feat(workflows): add python-app CI + python-release gold-standard reusables#252
Merged
Conversation
…sables Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the documentation in docs/reusable-workflow-permissions.md to specify permissions for individual Python workflows instead of using a wildcard. A review comment suggests sorting the list of workflows requiring contents: read alphabetically to improve readability and maintainability.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
CybotTM
added a commit
to netresearch/coding_agent_cli_toolset
that referenced
this pull request
Jul 21, 2026
## What Pilot the new `python-app-ci.yml` gold-standard **meta**-reusable from `netresearch/.github` on this repo. One `app-ci` call now composes: - **python-ci** — lint (flake8) + type-check (mypy, non-blocking) + tests (pytest + coverage) - **python-build** — `python -m build` + `twine check` - **python-audit** — pip-audit + bandit + CycloneDX SBOM - **gitleaks** — secret scanning - **dependency-review** — on PRs This replaces the former separate `lint` / `test` / `build` reusable-call jobs in `ci.yml` **and** the `audit` job in `security.yml` (deleted). Bespoke jobs `shell-tests`, `docs`, `integration-e2e` are kept unchanged as siblings. ## Reference pinning The meta is pinned to `netresearch/.github@feat/python-gold-standard` (not yet on `main`). **Flip to `@main` after netresearch/.github#252 merges.** ## Input mapping (repo commands → meta inputs) | Meta input | Value | |---|---| | `package-manager` | `pip` | | `python-versions` | `["3.14"]` | | `os-versions` | ubuntu + macos + windows (preserves the prior cross-OS test matrix) | | `install-cmd` | `pip install -r requirements-dev.txt` | | `lint-cmd` | the repo's existing flake8 command | | `type-check-cmd` | `mypy cli_audit --ignore-missing-imports \|\| true` (kept non-blocking) | | `test-cmd` | the repo's existing unit + integration pytest command | | `enable-build` | true (`python -m build` / `twine check dist/*`) | | `run-bandit` | true (matches prior default) | | `enable-gitleaks` | true (org `GITLEAKS_LICENSE` available) | | `enable-codeql` | **false** — repo uses CodeQL **default setup** (actions + python); enabling the advanced workflow would conflict | ## Pilot findings / notes for reviewers 1. **Coverage upload gate mismatch (meta gap).** The meta does not expose `coverage-os` / `coverage-python-version`; the underlying `python-ci.yml` defaults `coverage-python-version` to `3.13`. This repo is `3.14`-only, so the Codecov upload gate never matches and coverage will **not** upload despite `coverage-upload: true`. Recommend the meta forward those two inputs (or default the coverage cell to the first matrix entry). 2. **Dropped weekly schedule.** The deleted `security.yml` ran the audit on a weekly cron (`0 6 * * 1`) in addition to push/PR. The meta/`ci.yml` runs on push/PR only. If the weekly scheduled audit should be preserved, add a `schedule:` trigger to `ci.yml` or keep a slimmed schedule-only `security.yml`. 3. Combining lint/type/test into one matrixed `ci` job means flake8 + mypy now also run on macOS/windows cells (previously ubuntu-only); tests already ran on all three. ## Do not merge Pilot only. No branch-protection changes (repo has no required status checks configured).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the python-app archetype gold standard:
python-app-ci.yml(meta: python-ci + python-build + python-audit + codeql + gitleaks + dependency-review + zizmor + scorecard, all toggleable) +python-release.yml(tag-triggered: build -> OIDC PyPI publish -> GitHub Release;environment:gate only on publish;publish-pypi:false= GH-Release-only). Prereq: PyPI Trusted Publishing must be configured before python-release can go green. Local linters clean. Piloted against coding_agent_cli_toolset before merge.