fix(sandbox): suppress policy warnings during initial workflow load

[Sakshamm-Goyal]

Summary

• suppress import-notification policy only for the sandbox’s initial workflow-module import
• retain configured warning and raise behavior for that module’s import-time dependencies
• add regressions covering both sides of that split and a high-level changelog entry

Validation

• focused initial-module/dependency plus warning/error sandbox tests (4 passed)
• Ruff check and format check
• Pyright (0 errors)

Fixes #1254.

[VegetarianOrc]

Hey @Sakshamm-Goyal, thanks for taking a look at this!

The fix isn't quite correct as the import time dependencies of the workflow module are intended to trigger the warnings/exceptions. Those dependencies are loaded repeatedly when workflows are executed in the sandbox and the warnings are intended to highlight that those dependencies might be worth explicitly passing through to share them across workflow instances and avoid the processing/memory overhead of reloading them.

Addressing this issue would need to be scoped to suppressing the warnings for the imported workflow module only and allow the import time dependencies of that module to trigger configured the warnings or exceptions.

[Sakshamm-Goyal]

Thanks — narrowed the suppression to the initial workflow module only in commit fb1b110.

Import-time dependencies now continue through the configured notification policy, including both warning and raise modes. Added regression coverage for the workflow-module/dependency split; focused sandbox tests (4) plus Ruff and Pyright pass locally. CI is rerunning on the updated head.

[VegetarianOrc]

The approach looks okay to me, but the new check should be more narrowly applied.

Also please update the PR description to reflect the new behavior and include a changelog entry describing the new behavior.

[Sakshamm-Goyal]

Addressed in 5788b9f. The initial-module condition now applies only inside the warning/raise notification block, so the normal importer flow is unchanged. I also updated the PR description and added the Unreleased changelog entry. Focused sandbox tests (4), Ruff, and Pyright remain green; CI is rerunning.

[Sakshamm-Goyal]

The failed lint matrix was caused by Ruff I001 in the added fixture module, not the sandbox behavior. I reordered that module’s imports only and force-pushed the amended commit (de6e055). Local validation passed: Ruff import/full checks, Ruff format check, Pyright, and the two focused initial-import sandbox tests. Fresh CI is now running.

[Sakshamm-Goyal]

Correction to the CI status: the new fork-PR workflows entered action_required with zero jobs, so they need upstream approval before the matrix can run. CODEOWNERS and CLA are already green. The local validation reported above remains clean; I will monitor the approved rerun rather than attempting to bypass this gate.

[tconley1428]

You should really just use poe lint as validation on all PRs in this repo. You are still not running the full typecheck validation before pushing.

[Sakshamm-Goyal]

The CI failure was a basedpyright-only fixture diagnostic: initial_import_warning_dependency.py deliberately imports lazy_module to exercise the import-warning path, but the fixture only suppressed Ruff F401.

I added the repository-standard type:ignore[reportUnusedImport] annotation and pushed 7671d84. The focused initial-import regression passes (2 passed), and Ruff plus basedpyright on the changed fixture now pass with zero diagnostics. The local environment does not provide the project's poe executable, so the full CI lint matrix will be the authoritative confirmation.

[Sakshamm-Goyal]

I ran the repository gate exactly as requested: uv tool run --from poethepoet poe lint. Ruff import and formatting checks pass. The run stops in Pyright with 9 errors in temporalio/contrib/openai_agents/_openai_runner.py (lines 154–182); that file is outside this PR (the branch diff from merge-base changes only the sandbox fixture).

This local UV 0.8.16 cannot parse the repository's relative exclude-newer = "2 weeks" setting and rewrites the lockfile while running, so I restored that generated lockfile change and will not alter unrelated OpenAI Agents code. The focused fixture test and its direct basedpyright check remain clean; the pinned upstream CI environment is now the authoritative full-gate confirmation once its fork-PR approval requirement is cleared.