chore(rules): require explicit permission before writing to main #4920
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Python testing with uv, pip/venv caching, PostgreSQL parallel tests | |
| # Optimisations applied: | |
| # - uv for dep install (10-100x faster than pip) | |
| # - uv cache persisted between runs via astral-sh/setup-uv enable-cache | |
| # - venv cached by requirements hash (skips reinstall on cache hit) | |
| # - PostgreSQL service for server-tests → enables --parallel | |
| # - npm cache for dashboard-ci | |
| # - actions/checkout@v4 + shallow submodule fetch | |
| # | |
| # Coverage: | |
| # - SDK tests emit coverage-sdk.xml (parallel coverage, combined after run) | |
| # - Server tests emit coverage-server.xml | |
| # - Both are uploaded to Codacy (https://app.codacy.com/gh/karrioapi/karrio) | |
| # - Requires CODACY_API_TOKEN secret in repo settings (org-level API token) | |
| name: karrio-tests | |
| on: [push] | |
| permissions: | |
| contents: read | |
| jobs: | |
| sdk-tests: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| python-version: ["3.12"] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| submodules: false | |
| - name: Checkout submodules (shallow) | |
| run: git submodule update --init --depth=1 community | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v5 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| enable-cache: false | |
| - name: Cache SDK venv | |
| id: sdk-venv-cache | |
| uses: actions/cache@v4 | |
| with: | |
| path: .venv | |
| key: sdk-venv-${{ runner.os }}-py${{ matrix.python-version }}-${{ hashFiles('requirements.sdk.dev.txt', 'modules/sdk/**/pyproject.toml', 'modules/connectors/**/pyproject.toml') }} | |
| restore-keys: | | |
| sdk-venv-${{ runner.os }}-py${{ matrix.python-version }}- | |
| - name: Setup SDK env | |
| run: ./bin/setup-sdk-env -v | |
| - name: Run SDK typechecks | |
| run: ./bin/run-sdk-typecheck -v | |
| - name: Run SDK tests | |
| run: ./bin/run-sdk-tests -v ${{ github.ref == 'refs/heads/main' && '--coverage' || '' }} | |
| - name: Upload SDK coverage to Codacy | |
| if: ${{ github.ref == 'refs/heads/main' && success() && env.CODACY_API_TOKEN != '' }} | |
| uses: codacy/codacy-coverage-reporter-action@v1.3.0 | |
| with: | |
| api-token: ${{ secrets.CODACY_API_TOKEN }} | |
| organization-provider: gh | |
| username: karrioapi | |
| project-name: karrio | |
| coverage-reports: coverage-sdk.xml | |
| language: Python | |
| partial-coverage: true | |
| env: | |
| CODACY_API_TOKEN: ${{ secrets.CODACY_API_TOKEN }} | |
| server-tests: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| python-version: ["3.12"] | |
| services: | |
| postgres: | |
| image: postgres:16-alpine | |
| env: | |
| POSTGRES_DB: karrio | |
| POSTGRES_USER: postgres | |
| POSTGRES_PASSWORD: postgres | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd pg_isready | |
| --health-interval 5s | |
| --health-timeout 5s | |
| --health-retries 10 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| submodules: false | |
| - name: Checkout submodules (shallow) | |
| run: git submodule update --init --depth=1 community | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v5 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| enable-cache: false | |
| - name: Cache server venv | |
| id: server-venv-cache | |
| uses: actions/cache@v4 | |
| with: | |
| path: .venv | |
| key: server-venv-${{ runner.os }}-py${{ matrix.python-version }}-${{ hashFiles('requirements.server.dev.txt', 'requirements.sdk.dev.txt', 'modules/**/pyproject.toml', 'apps/**/pyproject.toml') }} | |
| restore-keys: | | |
| server-venv-${{ runner.os }}-py${{ matrix.python-version }}- | |
| - name: Setup server env | |
| env: | |
| DATABASE_ENGINE: postgresql | |
| DATABASE_NAME: karrio | |
| DATABASE_HOST: localhost | |
| DATABASE_PORT: "5432" | |
| DATABASE_USERNAME: postgres | |
| DATABASE_PASSWORD: postgres | |
| run: ./bin/setup-server-env -v | |
| - name: Run migrations | |
| env: | |
| DATABASE_ENGINE: postgresql | |
| DATABASE_NAME: karrio | |
| DATABASE_HOST: localhost | |
| DATABASE_PORT: "5432" | |
| DATABASE_USERNAME: postgres | |
| DATABASE_PASSWORD: postgres | |
| ENABLE_ALL_PLUGINS_BY_DEFAULT: "true" | |
| run: ./bin/migrate | |
| - name: Check rolling-deploy schema safety | |
| env: | |
| DATABASE_ENGINE: postgresql | |
| DATABASE_NAME: karrio | |
| DATABASE_HOST: localhost | |
| DATABASE_PORT: "5432" | |
| DATABASE_USERNAME: postgres | |
| DATABASE_PASSWORD: postgres | |
| ENABLE_ALL_PLUGINS_BY_DEFAULT: "true" | |
| run: | | |
| source bin/activate-env | |
| karrio check --tag database --fail-level ERROR | |
| - name: Run server tests | |
| env: | |
| DATABASE_ENGINE: postgresql | |
| DATABASE_NAME: karrio | |
| DATABASE_HOST: localhost | |
| DATABASE_PORT: "5432" | |
| DATABASE_USERNAME: postgres | |
| DATABASE_PASSWORD: postgres | |
| ENABLE_ALL_PLUGINS_BY_DEFAULT: "true" | |
| run: ./bin/run-server-tests -v ${{ github.ref == 'refs/heads/main' && '--coverage' || '' }} | |
| - name: Upload server coverage to Codacy | |
| if: ${{ github.ref == 'refs/heads/main' && success() && env.CODACY_API_TOKEN != '' }} | |
| uses: codacy/codacy-coverage-reporter-action@v1.3.0 | |
| with: | |
| api-token: ${{ secrets.CODACY_API_TOKEN }} | |
| organization-provider: gh | |
| username: karrioapi | |
| project-name: karrio | |
| coverage-reports: coverage-server.xml | |
| language: Python | |
| # Mark as partial so Codacy waits for both SDK + server before | |
| # computing the final combined coverage percentage | |
| partial-coverage: true | |
| env: | |
| CODACY_API_TOKEN: ${{ secrets.CODACY_API_TOKEN }} | |
| dashbaord-ci: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| submodules: false | |
| - name: Checkout submodules (shallow) | |
| run: git submodule update --init --depth=1 community | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22.x | |
| cache: 'npm' | |
| cache-dependency-path: package-lock.json | |
| - name: Install | |
| run: | | |
| npm install -g corepack | |
| mkdir -p ~/.volta/bin | |
| corepack enable --install-directory ~/.volta/bin | |
| - name: Test Build | |
| run: | | |
| npm ci | |
| npm run build -w apps/dashboard | |
| mcp-ci: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| submodules: false | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22.x | |
| cache: 'npm' | |
| cache-dependency-path: package-lock.json | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Typecheck | |
| working-directory: packages/mcp | |
| run: npx tsc --noEmit | |
| - name: Run unit tests | |
| working-directory: packages/mcp | |
| run: npm run test:unit | |
| # Integration tests are skipped in CI — they require a live Karrio API instance. | |
| # Run locally with: npm run test:integration -w packages/mcp | |
| - name: Build | |
| working-directory: packages/mcp | |
| run: npm run build |