.github/workflows/ci.yml

@@ -77,4 +77,25 @@ jobs:
         run: pip install -e ".[dev]"
 
       - name: Run mypy
-        run: mypy app
+        run: mypy app
+
+  import-linter:
+    name: Import Boundary
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: backend
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+
+      - name: Run import-linter
+        run: linter

CONTRIBUTING.md

@@ -93,6 +93,7 @@ BanGUI/
 | `tsc --noEmit` | Frontend type checking | `cd frontend && tsc --noEmit` |
 | `eslint` | Frontend linting | `cd frontend && eslint src` |
 | `prettier --check` | Frontend formatting | `cd frontend && prettier --check src` |
+| `import-linter` | Layer boundary enforcement | `cd backend && linter` |
 
 **All checks must pass before committing.** CI runs the same suite.
 

backend/pyproject.toml

@@ -31,6 +31,7 @@ dev = [
     "mypy>=1.13.0",
     "pytest-cov>=6.0.0",
     "pytest-mock>=3.14.0",
+    "import-linter>=2.0.0",
 ]
 
 [tool.hatch.build.targets.wheel]
@@ -64,3 +65,13 @@ pythonpath = [".", "../fail2ban-master"]
 testpaths = ["tests"]
 addopts = "--asyncio-mode=auto --cov=app --cov-report=term-missing"
 filterwarnings = ["ignore::pytest.PytestRemovedIn9Warning"]
+
+[tool.importlinter]
+package_root = "app"
+root_packages = ["app"]
+
+[[tool.importlinter.contracts]]
+name = "forbid_router_db_import"
+type = "forbidden"
+source_modules = ["app.routers"]
+forbidden_modules = ["app.dependencies"]