CI #258
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: ["*"] | |
| pull_request: | |
| branches: ["main"] | |
| schedule: | |
| # Sunday 12am EST (UTC-5) = 05:00 UTC Sunday. | |
| - cron: "0 5 * * 0" | |
| env: | |
| PYTHONUNBUFFERED: "1" | |
| FORCE_COLOR: "1" | |
| jobs: | |
| test: | |
| name: Test and Lint (Python ${{ matrix.python-version }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| python-version: ["3.10", "3.11", "3.12"] | |
| services: | |
| redis: | |
| image: redis:7.2-alpine | |
| ports: | |
| - 6379:6379 | |
| options: >- | |
| --health-cmd "redis-cli ping" | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| env: | |
| QDRANT_URL: ${{ secrets.QDRANT_URL }} | |
| QDRANT_API_KEY: ${{ secrets.QDRANT_API_KEY }} | |
| # Isolates each matrix job's test collections on the shared Qdrant Cloud | |
| # cluster so concurrent Python-version runs never touch the same data. | |
| QDRANT_TEST_NAMESPACE: ci-${{ github.run_id }}-${{ matrix.python-version }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 | |
| - name: Set up Python | |
| uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Verify Qdrant Cloud connectivity | |
| run: | | |
| if [ -z "$QDRANT_URL" ] || [ -z "$QDRANT_API_KEY" ]; then | |
| echo "::error ::QDRANT_URL or QDRANT_API_KEY secret is not set. Configure both repository secrets before CI can reach Qdrant Cloud." | |
| exit 1 | |
| fi | |
| if ! curl -fsS --max-time 10 \ | |
| -H "api-key: $QDRANT_API_KEY" \ | |
| "$QDRANT_URL/collections" > /dev/null; then | |
| echo "::error ::Could not reach Qdrant Cloud at the configured QDRANT_URL. Check that the cluster is running and QDRANT_API_KEY is valid." | |
| exit 1 | |
| fi | |
| echo "Qdrant Cloud is reachable." | |
| - name: Cache Python dependencies | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 | |
| with: | |
| path: | | |
| ~/.cache/pip | |
| ${{ env.pythonLocation }} | |
| key: ${{ runner.os }}-python-${{ matrix.python-version }}-${{ hashFiles('**/pyproject.toml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-python-${{ matrix.python-version }}- | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e '.[dev,saas]' | |
| - name: Ruff lint | |
| run: pip install ruff && ruff check . --output-format=github | |
| - name: Ruff format (warn only) | |
| run: | | |
| if ! ruff format . --check; then | |
| echo "::warning ::Some files would be reformatted by Ruff" | |
| fi | |
| - name: Bandit Security Scan | |
| run: | | |
| pip install bandit | |
| if ! bandit -r src -lll; then | |
| echo "::warning ::Bandit found potential security issues (review above)" | |
| fi | |
| - name: Run unit tests | |
| run: pytest tests/ -m "not integration" -x --timeout=60 -q | |
| env: | |
| REDIS_URL: redis://localhost:6379 | |
| AUTH_ENABLED: "false" | |
| USER_AUTH_ENABLED: "false" | |
| - name: Clean up Qdrant test collections | |
| if: always() | |
| run: python scripts/cleanup_qdrant_test_collections.py | |
| build: | |
| name: Build Package | |
| runs-on: ubuntu-latest | |
| needs: [test] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 | |
| - name: Set up Python | |
| uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 | |
| with: | |
| python-version: "3.11" | |
| - name: Cache Python dependencies | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 | |
| with: | |
| path: ~/.cache/pip | |
| key: ${{ runner.os }}-pip-build-${{ hashFiles('**/pyproject.toml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-pip-build- | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e '.[dev,api]' | |
| - name: Install build tools | |
| run: pip install build twine | |
| - name: Build package | |
| run: python -m build | |
| - name: Validate build with Twine | |
| run: twine check dist/* |