fix: address critical and medium post-audit findings

Critical/High:
- Remove dead _get_model() cached wrapper (never called)
- Add [build-system] to pyproject.toml for reliable editable installs
- Fix devcontainer.json to use pyproject.toml instead of deleted requirements.txt
- Add scikit-learn and scikeras as [train] optional deps

Medium:
- Move streamlit import in config.py to lazy import inside configure_page()
- Remove unreachable QueryExecutionError catch blocks in 1_home_team.py
- Add uv cache step to CI workflow
- Fix actions/checkout and actions/setup-python to stable v4/v5

Low:
- Remove duplicated --cov-fail-under from CI (pyproject.toml is single source)
- Fix SIM105 indentation in pyproject.toml
- Fix compile_model.py arr type to match str|float sliced values
- Add dist/ and build/ to .gitignore

.devcontainer/devcontainer.json

@@ -17,7 +17,7 @@
       ]
     }
   },
-  "updateContentCommand": "[ -f packages.txt ] && sudo apt update && sudo apt upgrade -y && sudo xargs apt install -y <packages.txt; [ -f requirements.txt ] && pip3 install --user -r requirements.txt; pip3 install --user streamlit; echo '✅ Packages installed and Requirements met'",
+  "updateContentCommand": "[ -f packages.txt ] && sudo apt update && sudo apt upgrade -y && sudo xargs apt install -y <packages.txt; pip3 install --user -e '.[dev]'; echo 'Packages installed and requirements met'",
   "postAttachCommand": {
     "server": "streamlit run app.py"
   },

.github/workflows/ci.yml

@@ -11,21 +11,28 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
         with:
           python-version: "3.11"
 
       - name: Install uv
         run: pip install uv
 
+      - name: Cache uv packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/uv
+          key: uv-${{ runner.os }}-${{ hashFiles('pyproject.toml') }}
+          restore-keys: uv-${{ runner.os }}-
+
       - name: Install dependencies
         run: uv pip install -e ".[dev]" --system
 
       - name: Run tests
-        run: pytest --cov=src --cov-report=term-missing --cov-fail-under=70
+        run: pytest --cov=src --cov-report=term-missing
 
       - name: Run ruff
         run: ruff check src/ tests/

.gitignore

@@ -18,6 +18,8 @@ htmlcov/
 
 # Packaging
 *.egg-info/
+dist/
+build/
 
 # uv
 uv.lock

pages/1_home_team.py

@@ -8,7 +8,6 @@ import streamlit as st
 from src.config import DIFFICULTY_PRESETS, PLAYER_COLUMNS, configure_page
 from src.database.connection import (
     DatabaseConnectionError,
-    QueryExecutionError,
     load_data,
 )
 from src.database.queries import get_players_by_full_names, search_player_by_name
@@ -64,12 +63,8 @@ def find_player(search_term: str) -> list[str]:
         results = search_player_by_name(data, validated_term)
         return [player[0] for player in results]
     except DatabaseConnectionError as e:
-        st.error("Could not connect to database. Please try again later.")
-        logger.error("Database connection error: %s", e)
-        return []
-    except QueryExecutionError as e:
-        st.error("Error searching for players. Please try again.")
-        logger.error("Query error: %s", e)
+        st.error("Could not load player data. Please try again later.")
+        logger.error("Data load error: %s", e)
         return []
 
 
@@ -92,12 +87,8 @@ def find_home_team() -> pd.DataFrame:
         st.session_state.home_team_df = df
         return df
     except DatabaseConnectionError as e:
-        st.error("Could not connect to database. Please try again later.")
-        logger.error("Database connection error: %s", e)
-        return pd.DataFrame(columns=PLAYER_COLUMNS)
-    except QueryExecutionError as e:
-        st.error("Error loading team data. Please try again.")
-        logger.error("Query error: %s", e)
+        st.error("Could not load player data. Please try again later.")
+        logger.error("Data load error: %s", e)
         return pd.DataFrame(columns=PLAYER_COLUMNS)
 
 

pages/2_play_game.py

@@ -25,7 +25,6 @@ from src.database.queries import get_away_team_by_stats
 from src.ml.model import (
     ModelLoadError,
     analyze_team_stats,
-    get_winner_model,
     predict_winner,
 )
 from src.state.session import get_away_stats, get_home_team_df, init_session_state
@@ -41,11 +40,6 @@ def _load_nba_data() -> pd.DataFrame:
     return load_data()
 
 
-@st.cache_resource
-def _get_model():  # type: ignore[no-untyped-def]
-    return get_winner_model()
-
-
 # Initialize session state BEFORE any access
 init_session_state()
 

pyproject.toml

@@ -1,3 +1,7 @@
+[build-system]
+requires = ["setuptools>=68.0"]
+build-backend = "setuptools.build_meta"
+
 [project]
 name = "streamlit-nba"
 version = "1.1.0"
@@ -21,6 +25,10 @@ dev = [
     "pandas-stubs>=2.0.0",
     "pre-commit>=3.0.0",
 ]
+train = [
+    "scikit-learn>=1.3.0",
+    "scikeras>=0.12.0",
+]
 
 [tool.mypy]
 python_version = "3.11"
@@ -75,7 +83,7 @@ select = [
 ignore = [
     "S101",   # assert used (ok in tests)
     "PLR0913", # too many arguments
-"SIM105", # prefer explicit try-except over contextlib.suppress
+    "SIM105", # prefer explicit try-except over contextlib.suppress
     "PLR2004", # magic numbers ok in game logic
     "S311",   # standard pseudo-random generators ok for game logic
     "E501",   # line length (handled by formatter or ignored)
@@ -83,6 +91,7 @@ ignore = [
 
 [tool.ruff.lint.per-file-ignores]
 "tests/*" = ["S101", "ARG001", "ARG002", "PLR2004", "PLC0415"]
+"src/config.py" = ["PLC0415"]  # lazy import of streamlit in configure_page()
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]

scripts/compile_model.py

@@ -95,7 +95,7 @@ def create_stats(roster: pd.DataFrame, schedule: pd.DataFrame) -> list[np.ndarra
 
     # Combine home and away stats for each game
     for i in range(len(home_stats)):
-        arr: list[float] = []
+        arr: list[str | float] = []
 
         for row in home_stats[i]:
             arr.extend(row[1:])  # Skip team name column

src/config.py

@@ -3,8 +3,6 @@
 import logging
 from typing import Final
 
-import streamlit as st
-
 # Database column names for player data
 PLAYER_COLUMNS: Final[list[str]] = [
     "FULL_NAME",
@@ -93,5 +91,7 @@ def setup_logging(level: int = logging.INFO) -> logging.Logger:
 
 def configure_page() -> None:
     """Configure Streamlit page settings and logging."""
+    import streamlit as st
+
     setup_logging()
     st.set_page_config(layout="wide")