From 0cbbc94021d400fde7cc7015ab4e2e52a87836fd Mon Sep 17 00:00:00 2001
From: Ian Duffy <iduffy@cloudsmith.io>
Date: Sat, 22 Aug 2026 00:25:55 +0100
Subject: [PATCH] chore(no-ticket): enforce type-checking-only imports with
 ruff

Select the FA and TC rule groups. Typing-only imports must sit in an
if TYPE_CHECKING block, which pre-commit and CI both enforce through
the ruff-check hook.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 cloudsmith_cli/core/cache_utils.py                         | 6 ++++--
 cloudsmith_cli/core/credentials/chain.py                   | 7 +++++--
 cloudsmith_cli/core/credentials/oidc/detectors/__init__.py | 2 +-
 cloudsmith_cli/core/credentials/provider.py                | 4 +++-
 cloudsmith_cli/credential_helpers/docker/installer.py      | 5 ++++-
 pyproject.toml                                             | 1 +
 6 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/cloudsmith_cli/core/cache_utils.py b/cloudsmith_cli/core/cache_utils.py
index c08e9a95..b2e31300 100644
--- a/cloudsmith_cli/core/cache_utils.py
+++ b/cloudsmith_cli/core/cache_utils.py
@@ -6,8 +6,10 @@
 import json
 import os
 import tempfile
-from collections.abc import Callable
-from typing import Any
+from typing import TYPE_CHECKING, Any
+
+if TYPE_CHECKING:
+    from collections.abc import Callable
 
 
 def _atomic_write_text(dest: str, text: str, *, mode: int = 0o600) -> None:
diff --git a/cloudsmith_cli/core/credentials/chain.py b/cloudsmith_cli/core/credentials/chain.py
index f892d039..3b5e3b09 100644
--- a/cloudsmith_cli/core/credentials/chain.py
+++ b/cloudsmith_cli/core/credentials/chain.py
@@ -7,9 +7,8 @@
 from __future__ import annotations
 
 import logging
+from typing import TYPE_CHECKING
 
-from .models import CredentialContext, CredentialResult
-from .provider import CredentialProvider
 from .providers import (
     CLIFlagProvider,
     CredentialsFileProvider,
@@ -18,6 +17,10 @@
     OidcProvider,
 )
 
+if TYPE_CHECKING:
+    from .models import CredentialContext, CredentialResult
+    from .provider import CredentialProvider
+
 logger = logging.getLogger(__name__)
 
 
diff --git a/cloudsmith_cli/core/credentials/oidc/detectors/__init__.py b/cloudsmith_cli/core/credentials/oidc/detectors/__init__.py
index 210140cb..0a77eb3e 100644
--- a/cloudsmith_cli/core/credentials/oidc/detectors/__init__.py
+++ b/cloudsmith_cli/core/credentials/oidc/detectors/__init__.py
@@ -7,7 +7,6 @@
 
 from .aws import AWSDetector
 from .azure_devops import AzureDevOpsDetector
-from .base import EnvironmentDetector
 from .bitbucket_pipelines import BitbucketPipelinesDetector
 from .circleci import CircleCIDetector
 from .generic import GenericDetector
@@ -18,6 +17,7 @@
     from collections.abc import Mapping
 
     from ... import CredentialContext
+    from .base import EnvironmentDetector
 
 logger = logging.getLogger(__name__)
 
diff --git a/cloudsmith_cli/core/credentials/provider.py b/cloudsmith_cli/core/credentials/provider.py
index 78b18886..8adeb732 100644
--- a/cloudsmith_cli/core/credentials/provider.py
+++ b/cloudsmith_cli/core/credentials/provider.py
@@ -3,8 +3,10 @@
 from __future__ import annotations
 
 from abc import ABC, abstractmethod
+from typing import TYPE_CHECKING
 
-from .models import CredentialContext, CredentialResult
+if TYPE_CHECKING:
+    from .models import CredentialContext, CredentialResult
 
 
 class CredentialProvider(ABC):
diff --git a/cloudsmith_cli/credential_helpers/docker/installer.py b/cloudsmith_cli/credential_helpers/docker/installer.py
index 818812d8..4431a76d 100644
--- a/cloudsmith_cli/credential_helpers/docker/installer.py
+++ b/cloudsmith_cli/credential_helpers/docker/installer.py
@@ -13,13 +13,16 @@
 import os
 import sys
 from pathlib import Path
+from typing import TYPE_CHECKING
 
 from ...core.cache_utils import merge_json_file
-from ...core.credentials.models import CredentialResult
 from ..backends import BackendKind
 from ..custom_domains import get_format_domains
 from ..launchers import is_on_path, remove_launcher, resolve_bin_dir, write_launcher
 
+if TYPE_CHECKING:
+    from ...core.credentials.models import CredentialResult
+
 logger = logging.getLogger(__name__)
 
 
diff --git a/pyproject.toml b/pyproject.toml
index bab3fd9d..b0d30268 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -142,6 +142,7 @@ show_missing = true
 directory = "reports/coverage"
 
 [tool.ruff.lint]
+extend-select = ["FA", "TC"]
 ignore = ["TRY002", "BLE001"]
 
 [tool.ruff.lint.per-file-ignores]