Merge pull request #6 from stackopshq/docs/adr-server-boot-mode #71
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_call: | |
| jobs: | |
| lint: | |
| name: Lint (ruff) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| cache: pip | |
| - name: Install ruff | |
| run: pip install ruff | |
| - name: Run ruff | |
| run: ruff check . | |
| typecheck: | |
| name: Type check (mypy) | |
| runs-on: ubuntu-latest | |
| needs: lint | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| cache: pip | |
| - name: Install mypy + stubs | |
| run: pip install mypy types-PyYAML | |
| - name: Run mypy | |
| run: mypy | |
| test: | |
| name: Tests (Python ${{ matrix.python-version }}) | |
| runs-on: ubuntu-latest | |
| needs: [lint, typecheck] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| cache: pip | |
| - name: Install poetry | |
| run: pip install poetry | |
| - name: Cache virtualenv | |
| uses: actions/cache@v4 | |
| with: | |
| path: .venv | |
| key: venv-${{ runner.os }}-py${{ matrix.python-version }}-${{ hashFiles('pyproject.toml') }} | |
| - name: Install dependencies | |
| run: | | |
| poetry config virtualenvs.in-project true | |
| poetry install --with dev | |
| - name: Run tests | |
| run: > | |
| poetry run pytest tests/ -v --tb=short | |
| --cov=orca_cli --cov-report=term --cov-fail-under=85 | |
| build: | |
| name: Build distribution | |
| runs-on: ubuntu-latest | |
| needs: test | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| cache: pip | |
| - name: Install poetry | |
| run: pip install poetry | |
| - name: Build sdist + wheel | |
| run: poetry build | |
| - name: Sanity-check artifacts | |
| run: | | |
| ls -la dist/ | |
| python -m zipfile -l dist/*.whl | head -20 | |
| - name: Upload artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: dist | |
| path: dist/ | |
| retention-days: 7 | |
| security: | |
| name: Security scan | |
| runs-on: ubuntu-latest | |
| # Security advisories change daily — don't block lint on them, but do | |
| # fail the job so regressions surface in the PR view. | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install gitleaks | |
| # Direct CLI install — the official gitleaks-action now requires a | |
| # paid GITLEAKS_LICENSE on organization repos. Pinning the upstream | |
| # release SHA is impractical (no GitHub Release signing here); we | |
| # accept the published tarball under pinned version. | |
| env: | |
| GITLEAKS_VERSION: 8.30.1 | |
| run: | | |
| curl -sSfL \ | |
| "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ | |
| | sudo tar -xz -C /usr/local/bin gitleaks | |
| gitleaks version | |
| - name: Scan for leaked secrets | |
| run: gitleaks detect --source=. --redact --exit-code=1 --verbose | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| cache: pip | |
| - name: Install project + pip-audit | |
| run: | | |
| pip install -e . | |
| pip install pip-audit | |
| - name: Audit runtime dependencies | |
| # --skip-editable excludes our own package (installed via -e .) — | |
| # pip-audit would otherwise try to resolve it against PyPI. We drop | |
| # --strict because it would turn that skip into a fatal error; | |
| # pip-audit still exits non-zero on actual CVE findings, which is | |
| # what we want to fail the build on. | |
| run: pip-audit --skip-editable |