build(deps): bump the backend-minor-patch group across 1 directory with 3 updates #22
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches-ignore: | |
| - main | |
| - master | |
| tags-ignore: | |
| - '*' | |
| workflow_call: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| POETRY_VIRTUALENVS_IN_PROJECT: 'true' | |
| POETRY_NO_INTERACTION: '1' | |
| jobs: | |
| workflows: | |
| name: Workflow contracts | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| - name: Validate GitHub Actions workflows | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| archive="$RUNNER_TEMP/actionlint.tar.gz" | |
| curl -fL --retry 3 \ | |
| -o "$archive" \ | |
| https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz | |
| echo "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8 $archive" \ | |
| | sha256sum -c - | |
| tar -xzf "$archive" -C "$RUNNER_TEMP" actionlint | |
| "$RUNNER_TEMP/actionlint" -color | |
| frontend: | |
| name: Frontend tests and static analysis | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 | |
| with: | |
| node-version: 24.18.0 | |
| cache: npm | |
| - name: Install locked dependencies | |
| run: npm ci --legacy-peer-deps | |
| - name: Test with coverage | |
| run: npm run test:coverage | |
| - name: Lint and typecheck | |
| run: | | |
| npm run lint | |
| npm run typecheck | |
| - name: Audit npm dependencies | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| npm audit --json > "$RUNNER_TEMP/npm-audit.json" || true | |
| python scripts/check_npm_audit.py "$RUNNER_TEMP/npm-audit.json" | |
| - name: Upload frontend coverage | |
| if: always() | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: frontend-coverage | |
| path: coverage | |
| if-no-files-found: error | |
| retention-days: 14 | |
| backend: | |
| name: Backend tests and static analysis | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 25 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| - name: Set up Python | |
| uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: '3.11' | |
| cache: pip | |
| - name: Install Poetry bootstrap | |
| run: python -m pip install poetry==2.4.1 | |
| - name: Install locked Python test environment | |
| working-directory: api | |
| run: | | |
| poetry check --lock | |
| poetry sync --with dev --without build | |
| - name: Test backend with branch coverage | |
| run: api/.venv/bin/python -m pytest -q --cov-fail-under=26 | |
| - name: Ruff and focused type analysis | |
| run: | | |
| api/.venv/bin/ruff check --config api/pyproject.toml \ | |
| api/security.py api/settings.py api/app_factory.py \ | |
| api/build_info.py api/component_manifest.py api/data_root.py \ | |
| api/domain api/jobs api/memory api/providers api/routers api/services \ | |
| api/lifespan.py api/network_policy.py api/observability.py \ | |
| api/storage/__init__.py api/storage/secret_rotation.py \ | |
| scripts/check_build_space.py scripts/check_npm_audit.py \ | |
| scripts/check_pip_audit.py scripts/clean_build.py \ | |
| scripts/generate_env_example.py \ | |
| scripts/generate_sbom.py scripts/manage_data.py \ | |
| tests/unit/test_network_timeouts.py \ | |
| tests/unit/test_security_boundary.py \ | |
| tests/unit/test_storage_migrations.py | |
| api/.venv/bin/python -m mypy --follow-imports=skip \ | |
| api/security.py api/settings.py api/storage/__init__.py \ | |
| api/code_agent/port.py api/code_agent/service.py \ | |
| api/memory/engraphis_adapter.py api/memory/port.py \ | |
| api/memory/service.py api/memory/workspaces.py \ | |
| api/providers/port.py api/providers/registry.py | |
| - name: Compile and validate environment | |
| run: | | |
| api/.venv/bin/python scripts/generate_env_example.py --check | |
| PYTHONPYCACHEPREFIX="$RUNNER_TEMP/hackdeepwiki-pycache" \ | |
| api/.venv/bin/python -m compileall -q -x '/\.venv/' api scripts tests | |
| api/.venv/bin/python -m pip check | |
| if rg "google\\.generativeai" api scripts tests hackdeepwiki.spec; then | |
| echo "Deprecated google.generativeai import found" | |
| exit 1 | |
| fi | |
| - name: Audit Python dependencies | |
| shell: bash | |
| run: | | |
| set -uo pipefail | |
| api/.venv/bin/python -m pip_audit --local --format json \ | |
| --output "$RUNNER_TEMP/pip-audit.json" || true | |
| api/.venv/bin/python scripts/check_pip_audit.py \ | |
| "$RUNNER_TEMP/pip-audit.json" | |
| - name: Upload backend coverage | |
| if: always() | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: backend-coverage | |
| path: coverage.xml | |
| if-no-files-found: error | |
| retention-days: 14 |