feat: CI/CD pipeline + sortedcontainers for O(log n) index ops

CI/CD (.gitea/workflows/ci.yml): - Lint: ruff + mypy on every push/PR - Test: pytest with coverage report (175 tests) - Security: bandit SAST + pip-audit dependency scan - Build: Docker image verification sortedcontainers (backend/search.py): - Replace bisect with SortedList for _sorted_tokens - O(log n) add() / discard() instead of O(n) insort/pop - SortedList.bisect_left() for prefix search - Add sortedcontainers>=2.4.0 to requirements.txt
2026-05-27 22:47:28 -04:00
parent 8d1b766947
commit 7b2da1ff6a
3 changed files with 101 additions and 8 deletions
@@ -0,0 +1,94 @@
+# ObsiGate CI/CD Pipeline
+# Runs on every push and pull request to main
+
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  # ── Lint ──────────────────────────────────────────────────────────
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install dependencies
+        run: |
+          pip install ruff mypy
+          pip install -r backend/requirements.txt
+
+      - name: Ruff (linter)
+        run: ruff check backend/
+
+      - name: Mypy (type checker)
+        run: mypy backend/ --ignore-missing-imports
+
+  # ── Tests ─────────────────────────────────────────────────────────
+  test:
+    needs: lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install dependencies
+        run: |
+          pip install pytest pytest-cov pytest-asyncio httpx
+          pip install -r backend/requirements.txt
+
+      - name: Run tests
+        run: pytest tests/ --cov=backend --cov-report=xml --cov-report=term -q
+
+      - name: Upload coverage
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-report
+          path: coverage.xml
+
+  # ── Security scan ─────────────────────────────────────────────────
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install dependencies
+        run: |
+          pip install bandit pip-audit
+          pip install -r backend/requirements.txt
+
+      - name: Bandit (SAST)
+        run: bandit -r backend/ -c pyproject.toml 2>/dev/null || bandit -r backend/ --skip B101
+
+      - name: Pip-audit (dependency vulnerabilities)
+        run: pip-audit
+
+  # ── Docker build ──────────────────────────────────────────────────
+  build:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build Docker image
+        run: docker build -t obsigate:ci .
+
+      - name: Verify image
+        run: docker images obsigate:ci