airlock/.github/workflows/ci.yml at 5473e08587fd7cbb9102a1faf4a40a7084c5f484 · coreyt/airlock · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  docs:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install uv
        uses: astral-sh/setup-uv@v8.0.0

      - name: Build strict documentation site and check documentation contracts
        run: |
          uv sync --locked --extra docs --extra test
          uv run mkdocs build --strict --site-dir /tmp/airlock-docs
          uv run pytest tests/test_documentation_contract.py -q

  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.12"]

    steps:
      - uses: actions/checkout@v6

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install uv
        uses: astral-sh/setup-uv@v8.0.0

      - name: Install dependencies
        run: |
          uv sync --locked --all-extras

      - name: Download spaCy model
        run: make ensure-spacy

      - name: Verify presidio + spaCy available
        run: |
          uv run python -c "from presidio_analyzer import AnalyzerEngine; print('presidio OK')"
          uv run python -c "import spacy; spacy.load('en_core_web_lg'); print('spacy model OK')"

      - name: Run tests with coverage
        run: |
          uv run pytest -m "not live" --cov=airlock --cov-report=xml --cov-report=term-missing

      - name: Upload coverage report
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: coverage-report
          path: coverage.xml

  lint:
    runs-on: ubuntu-latest
    needs: [test]
    steps:
      - uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install uv
        uses: astral-sh/setup-uv@v8.0.0

      - name: Install dependencies and linters
        run: |
          uv sync --locked --all-extras
          # Pin linter versions so CI is reproducible and a new ruff/mypy
          # release can't silently turn the build red on an unrelated PR.
          . scripts/tool-versions.sh
          uv pip install "ruff==$AIRLOCK_RUFF_VERSION" "mypy==$AIRLOCK_MYPY_VERSION"

      - name: Ruff check
        run: uv run ruff check airlock/ tests/

      - name: Ruff format check
        run: uv run ruff format --check airlock/ tests/

      - name: Mypy (fast subsystem)
        run: uv run mypy airlock/fast/ --ignore-missing-imports

  docker:
    runs-on: ubuntu-latest
    needs: [test]
    steps:
      - uses: actions/checkout@v6

      - name: Build Docker image
        run: docker build -t airlock:ci .

  security:
    runs-on: ubuntu-latest
    needs: [test]
    steps:
      - uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install uv
        uses: astral-sh/setup-uv@v8.0.0

      - name: Install and audit
        # Suppressions are documented, scoped, and reviewable in
        # dev/notes/security-pip-audit-exceptions.md. Each records why it cannot
        # be fixed, why it is unreachable in Airlock's usage, and the condition
        # for removal. Do not add one without that assessment.
        #
        # cryptography 48.0.1: litellm[proxy] and presidio-anonymizer both pin
        # <49, blocking the 49/50 fixes. All three findings need PKCS#7
        # decryption or X.509 path validation; Airlock does neither and imports
        # cryptography nowhere directly.
        run: |
          uv sync --locked --all-extras
          . scripts/tool-versions.sh
          uv pip install "pip-audit==$AIRLOCK_PIP_AUDIT_VERSION"
          uv run pip-audit \
            --ignore-vuln PYSEC-2026-3552 \
            --ignore-vuln PYSEC-2026-3553 \
            --ignore-vuln PYSEC-2026-3554