379a60e5d6
.github/workflows/ci.yml runs on push to main + PRs: - python-syntax: compileall over app.py + core/routes/src/services/scripts/tests - node-syntax: node --check on our JS (static/app.js + static/js) - python-tests: pip install + pytest (continue-on-error for now) Hardening: least-privilege `permissions: contents: read`, a `concurrency` group that cancels superseded runs, and actions pinned to commit SHAs (version in a comment) instead of mutable tags.
61 lines
2.0 KiB
YAML
61 lines
2.0 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
# Least privilege: none of the jobs write to the repo.
|
|
permissions:
|
|
contents: read
|
|
|
|
# Cancel superseded runs on the same ref to save Actions minutes.
|
|
concurrency:
|
|
group: ci-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
python-syntax:
|
|
name: Python syntax (compileall)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
|
|
with:
|
|
python-version: "3.11"
|
|
# Byte-compile sources — catches syntax errors without installing deps.
|
|
- run: python -m compileall -q app.py core routes src services scripts tests
|
|
|
|
node-syntax:
|
|
name: JS syntax (node --check)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
|
|
with:
|
|
node-version: "20"
|
|
# Syntax-check our own JS (skip vendored libs in static/lib).
|
|
- name: node --check
|
|
run: |
|
|
shopt -s globstar nullglob
|
|
for f in static/app.js static/js/**/*.js; do
|
|
node --check "$f"
|
|
done
|
|
|
|
python-tests:
|
|
name: Python tests (pytest)
|
|
runs-on: ubuntu-latest
|
|
# Informational for now: the suite has known flaky / environment-dependent
|
|
# failures (test isolation + embedding-model assertions). Tracked under the
|
|
# ROADMAP "fresh install smoke tests" item; make this required once green.
|
|
continue-on-error: true
|
|
steps:
|
|
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
|
|
with:
|
|
python-version: "3.11"
|
|
cache: pip
|
|
- run: pip install -r requirements.txt
|
|
- run: mkdir -p data # sqlite DB lives at ./data/app.db
|
|
- run: python -m pytest -q
|