chore(deps): bump github/codeql-action/init from 4.36.2 to 4.36.3 #1901
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| paths-ignore: | |
| - "**/*.md" | |
| - "docs/**" | |
| - "inbox/**" | |
| - "memory/**" | |
| - "ops/**" | |
| - "proof/**" | |
| pull_request: | |
| branches: [main] | |
| paths-ignore: | |
| - "**/*.md" | |
| - "docs/**" | |
| - "inbox/**" | |
| - "memory/**" | |
| - "ops/**" | |
| - "proof/**" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| env: | |
| PYTHONPATH: sdk | |
| strategy: | |
| matrix: | |
| python-version: ${{ github.event_name == 'pull_request' && fromJSON('["3.9","3.12"]') || fromJSON('["3.9","3.10","3.11","3.12"]') }} | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| cache: 'pip' | |
| - name: Install | |
| run: python -m pip install --require-hashes -r .github/requirements/ci-tools.txt | |
| - name: Tests with coverage | |
| run: | | |
| python -m pytest sdk/tests/ -v \ | |
| --cov=agentguard \ | |
| --cov-report=term-missing \ | |
| --cov-report=xml:coverage.xml \ | |
| --cov-fail-under=80 | |
| - name: Upload coverage artifact | |
| if: matrix.python-version == '3.12' | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: coverage-report | |
| path: coverage.xml | |
| retention-days: 7 | |
| lint: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| env: | |
| PYTHONPATH: sdk | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 | |
| with: | |
| python-version: "3.12" | |
| cache: 'pip' | |
| - name: Install tools | |
| run: python -m pip install --require-hashes -r .github/requirements/ci-tools.txt | |
| - name: Check CI tool pins support the SDK Python floor | |
| run: python scripts/ci_tools_requirements_guard.py | |
| - name: Check PyPI README sync | |
| run: python scripts/generate_pypi_readme.py --check | |
| - name: Check release metadata sync | |
| run: python scripts/sdk_release_guard.py | |
| - name: Lint (ruff) | |
| run: ruff check sdk/agentguard/ scripts/generate_pypi_readme.py scripts/sdk_preflight.py scripts/sdk_release_guard.py scripts/ci_tools_requirements_guard.py | |
| - name: Security lint (bandit) | |
| run: bandit -r sdk/agentguard/ -s B101,B110,B112,B311 -q | |
| mcp: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: "20" | |
| cache: "npm" | |
| cache-dependency-path: mcp-server/package-lock.json | |
| - name: Install MCP server deps | |
| run: npm --prefix mcp-server ci | |
| - name: MCP build and tests | |
| run: npm --prefix mcp-server test | |
| mcp-budget: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 | |
| with: | |
| python-version: "3.12" | |
| cache: 'pip' | |
| - name: Install tools | |
| run: python -m pip install --require-hashes -r .github/requirements/ci-tools.txt | |
| - name: Install local budget MCP | |
| run: python -m pip install -e ./agentguard-mcp | |
| - name: Local budget MCP lint and tests | |
| run: | | |
| cd agentguard-mcp | |
| ruff check agentguard_mcp tests | |
| python -m pytest |