Bruno Charest
7b2da1ff6a
CI/CD (.gitea/workflows/ci.yml): - Lint: ruff + mypy on every push/PR - Test: pytest with coverage report (175 tests) - Security: bandit SAST + pip-audit dependency scan - Build: Docker image verification sortedcontainers (backend/search.py): - Replace bisect with SortedList for _sorted_tokens - O(log n) add() / discard() instead of O(n) insort/pop - SortedList.bisect_left() for prefix search - Add sortedcontainers>=2.4.0 to requirements.txt
95 lines
2.7 KiB
YAML
95 lines
2.7 KiB
YAML
# ObsiGate CI/CD Pipeline
|
|
# Runs on every push and pull request to main
|
|
|
|
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
# ── Lint ──────────────────────────────────────────────────────────
|
|
lint:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Setup Python
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.11"
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
pip install ruff mypy
|
|
pip install -r backend/requirements.txt
|
|
|
|
- name: Ruff (linter)
|
|
run: ruff check backend/
|
|
|
|
- name: Mypy (type checker)
|
|
run: mypy backend/ --ignore-missing-imports
|
|
|
|
# ── Tests ─────────────────────────────────────────────────────────
|
|
test:
|
|
needs: lint
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Setup Python
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.11"
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
pip install pytest pytest-cov pytest-asyncio httpx
|
|
pip install -r backend/requirements.txt
|
|
|
|
- name: Run tests
|
|
run: pytest tests/ --cov=backend --cov-report=xml --cov-report=term -q
|
|
|
|
- name: Upload coverage
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: coverage-report
|
|
path: coverage.xml
|
|
|
|
# ── Security scan ─────────────────────────────────────────────────
|
|
security:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Setup Python
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.11"
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
pip install bandit pip-audit
|
|
pip install -r backend/requirements.txt
|
|
|
|
- name: Bandit (SAST)
|
|
run: bandit -r backend/ -c pyproject.toml 2>/dev/null || bandit -r backend/ --skip B101
|
|
|
|
- name: Pip-audit (dependency vulnerabilities)
|
|
run: pip-audit
|
|
|
|
# ── Docker build ──────────────────────────────────────────────────
|
|
build:
|
|
needs: test
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Build Docker image
|
|
run: docker build -t obsigate:ci .
|
|
|
|
- name: Verify image
|
|
run: docker images obsigate:ci
|