chore(deps): bump the python-dependencies group across 1 directory wi… #277
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| pull_request: | |
| jobs: | |
| backend-quality: | |
| name: Backend lint/typecheck | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up Python 3.11 | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.11" | |
| - name: Set up uv | |
| uses: astral-sh/setup-uv@v7 | |
| with: | |
| enable-cache: true | |
| - name: Install dependencies | |
| run: make python-sync | |
| - name: Check Python lockfile | |
| run: make python-lock-check | |
| - name: Check release version consistency | |
| run: make release-check | |
| - name: Run backend lint | |
| run: make lint | |
| - name: Run release hygiene guard | |
| run: make hygiene | |
| - name: Check document authority | |
| run: make doc-check | |
| - name: Run backend typecheck | |
| run: make typecheck | |
| backend-tests: | |
| name: Backend tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up Python 3.11 | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.11" | |
| - name: Set up uv | |
| uses: astral-sh/setup-uv@v7 | |
| with: | |
| enable-cache: true | |
| - name: Install dependencies | |
| run: make python-sync | |
| - name: Bootstrap database schema | |
| run: PYTHONPATH=. .venv/bin/python backend/data/database.py | |
| - name: Run backend tests with coverage | |
| run: make coverage | |
| - name: Publish coverage summary | |
| if: always() | |
| run: | | |
| if [ -f coverage.xml ]; then | |
| pct=$(python3 -c "import xml.etree.ElementTree as ET; print(round(float(ET.parse('coverage.xml').getroot().get('line-rate')) * 100, 1))") | |
| echo "### Backend coverage" >> $GITHUB_STEP_SUMMARY | |
| echo "Line coverage: **${pct}%** (gate: fail_under in pyproject.toml)" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| - name: Upload coverage artifact | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: backend-coverage | |
| path: coverage.xml | |
| python-compat: | |
| name: Python ${{ matrix.python-version }} compatibility | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.12", "3.13"] | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - uses: astral-sh/setup-uv@v7 | |
| with: | |
| enable-cache: true | |
| - name: Install locked test environment | |
| run: uv sync --frozen --extra test --python ${{ matrix.python-version }} | |
| - name: Run compatibility contract suite | |
| run: >- | |
| PYTHONPATH=. .venv/bin/python -m pytest -q | |
| tests/test_schema_authority.py | |
| tests/test_runtime_identity_and_job_ledger.py | |
| tests/test_m61_p3_research.py | |
| docker: | |
| name: Docker build and health smoke | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Build backend and frontend images | |
| run: | | |
| docker build --target backend -t mingcang-backend:ci . | |
| docker build --target frontend -t mingcang-frontend:ci . | |
| - name: Verify backend container health | |
| run: | | |
| set -euo pipefail | |
| docker run --detach --rm --name mingcang-backend-ci -p 18000:8000 mingcang-backend:ci | |
| trap 'docker logs mingcang-backend-ci || true; docker stop mingcang-backend-ci || true' EXIT | |
| for attempt in $(seq 1 30); do | |
| if curl --fail --silent http://127.0.0.1:18000/health | grep -q '"status":"ok"'; then | |
| exit 0 | |
| fi | |
| sleep 2 | |
| done | |
| exit 1 | |
| security: | |
| name: Security and dependency audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up Python 3.11 | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.11" | |
| - name: Set up uv | |
| uses: astral-sh/setup-uv@v7 | |
| with: | |
| enable-cache: true | |
| - name: Install dependencies | |
| run: make python-sync | |
| - name: Run low-noise security snapshot | |
| run: make security | |
| - name: Run dependency audit | |
| run: | | |
| make dependency-audit | |
| echo "### Dependency audit" >> $GITHUB_STEP_SUMMARY | |
| echo "Audit completed at $(date -u '+%Y-%m-%dT%H:%M:%SZ'). No known vulnerabilities found." >> $GITHUB_STEP_SUMMARY | |
| frontend: | |
| name: Frontend test/build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up Node | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: "20" | |
| cache: "npm" | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: Install dependencies | |
| working-directory: frontend | |
| run: npm ci | |
| - name: Install browser runtime | |
| working-directory: frontend | |
| run: npx playwright install --with-deps chromium | |
| - name: Run frontend tests | |
| run: make frontend-test | |
| - name: Run frontend ESLint gate | |
| run: make frontend-lint | |
| - name: Run frontend build | |
| run: make build | |
| - name: Run demo and live-mode browser smoke | |
| run: make frontend-smoke |