fix(audit): merge --update-baseline results into the existing baselin… #414
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main, develop] | |
| workflow_dispatch: | |
| permissions: {} | |
| jobs: | |
| # Gold-standard meta-reusable pilot. python-app-ci composes lint / | |
| # type-check / tests (python-ci), the distribution build (python-build), | |
| # the security audit (python-audit: pip-audit + bandit + SBOM), plus | |
| # gitleaks secret scanning and dependency review — one call site that | |
| # replaces the former lint / test / build jobs here AND the audit job in | |
| # security.yml. CodeQL stays OFF here: the repo uses CodeQL default setup | |
| # (actions + python), and enabling the advanced workflow would conflict. | |
| # | |
| # Pinned to @feat/python-gold-standard until netresearch/.github#252 | |
| # merges; flip to @main afterwards. | |
| app-ci: | |
| name: App CI | |
| uses: netresearch/.github/.github/workflows/python-app-ci.yml@main | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| pull-requests: write | |
| id-token: write | |
| with: | |
| package-manager: pip | |
| python-versions: '["3.14"]' | |
| os-versions: '["ubuntu-latest", "macos-latest", "windows-latest"]' | |
| install-cmd: "python -m pip install --upgrade pip && pip install -r requirements-dev.txt" | |
| run-lint: true | |
| lint-cmd: >- | |
| flake8 cli_audit tests --count --select=E9,F63,F7,F82 --show-source --statistics && | |
| flake8 cli_audit tests --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics | |
| run-type-check: true | |
| # mypy stays non-blocking (was continue-on-error: true). | |
| type-check-cmd: "mypy cli_audit --ignore-missing-imports || true" | |
| run-tests: true | |
| test-cmd: >- | |
| pytest tests/ --ignore=tests/integration -v --cov=cli_audit | |
| --cov-report=xml --cov-report=term && | |
| pytest tests/integration -v --cov=cli_audit --cov-append | |
| --cov-report=xml --cov-report=term | |
| coverage-upload: true | |
| enable-build: true | |
| build-cmd: "python -m build" | |
| check-cmd: "twine check dist/*" | |
| run-bandit: true | |
| enable-gitleaks: true | |
| enable-codeql: false | |
| secrets: | |
| CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} | |
| GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} | |
| # The bash suites are driven through python-ci's test step (it runs the | |
| # command with `bash -c` from the repo root), so no step-level action is | |
| # needed here. test_reconcile_dryrun.sh invokes `python3 audit.py`, which | |
| # needs the runtime deps declared in pyproject (packaging, PyYAML) — hence | |
| # the editable install and Python 3.14 (pyproject requires-python >=3.14). | |
| shell-tests: | |
| name: Shell Tests | |
| uses: netresearch/.github/.github/workflows/python-ci.yml@main | |
| permissions: | |
| contents: read | |
| with: | |
| python-versions: '["3.14"]' | |
| install-cmd: "python -m pip install --upgrade pip && pip install -e ." | |
| run-lint: false | |
| run-type-check: false | |
| run-tests: true | |
| test-cmd: >- | |
| bash tests/test_guide_multi_install.sh && | |
| bash tests/test_reconcile_dryrun.sh | |
| docs: | |
| name: Documentation Check | |
| uses: netresearch/.github/.github/workflows/python-ci.yml@main | |
| permissions: | |
| contents: read | |
| with: | |
| python-versions: '["3.14"]' | |
| install-cmd: "python -m pip install --upgrade pip markdown pyyaml" | |
| run-lint: false | |
| run-type-check: false | |
| run-tests: true | |
| test-cmd: >- | |
| python -c "import markdown; markdown.markdown(open('README.md').read())" && | |
| { python -c "import yaml; yaml.safe_load(open('.cli-audit.yml').read())" || echo "No config file"; } | |
| integration-e2e: | |
| name: End-to-End Integration | |
| needs: [app-ci] | |
| uses: netresearch/.github/.github/workflows/python-ci.yml@main | |
| permissions: | |
| contents: read | |
| with: | |
| python-versions: '["3.14"]' | |
| install-cmd: "python -m pip install --upgrade pip && pip install -e ." | |
| run-lint: false | |
| run-type-check: false | |
| run-tests: true | |
| test-cmd: >- | |
| python audit.py --help && | |
| CLI_AUDIT_JSON=1 python audit.py --only python-core | jq '.' && | |
| python -c "from cli_audit import Config, Environment, load_config; c = Config(); print('API works')" |