chore(ci): pilot python-app-ci gold-standard reusable #398
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main, develop] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| # Gold-standard meta-reusable pilot. python-app-ci composes lint / | |
| # type-check / tests (python-ci), the distribution build (python-build), | |
| # the security audit (python-audit: pip-audit + bandit + SBOM), plus | |
| # gitleaks secret scanning and dependency review — one call site that | |
| # replaces the former lint / test / build jobs here AND the audit job in | |
| # security.yml. CodeQL stays OFF here: the repo uses CodeQL default setup | |
| # (actions + python), and enabling the advanced workflow would conflict. | |
| # | |
| # Pinned to @feat/python-gold-standard until netresearch/.github#252 | |
| # merges; flip to @main afterwards. | |
| app-ci: | |
| name: App CI | |
| uses: netresearch/.github/.github/workflows/python-app-ci.yml@main | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| pull-requests: write | |
| id-token: write | |
| with: | |
| package-manager: pip | |
| python-versions: '["3.14"]' | |
| os-versions: '["ubuntu-latest", "macos-latest", "windows-latest"]' | |
| install-cmd: "python -m pip install --upgrade pip && pip install -r requirements-dev.txt" | |
| run-lint: true | |
| lint-cmd: >- | |
| flake8 cli_audit tests --count --select=E9,F63,F7,F82 --show-source --statistics && | |
| flake8 cli_audit tests --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics | |
| run-type-check: true | |
| # mypy stays non-blocking (was continue-on-error: true). | |
| type-check-cmd: "mypy cli_audit --ignore-missing-imports || true" | |
| run-tests: true | |
| test-cmd: >- | |
| pytest tests/ --ignore=tests/integration -v --cov=cli_audit | |
| --cov-report=xml --cov-report=term && | |
| pytest tests/integration -v --cov=cli_audit --cov-append | |
| --cov-report=xml --cov-report=term | |
| coverage-upload: true | |
| enable-build: true | |
| build-cmd: "python -m build" | |
| check-cmd: "twine check dist/*" | |
| run-bandit: true | |
| enable-gitleaks: true | |
| enable-codeql: false | |
| secrets: | |
| CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} | |
| GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} | |
| shell-tests: | |
| name: Shell Tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Run shell test suites | |
| run: | | |
| bash tests/test_guide_multi_install.sh | |
| bash tests/test_reconcile_dryrun.sh | |
| docs: | |
| name: Documentation Check | |
| uses: netresearch/.github/.github/workflows/python-ci.yml@main | |
| permissions: | |
| contents: read | |
| with: | |
| python-versions: '["3.14"]' | |
| install-cmd: "python -m pip install --upgrade pip markdown pyyaml" | |
| run-lint: false | |
| run-type-check: false | |
| run-tests: true | |
| test-cmd: >- | |
| python -c "import markdown; markdown.markdown(open('README.md').read())" && | |
| { python -c "import yaml; yaml.safe_load(open('.cli-audit.yml').read())" || echo "No config file"; } | |
| integration-e2e: | |
| name: End-to-End Integration | |
| needs: [app-ci] | |
| uses: netresearch/.github/.github/workflows/python-ci.yml@main | |
| permissions: | |
| contents: read | |
| with: | |
| python-versions: '["3.14"]' | |
| install-cmd: "python -m pip install --upgrade pip && pip install -e ." | |
| run-lint: false | |
| run-type-check: false | |
| run-tests: true | |
| test-cmd: >- | |
| python audit.py --help && | |
| CLI_AUDIT_JSON=1 python audit.py --only python-core | jq '.' && | |
| python -c "from cli_audit import Config, Environment, load_config; c = Config(); print('API works')" |