chore(format): align governed task package CI #3420
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| paths-ignore: | |
| - 'CHANGELOG.md' | |
| - 'docs/**' | |
| - '*.md' | |
| - '.github/workflows/**' | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| name: Test (Node 20) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Setup Node.js 20 | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: '20' | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Run type check | |
| run: npm run typecheck | |
| - name: Build project | |
| run: npm run build | |
| - name: Run tests | |
| run: npm test | |
| - name: Upload build artifacts | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: dist-node20 | |
| path: dist/ | |
| retention-days: 7 | |
| python-test: | |
| name: Test Python Components | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| env: | |
| # PR CI exercises the deterministic fallback/PQC governance path. Native | |
| # liboqs builds are handled by the dedicated "PQC Native liboqs" workflow, | |
| # which must pass for release/security validation. | |
| SCBE_FORCE_SKIP_LIBOQS: '1' | |
| CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Setup Python 3.11 | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: '3.11' | |
| cache: 'pip' | |
| - name: Install Python dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -r requirements.txt | |
| pip install pytest pytest-cov pytest-asyncio hypothesis | |
| - name: Run Python tests | |
| run: | | |
| python scripts/system/run_core_python_checks.py -- --cov=src --cov-report=xml | |
| - name: Check coverage report | |
| id: coverage-report | |
| run: | | |
| if [ -s coverage.xml ]; then | |
| echo "exists=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "exists=false" >> "$GITHUB_OUTPUT" | |
| echo "coverage.xml was not generated; skipping Codecov upload." | |
| fi | |
| - name: Upload coverage | |
| if: ${{ env.CODECOV_TOKEN != '' && steps.coverage-report.outputs.exists == 'true' }} | |
| uses: codecov/codecov-action@v6 | |
| # audit: advisory - non-blocking telemetry/reporting path; downstream summary or gate handles outcome | |
| continue-on-error: true | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| file: ./coverage.xml | |
| flags: python | |
| name: python-3.11 | |
| product-delivery: | |
| name: Product Delivery Smoke | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Setup Python 3.11 | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: '3.11' | |
| cache: 'pip' | |
| - name: Install Python dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -r requirements.txt | |
| pip install pytest | |
| - name: Verify checkout, delivery bridge, and buyer packages | |
| run: | | |
| python -m pytest \ | |
| tests/test_vercel_launch_bridge.py \ | |
| tests/smoke/test_app_deploy_config.py \ | |
| tests/api/test_stripe_billing_hardening.py \ | |
| tests/test_package_products.py \ | |
| -q | |
| - name: Build buyer ZIPs without publishing artifacts | |
| run: python scripts/package_products.py --product all --output-dir artifacts/product-delivery-smoke | |
| lint: | |
| name: Lint and Format Check | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: '20' | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Check TypeScript formatting | |
| run: npm run lint | |
| - name: Setup Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: '3.11' | |
| - name: Install Python linters | |
| run: | | |
| pip install black ruff flake8 | |
| - name: Check Python formatting | |
| run: black --check --target-version py311 --line-length 120 src/ tests/ scripts/ agents/ | |
| - name: Run ruff (fast lint) | |
| run: ruff check --config ruff.toml | |
| - name: Run flake8 (style + pyflakes) | |
| run: flake8 --max-line-length 120 src/ tests/ hydra/ scripts/ agents/ |