overall security gaps hardening #37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| # Also run on version tags so the exact released ref is checked. | |
| tags: | |
| - "v*" | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| quality: | |
| name: Python ${{ matrix.python-version }} quality | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: | |
| - "3.12" | |
| - "3.13" | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| - name: Install uv and Python | |
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | |
| with: | |
| enable-cache: true | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install locked dependencies | |
| run: uv sync --locked --all-extras --dev | |
| - name: Install ripgrep | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y ripgrep | |
| rg --version | |
| - name: Check lock file | |
| run: uv lock --check | |
| - name: Lint | |
| run: uv run ruff check src tests | |
| - name: Type check | |
| run: uv run mypy src/noah_code | |
| - name: Test with coverage (3.12 only) | |
| if: matrix.python-version == '3.12' | |
| run: | | |
| uv run pytest tests --cov=noah_code --cov-report=term-missing \ | |
| --cov-fail-under=70 -W error::pytest.PytestUnraisableExceptionWarning | |
| - name: Test | |
| if: matrix.python-version != '3.12' | |
| run: uv run pytest tests -W error::pytest.PytestUnraisableExceptionWarning | |
| - name: Build distributions | |
| run: uv build --out-dir build-dist | |
| integration: | |
| name: Integration tests (network) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| # Integration-marked tests hit the live network and can flake for reasons | |
| # unrelated to the code; keep the signal visible without blocking PRs. | |
| continue-on-error: true | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| - name: Install uv and Python | |
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | |
| with: | |
| enable-cache: true | |
| python-version: "3.12" | |
| - name: Install locked dependencies | |
| run: uv sync --locked --all-extras --dev | |
| - name: Run integration tests | |
| run: uv run pytest -m integration -q | |
| platform: | |
| name: ${{ matrix.name }} smoke test | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 40 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - name: Linux x86_64 | |
| runner: ubuntu-latest | |
| - name: Linux arm64 | |
| runner: ubuntu-24.04-arm | |
| - name: macOS arm64 | |
| runner: macos-15 | |
| - name: macOS x86_64 | |
| runner: macos-15-intel | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| - name: Install uv and Python | |
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | |
| with: | |
| enable-cache: true | |
| python-version: "3.12" | |
| - name: Install locked dependencies | |
| run: uv sync --locked --all-extras --dev | |
| - name: Install ripgrep | |
| run: | | |
| if [ "${{ runner.os }}" = "Linux" ]; then | |
| sudo apt-get update | |
| sudo apt-get install -y ripgrep | |
| else | |
| HOMEBREW_NO_AUTO_UPDATE=1 brew install ripgrep | |
| fi | |
| rg --version | |
| - name: Run tests | |
| if: runner.os != 'macOS' | |
| run: uv run pytest tests -W error::pytest.PytestUnraisableExceptionWarning | |
| - name: Run tests with coverage (macOS) | |
| if: runner.os == 'macOS' | |
| # Collect coverage on macOS too so mac-only paths are measured, but | |
| # without a fail-under gate: per-platform coverage totals differ, | |
| # and the 70% gate stays on the ubuntu quality job. | |
| run: | | |
| uv run pytest tests --cov=noah_code --cov-report=term \ | |
| -W error::pytest.PytestUnraisableExceptionWarning | |
| - name: Verify command entry point | |
| run: uv run noah --version | |
| - name: Verify binary-only public installation | |
| env: | |
| UV_TOOL_DIR: ${{ runner.temp }}/noah-tools | |
| UV_TOOL_BIN_DIR: ${{ runner.temp }}/noah-bin | |
| run: | | |
| uv build --out-dir smoke-dist | |
| uv tool install --managed-python --python 3.12 --no-build --with 'nooa[mcp,tracing]' smoke-dist/*.whl | |
| "${UV_TOOL_BIN_DIR}/noah" --version |