyproject.toml, requirements.txt, README.md, scripts/test_build_data.py	The Ruff target and documented minimum Python version change to 3.11. Pillow is pinned to 13.0.0. New tests check the Pillow pin and PNG/WebP decoding, including invalid image data.
Offline bundle build test scripts/test_build_data.py	A new test builds and validates a bundle from mocked sources. It checks manifest and icon fields, ZIP timestamps, and whether repeated builds produce identical archive bytes.
Pull request validation and build workflow .github/workflows/build-release.yml, README.md	Pull requests trigger validation when specified files change. A read-only validation job runs lint, format, compile, and unit tests. The build job excludes pull requests and adds unit tests. The README describes the workflow and test coverage.

Priority: Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Possibly related PRs

• tarkovtracker-org/RatScannerData#2: Both PRs change .github/workflows/build-release.yml; this PR changes how scheduled events run and share the release concurrency group.

Merge Risk: Minimal · up to 1e7f1

No actionable merge-blocking risk remains; the PR is suitable to merge after normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title names the two main parts of the changeset: the Pillow upgrade (12.3.0 to 13.0.0, with regenerated hashes) and the restored validated dependency installs in the workflow. It is specific and c…
Description check		The description matches the changeset. It covers the Pillow 13.0.0 pin and regenerated hashes, the workflow YAML fix, the read-only offline PR validation job with separate concurrency groups, the Pyth…
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the two main parts of the changeset: the Pillow upgrade (12.3.0 to 13.0.0, with regenerated hashes) and the restored validated dependency installs in the workflow. It is specific and conventional, and it matches the PR objectives. The title is 71 characters, which is a little long but acceptable.

Full details: Description check

Explanation

The description matches the changeset. It covers the Pillow 13.0.0 pin and regenerated hashes, the workflow YAML fix, the read-only offline PR validation job with separate concurrency groups, the Python 3.11 documentation change, and the validation steps that were run.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 2 functions across 1 files. (1 skipped: 1 unsupported.)

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​pillow@​12.3.0 ⏵ 13.0.0	+1	+75

View full report

[DysektAI]

Merged at 49e4fe6 after exact-head approval and passing checks.

Post-merge verification passed on that SHA:

• Full live build generated 5,359 icons; independent Data.zip validation passed.
• CodeQL and Dependency Graph workflows passed.
• GitHub now reports zero open dependency alerts (previously 82 alert entries).
• The existing push workflow ran in validate mode: release creation was skipped. No production release was published.

Validated artifact: https://github.com/tarkovtracker-org/RatScannerData/actions/runs/40797055492

Removed only this merged task’s local worktree and topic branches; the local master checkout is clean and up to date.