fix: use Pi SDK native 'nvidia' provider with NVIDIA_API_KEY env var #542
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main, unstable] | |
| pull_request: | |
| branches: [main, unstable] | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # ── Lint (ruff + mypy + eslint) ────────────────────────────────────────── | |
| lint: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Set up Python 3.11 | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| cache: pip | |
| - name: Install ruff and mypy | |
| run: pip install --quiet ruff mypy | |
| - name: Run ruff check | |
| run: ruff check backend/ | |
| - name: Run ruff format check | |
| run: ruff format --check backend/ | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: "22" | |
| cache: npm | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: Install frontend deps | |
| working-directory: frontend | |
| run: npm ci --no-audit --no-fund | |
| - name: Run eslint | |
| working-directory: frontend | |
| run: npx eslint src | |
| # ── Backend tests ───────────────────────────────────────────────────────── | |
| backend: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| needs: [lint] | |
| services: | |
| postgres: | |
| image: postgres:16 | |
| env: | |
| POSTGRES_USER: hermeshq | |
| POSTGRES_PASSWORD: hermeshq | |
| POSTGRES_DB: hermeshq | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd "pg_isready -U hermeshq" | |
| --health-interval 5s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| env: | |
| DATABASE_URL: postgresql+asyncpg://hermeshq:hermeshq@localhost:5432/hermeshq | |
| JWT_SECRET: ci-test-secret-${{ github.run_id }} | |
| AUTH_MODE: local | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Set up Python 3.11 | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| cache: pip | |
| - name: Install Python dependencies | |
| run: | | |
| pip install --quiet -r backend/requirements.txt | |
| pip install --quiet pytest pytest-asyncio pytest-cov | |
| - name: Run backend tests | |
| working-directory: backend | |
| run: python -m pytest tests/ -v --tb=short --cov=hermeshq --cov-report=xml --cov-fail-under=27 | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@v5 | |
| with: | |
| files: backend/coverage.xml | |
| fail_ci_if_error: false | |
| continue-on-error: true | |
| # ── Frontend tests + build ──────────────────────────────────────────────── | |
| frontend: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| needs: [lint] | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: "22" | |
| cache: npm | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: Install dependencies | |
| working-directory: frontend | |
| run: npm ci --no-audit --no-fund | |
| - name: TypeScript check | |
| working-directory: frontend | |
| run: npx tsc --noEmit | |
| - name: Run frontend tests | |
| working-directory: frontend | |
| run: npm test | |
| - name: Build frontend | |
| working-directory: frontend | |
| run: npm run build | |
| # ── Docker build (also on PRs so Dependabot can't merge broken images) ──── | |
| docker: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| needs: [backend, frontend] | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Build backend image | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: backend/Dockerfile | |
| push: false | |
| tags: hermeshq-backend:ci | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| outputs: type=docker,dest=/tmp/hermeshq-backend.tar | |
| - name: Build frontend image | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: frontend/Dockerfile | |
| push: false | |
| tags: hermeshq-frontend:ci | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| outputs: type=docker,dest=/tmp/hermeshq-frontend.tar | |
| - name: Scan backend image with Trivy | |
| uses: aquasecurity/trivy-action@0.28.0 | |
| with: | |
| input: /tmp/hermeshq-backend.tar | |
| severity: CRITICAL,HIGH | |
| ignore-unfixed: true | |
| exit-code: "0" | |
| - name: Scan frontend image with Trivy | |
| uses: aquasecurity/trivy-action@0.28.0 | |
| with: | |
| input: /tmp/hermeshq-frontend.tar | |
| severity: CRITICAL,HIGH | |
| ignore-unfixed: true | |
| exit-code: "0" | |
| # ── Dependency security audit ───────────────────────────────────────────── | |
| security: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Set up Python 3.11 | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| - name: Run pip-audit on backend requirements | |
| run: | | |
| pip install --quiet pip-audit | |
| pip-audit -r backend/requirements.txt --progress-spinner=off || true | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: "22" | |
| - name: Run npm audit on frontend | |
| working-directory: frontend | |
| run: npm audit --audit-level=high || true |