This repository was archived by the owner on Mar 7, 2026. It is now read-only.
-
-
Notifications
You must be signed in to change notification settings - Fork 6
142 lines (116 loc) · 3.82 KB
/
Copy pathci.yml
File metadata and controls
142 lines (116 loc) · 3.82 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
name: CI
on:
push:
branches: [master, main]
tags:
- 'v*'
pull_request:
branches: [master, main]
jobs:
# ==========================================================================
# Test Suite with Coverage
# ==========================================================================
test:
runs-on: ubuntu-latest
strategy:
matrix:
python-version: ["3.11", "3.12"]
steps:
- uses: actions/checkout@v4
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v5
with:
python-version: ${{ matrix.python-version }}
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -e ".[dev]"
- name: Run tests with coverage
run: |
pytest tests/ -v --cov=src/agentmesh --cov-report=xml --cov-report=term
- name: Upload coverage to Codecov
if: matrix.python-version == '3.11'
uses: codecov/codecov-action@v4
with:
file: ./coverage.xml
fail_ci_if_error: false
# ==========================================================================
# Linting (Ruff + MyPy)
# ==========================================================================
lint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "3.11"
- name: Install linters
run: pip install ruff mypy
- name: Run Ruff linter
run: ruff check . --exit-zero
- name: Run MyPy (type checking)
run: mypy src/agentmesh --ignore-missing-imports || true
# ==========================================================================
# Security Scanning (Bandit + pip-audit)
# ==========================================================================
security:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "3.11"
- name: Install security tools
run: pip install bandit pip-audit
- name: Run Bandit (SAST)
run: bandit -r src/ -ll --exit-zero
- name: Run pip-audit (CVE scan)
run: |
pip install -e ".[dev]"
pip-audit --strict || true
# ==========================================================================
# Build Package
# ==========================================================================
build:
runs-on: ubuntu-latest
needs: [test, lint, security]
steps:
- uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "3.11"
- name: Install build tools
run: pip install build twine
- name: Build package
run: python -m build
- name: Check package
run: twine check dist/*
- name: Upload artifacts
uses: actions/upload-artifact@v4
with:
name: dist
path: dist/
# ==========================================================================
# Publish to PyPI (on tag push)
# ==========================================================================
publish:
runs-on: ubuntu-latest
needs: [build]
if: startsWith(github.ref, 'refs/tags/v')
environment: pypi
permissions:
id-token: write
steps:
- uses: actions/checkout@v4
- name: Download artifacts
uses: actions/download-artifact@v4
with:
name: dist
path: dist/
- name: Publish to PyPI
uses: pypa/gh-action-pypi-publish@release/v1
with:
skip-existing: true