feat: complete 0.5.9 internal challenge pack #180
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| python-version: ["3.12"] | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v8.0.0 | |
| - name: Install dependencies | |
| run: | | |
| uv sync --locked --all-extras | |
| - name: Download spaCy model | |
| run: make ensure-spacy | |
| - name: Verify presidio + spaCy available | |
| run: | | |
| uv run python -c "from presidio_analyzer import AnalyzerEngine; print('presidio OK')" | |
| uv run python -c "import spacy; spacy.load('en_core_web_lg'); print('spacy model OK')" | |
| - name: Run tests with coverage | |
| run: | | |
| uv run pytest -m "not live" --cov=airlock --cov-report=xml --cov-report=term-missing | |
| - name: Upload coverage report | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: coverage-report | |
| path: coverage.xml | |
| lint: | |
| runs-on: ubuntu-latest | |
| needs: [test] | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.12" | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v8.0.0 | |
| - name: Install dependencies and linters | |
| run: | | |
| uv sync --locked --all-extras | |
| # Pin linter versions so CI is reproducible and a new ruff/mypy | |
| # release can't silently turn the build red on an unrelated PR. | |
| . scripts/tool-versions.sh | |
| uv pip install "ruff==$AIRLOCK_RUFF_VERSION" "mypy==$AIRLOCK_MYPY_VERSION" | |
| - name: Ruff check | |
| run: uv run ruff check airlock/ tests/ | |
| - name: Ruff format check | |
| run: uv run ruff format --check airlock/ tests/ | |
| - name: Mypy (fast subsystem) | |
| run: uv run mypy airlock/fast/ --ignore-missing-imports | |
| docker: | |
| runs-on: ubuntu-latest | |
| needs: [test] | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Build Docker image | |
| run: docker build -t airlock:ci . | |
| security: | |
| runs-on: ubuntu-latest | |
| needs: [test] | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.12" | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v8.0.0 | |
| - name: Install and audit | |
| run: | | |
| uv sync --locked --all-extras | |
| . scripts/tool-versions.sh | |
| uv pip install "pip-audit==$AIRLOCK_PIP_AUDIT_VERSION" | |
| uv run pip-audit |