Refactor imports and update type hints for Python 3.10+ #10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main, 'claude/**'] | |
| pull_request: | |
| branches: [main] | |
| env: | |
| PYTHON_VERSION: '3.11' | |
| jobs: | |
| lint_and_type_check: | |
| name: Lint & Type Check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| cache: 'pip' | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -r requirements.txt -r requirements-dev.txt | |
| - name: Lint with ruff | |
| run: ruff check src/ --output-format=github | |
| - name: Check formatting with black | |
| run: black --check src/ | |
| - name: Type check with mypy | |
| run: mypy src/ --install-types --non-interactive || true | |
| test: | |
| name: Test & Coverage | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| cache: 'pip' | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -r requirements.txt -r requirements-dev.txt | |
| - name: Run tests with coverage | |
| run: | | |
| pytest --cov=src --cov-report=xml --cov-report=term --cov-fail-under=85 || echo "Coverage threshold not met (expected ≥85%)" | |
| - name: Upload coverage to artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: coverage-report | |
| path: | | |
| coverage.xml | |
| htmlcov/ | |
| security: | |
| name: Security Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| cache: 'pip' | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -r requirements.txt -r requirements-dev.txt | |
| - name: Run pip-audit for dependency vulnerabilities | |
| run: pip-audit --require-hashes --disable-pip || echo "Dependency vulnerabilities found" | |
| build_and_scan: | |
| name: Build & Scan Docker Image | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Build Docker image | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: . | |
| file: ./Dockerfile | |
| push: false | |
| tags: cloud-dashboard:ci | |
| load: true | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@0.28.0 | |
| with: | |
| image-ref: 'cloud-dashboard:ci' | |
| format: 'table' | |
| exit-code: '0' | |
| severity: 'CRITICAL,HIGH' | |
| ignore-unfixed: true | |
| - name: Run Trivy SBOM generation | |
| uses: aquasecurity/trivy-action@0.28.0 | |
| with: | |
| image-ref: 'cloud-dashboard:ci' | |
| format: 'cyclonedx' | |
| output: 'sbom.json' | |
| - name: Upload SBOM | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: sbom | |
| path: sbom.json | |
| summary: | |
| name: CI Summary | |
| runs-on: ubuntu-latest | |
| needs: [lint_and_type_check, test, security, build_and_scan] | |
| if: always() | |
| steps: | |
| - name: Check job results | |
| run: | | |
| echo "Lint & Type Check: ${{ needs.lint_and_type_check.result }}" | |
| echo "Test & Coverage: ${{ needs.test.result }}" | |
| echo "Security Scan: ${{ needs.security.result }}" | |
| echo "Build & Scan: ${{ needs.build_and_scan.result }}" | |
| if [ "${{ needs.lint_and_type_check.result }}" != "success" ] || \ | |
| [ "${{ needs.test.result }}" != "success" ] || \ | |
| [ "${{ needs.security.result }}" != "success" ] || \ | |
| [ "${{ needs.build_and_scan.result }}" != "success" ]; then | |
| echo "❌ CI pipeline has failures" | |
| exit 1 | |
| fi | |
| echo "✅ All CI checks passed" |