Make no-panics CI check test-aware (#1160)

* Make no-panics check test-aware

* Handle proc-macro test attrs in no-panics check

* Pin Python for no-panics CI job

.github/workflows/code_style.yml

@@ -86,52 +86,13 @@ jobs:
       uses: actions/checkout@v6
       with:
         fetch-depth: 0
+    - uses: actions/setup-python@v5
+      with:
+        python-version: "3.12"
     - name: Check for .unwrap(), .expect(), assert!() in production code
       run: |
         BASE="${{ github.event.pull_request.base.sha }}"
-        # Get the full diff for .rs files (production only, exclude tests/ directory)
-        DIFF=$(git diff "$BASE"...HEAD -- 'src/**/*.rs' 'crates/**/*.rs' || true)
-
-        if [ -z "$DIFF" ]; then
-          echo "No production Rust changes detected."
-          exit 0
-        fi
-
-        # Extract added lines, skipping those inside test modules.
-        # Track whether we're inside a test module by watching hunk headers
-        # (lines starting with @@) whose context contains "mod tests" or "#[cfg(test)]".
-        ADDED=$(echo "$DIFF" | awk '
-          /^@@/ {
-            # Hunk context (after the second @@) tells us the function/module scope
-            in_test = (tolower($0) ~ /mod tests/ || $0 ~ /#\[cfg\(test\)\]/ || $0 ~ /#\[test\]/)
-          }
-          /^\+[^+]/ && !in_test { print }
-        ' || true)
-
-        if [ -z "$ADDED" ]; then
-          echo "No production Rust changes detected (test-only changes excluded)."
-          exit 0
-        fi
-
-        # Match panic-inducing patterns, excluding safety suppressions
-        VIOLATIONS=$(echo "$ADDED" \
-          | grep -E '\.(unwrap|expect)\(|[^_]assert(_eq|_ne)?!' \
-          | grep -Ev 'debug_assert|// safety:' \
-          || true)
-
-        if [ -n "$VIOLATIONS" ]; then
-          echo "::error::Found .unwrap(), .expect(), or assert!() in production code."
-          echo "Production code must use proper error handling instead of panicking."
-          echo "Suppress false positives with an inline '// safety: <reason>' comment."
-          echo ""
-          echo "$VIOLATIONS" | head -20
-          echo ""
-          COUNT=$(echo "$VIOLATIONS" | wc -l | tr -d ' ')
-          echo "Total: $COUNT violation(s)"
-          exit 1
-        fi
-
-        echo "OK: No panic-inducing calls in changed production code."
+        python3 scripts/check_no_panics.py --base "$BASE" --head HEAD
 
   # Roll-up job for branch protection
   code-style: