Test

ci(docker): block builds on HIGH/CRITICAL CVEs via Trivy #14

	name: Test

	on:
	push:
	branches:
	- main
	paths:
	- "app/**"
	- "tests/**"
	- "cli/**"
	- "pyproject.toml"
	- "requirements*.txt"
	- ".github/workflows/test.yml"
	pull_request:
	paths:
	- "app/**"
	- "tests/**"
	- "cli/**"
	- "pyproject.toml"
	- "requirements*.txt"
	- ".github/workflows/test.yml"
	workflow_dispatch:

	permissions:
	contents: read

	concurrency:
	group: test-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	test:
	name: Lint & test
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6

	- uses: actions/setup-python@v6
	with:
	python-version: "3.14"
	cache: "pip"
	cache-dependency-path: \|
	pyproject.toml
	requirements*.txt

	# ── Install from pyproject.toml (dev extra pulls pytest + ruff) ─────────
	# The CLI is installed as a second editable package so test_cli_crypto
	# can `from cli import …` without a sys.path hack.
	- name: Install dependencies
	run: \|
	python -m pip install --upgrade pip
	pip install -e '.[dev]'
	pip install -e cli/

	# ── Lint ────────────────────────────────────────────────────────────────
	- name: Ruff check
	run: ruff check app/ tests/ cli/

	- name: Ruff format check
	run: ruff format --check app/ tests/ cli/

	# ── Tests ───────────────────────────────────────────────────────────────
	- name: Pytest
	run: pytest tests/ -v

Navigation Menu