Merge pull request #45 from maemayv/fix/cache-control-non-anthropic #118
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Sync | |
| run: uv sync --all-extras --no-extra sandbox | |
| - name: Ruff lint | |
| run: uv run ruff check . | |
| - name: Ruff format check | |
| run: uv run ruff format --check . | |
| - name: SPDX license headers | |
| run: uv run python scripts/check_license_headers.py | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Sync | |
| run: uv sync --all-extras --no-extra sandbox | |
| - name: Unit tests (no live API calls) | |
| run: uv run pytest -q -m "not integration and not stress" | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # tags needed for uv-dynamic-versioning | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Build all packages | |
| run: | | |
| rm -rf dist | |
| for pkg in nooa nooa-cli nooa-memory nooa-bench; do | |
| uv build --package "$pkg" --out-dir dist | |
| done | |
| - name: Upload wheels | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: dist | |
| path: dist/ | |
| retention-days: 7 | |
| frontend-build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: "20" | |
| - name: Build the trace viewer | |
| working-directory: src/nooa/viewer/frontend-react | |
| run: | | |
| npm ci --ignore-scripts | |
| npm run build | |
| - name: Fail if dist/ is stale | |
| run: | | |
| if ! git diff --quiet src/nooa/viewer/frontend-react/dist/; then | |
| echo "ERROR: frontend-react/dist/ is stale. Run 'npm run build' and commit dist/." | |
| git diff --stat src/nooa/viewer/frontend-react/dist/ | |
| exit 1 | |
| fi | |
| secret-scan: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # full history so the scan covers all commits | |
| # Invokes the gitleaks binary directly rather than gitleaks/gitleaks-action. | |
| # That action is not on this org's GitHub Actions allowlist, and a | |
| # disallowed action fails the *entire workflow* at startup — which is why | |
| # every CI run since 2026-07-21 was a 0-second `startup_failure` and no | |
| # lint, test, or build job ran at all. | |
| # | |
| # Pinned to an exact version and checksum-verified: the binary is fetched | |
| # at runtime, so an unpinned tag would be an unreviewed remote dependency. | |
| - name: Gitleaks | |
| env: | |
| GITLEAKS_VERSION: 8.30.1 | |
| GITLEAKS_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb | |
| run: | | |
| set -euo pipefail | |
| curl -sSLo gitleaks.tar.gz \ | |
| "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | |
| echo "${GITLEAKS_SHA256} gitleaks.tar.gz" | sha256sum -c - | |
| tar xzf gitleaks.tar.gz gitleaks | |
| # `gitleaks git` exits 0 with "no leaks found" when it has no history | |
| # to read — a shallow clone scans 1 commit and passes vacuously, and a | |
| # non-repo scans 0. Fail loudly instead of reporting a clean scan. | |
| test "$(git rev-parse --is-inside-work-tree 2>/dev/null)" = "true" \ | |
| || { echo "::error::not a git checkout — gitleaks would pass vacuously"; exit 1; } | |
| test "$(git rev-parse --is-shallow-repository)" = "false" \ | |
| || { echo "::error::shallow clone — gitleaks would miss history (need fetch-depth: 0)"; exit 1; } | |
| ./gitleaks git --config .gitleaks.toml --redact --no-banner . |