Codacy and code-quality follow-ups after reaching grade A (plan) #894

The code-quality work of 23 October 2026 (#888, #890, #891, #892, #893) took Codacy from grade B (89) to A (91). This is the plan for what is left. Several items are design decisions, not cleanup, so please comment here and do not send a PR for them.

Where it stands (Codacy, main, 23 October 2026)

The 129 narrowing asserts in src went to zero with # nosec B101: <reason>, so Codacy honors it. .codacy.yml now skips Bandit in tests/, the Dynamixel and ROS sketches, the vendored Eigen headers, and pyflakes in tests/ and examples/ (deliberate star imports).

To look again, the public API needs no token: curl https://app.codacy.com/api/v3/analysis/organizations/gh/petercorke/repositories/robotics-toolbox-python for the summary, and POST …/issues/search?limit=100 with body {} for the findings.

Plan

Small, mechanical

• Add # nosec with a reason to the deliberate exec and subprocess uses (55 findings): the code generator robot/symbolic_ik_rr.py (8) and symbolic_ik.py, the moved tests tests/test_symbolic_ik*.py (20) that compile and run generated code, blocks/spatial.py and blocks/arm.py (4 each), docs/lite/browser_check/check_lite_in_browser.py (5).
• The 34 unused local variables (F841), one by one. Some are constants in models/ and are safe to delete; blocks/uav.py has an unused li and alphas that may hide a bug; several tests build a block they never use.
• Mutable default arguments (8, W0102): fix, as they are real bugs waiting to happen.
• The 18 "undefined name" findings in L["rpy/xyz", …] hints are false positives caused by the alias Literal as L. Either import Literal under its own name or leave them.
• Look at the remaining "used before assignment" and "unexpected keyword" findings (E0601, E1123, E1120). The three I checked were false positives; the rest in tests/ and examples/ are unchecked.

Test hygiene

• tests/test_blocks.py is excluded from CI (--ignore=tests/test_blocks.py), and its test_jtraj is skipped, which is why the JTraj bug in fix(blocks): JTraj ends at rest, and accepts qd0 and qdf #890 lasted. Find out why it is excluded, and run it or port its tests.
• Decide on the if __name__ == "__main__" demo blocks in 91 modules (1,203 lines, mostly plots, never tested). Remove them, or move the long ones (mobile/EKF.py 193 lines, Vehicle.py 102) to examples/.

Design (comment before any PR)

• Two-phase initialization. 41 asserts only narrow a type for mypy, mostly attributes that are None until plan(), query() or a plot call (occgrid, _goal, start, fig/ax). A planner that returns a result object from plan() would remove the None, in line with the stateless aim in desiderata.md.
• "Arguments differ" (26): PlannerBase.plot has 33 parameters and LatticePlanner.plot has 3; Connector.add differs from PyPlot.add. Overlaps Connector/backend API polish: addable-object superclass, teach-panel promotion, getframe() #676 and Backends wanted: CoppeliaSim, Viser, Gazebo, MuJoCo and others (plan first) #886.
• "Redefined builtin" (70): parameters named map, id, next, format, bin. These are public names, so renaming needs a deprecation. Alternatively disable the pattern in Codacy.

Probably not worth doing

• Complexity and duplication to the 10% goals. The most complex files are robot/symbolic_ik.py (total cyclomatic complexity 505), BaseRobot.py, tools/urdf/urdf.py and DHRobot.py. Splitting symbolic_ik.py (about 2,200 lines) would help but is a refactor.
• Reporting coverage to Codacy as well as Codecov, which would fill its fourth measure.

Decisions already made

• Windows: the two C-kernel tests that timed out on the Windows runner are marked slow and run only in the Linux coverage job. The analytic IK solver itself passes on Windows (tests/test_analytic_ik.py). No separate slow-test workflow, decided 23 October 2026.
• Third-party GitHub Actions are pinned to commit SHAs (ci: pin third-party GitHub Actions to commit SHAs #892). The other repos are in Pin third-party GitHub Actions to commit SHAs, across the toolbox repos rvc-ecosystem#24.