Skip to content
CI

feat: close OSC gaps on stack, zone, image metadef #90

Sign in to view logs

feat: close OSC gaps on stack, zone, image metadef

feat: close OSC gaps on stack, zone, image metadef #90

Workflow file for this run

.github/workflows/ci.yml at 7e73664
name: CI
on:
push:
branches: [main]
pull_request:
branches: [main]
workflow_call:
jobs:
lint:
name: Lint (ruff)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
with:
python-version: "3.11"
cache: pip
- name: Install ruff
run: pip install ruff
- name: Run ruff
run: ruff check .
typecheck:
name: Type check (mypy)
runs-on: ubuntu-latest
needs: lint
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
with:
python-version: "3.11"
cache: pip
- name: Install mypy + stubs
run: pip install mypy types-PyYAML
- name: Run mypy
run: mypy
test:
name: Tests (Python ${{ matrix.python-version }})
runs-on: ubuntu-latest
needs: [lint, typecheck]
strategy:
fail-fast: false
matrix:
python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
with:
python-version: ${{ matrix.python-version }}
cache: pip
- name: Install poetry
run: pip install poetry
- name: Cache virtualenv
uses: actions/cache@v4
with:
path: .venv
key: venv-${{ runner.os }}-py${{ matrix.python-version }}-${{ hashFiles('pyproject.toml') }}
- name: Install dependencies
run: |
poetry config virtualenvs.in-project true
poetry install --with dev
- name: Run tests
run: >
poetry run pytest tests/ -v --tb=short
--cov=orca_cli --cov-report=term --cov-fail-under=85
build:
name: Build distribution
runs-on: ubuntu-latest
needs: test
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
with:
python-version: "3.11"
cache: pip
- name: Install poetry
run: pip install poetry
- name: Build sdist + wheel
run: poetry build
- name: Sanity-check artifacts
run: |
ls -la dist/
python -m zipfile -l dist/*.whl | head -20
- name: Upload artifacts
uses: actions/upload-artifact@v4
with:
name: dist
path: dist/
retention-days: 7
security:
name: Security scan
runs-on: ubuntu-latest
# Security advisories change daily — don't block lint on them, but do
# fail the job so regressions surface in the PR view.
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Install gitleaks
# Direct CLI install — the official gitleaks-action now requires a
# paid GITLEAKS_LICENSE on organization repos. Pinning the upstream
# release SHA is impractical (no GitHub Release signing here); we
# accept the published tarball under pinned version.
env:
GITLEAKS_VERSION: 8.30.1
run: |
curl -sSfL \
"https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
| sudo tar -xz -C /usr/local/bin gitleaks
gitleaks version
- name: Scan for leaked secrets
run: gitleaks detect --source=. --redact --exit-code=1 --verbose
- uses: actions/setup-python@v5
with:
python-version: "3.11"
cache: pip
- name: Install poetry + pip-audit
# poetry-plugin-export is bundled in poetry < 2.0 but split out in
# poetry 2.x; pin it explicitly so this works on either side of
# that boundary.
run: pip install poetry "poetry-plugin-export>=1.7" pip-audit
- name: Export runtime requirements
# Audit only what we actually ship — orca's declared runtime deps —
# rather than the runner's whole environment. The previous
# ``pip-audit --skip-editable`` invocation walked every package
# installed in the job's Python (pip, setuptools, wheel, …) and
# failed the build on advisories in the tooling itself, e.g.
# CVE-2026-3219 in pip 26.0.1. Those have nothing to do with
# orca's supply chain.
run: poetry export --format requirements.txt --without-hashes --only main --output /tmp/runtime-requirements.txt
- name: Audit runtime dependencies
run: pip-audit --requirement /tmp/runtime-requirements.txt