ci and tests: add secured Linux build workflow, zero-skip test parame… #8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Main CI | |
| on: | |
| push: | |
| branches: ["main", "master"] | |
| pull_request: | |
| branches: ["main", "master"] | |
| workflow_dispatch: | |
| # Least privilege: this workflow only checks out code and uploads artifacts. | |
| permissions: | |
| contents: read | |
| jobs: | |
| lint: | |
| name: Lint and security | |
| runs-on: ubuntu-latest | |
| env: | |
| PIP_NO_CACHE_DIR: "1" | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| - name: Install project + dev deps | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install --find-links wheels --find-links wheels-linux -e .[dev] | |
| - name: Zero-egress security compliance scan | |
| run: python cli.py compliance | |
| - name: Proof suite verification | |
| run: python -m unittest test_qector_decoder_v3_proofs -v | |
| - name: Ruff lint (informational) | |
| continue-on-error: true | |
| run: ruff check . | |
| - name: Bandit security scan (informational) | |
| continue-on-error: true | |
| run: bandit -q -r . -x ./build,./dist,./tests -ll | |
| - name: pip-audit dependency scan (informational) | |
| continue-on-error: true | |
| run: pip-audit | |
| - name: mypy typecheck (informational) | |
| continue-on-error: true | |
| run: mypy . | |
| test: | |
| name: pytest on ${{ matrix.os }} | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.11"] | |
| os: [ubuntu-latest, windows-latest] | |
| env: | |
| PIP_NO_CACHE_DIR: "1" | |
| MPLBACKEND: Agg | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install project + dev deps | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install --find-links wheels --find-links wheels-linux -e .[dev] | |
| - name: Run pytest with coverage | |
| run: python -m pytest -q --cov=. --cov-report=xml | |
| - name: Upload coverage artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: coverage-${{ matrix.os }}-${{ matrix.python-version }} | |
| path: coverage.xml | |
| build: | |
| name: PyInstaller EXE (Windows) | |
| needs: [lint, test] | |
| runs-on: windows-latest | |
| env: | |
| PIP_NO_CACHE_DIR: "1" | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| - name: Install project deps + PyInstaller | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e . | |
| pip install pyinstaller | |
| - name: Build EXE with PyInstaller | |
| run: pyinstaller -y QectorWorkbench.spec | |
| - name: Package release zip | |
| shell: pwsh | |
| run: | | |
| New-Item -ItemType Directory -Force release_assets | Out-Null | |
| Compress-Archive -Path 'dist\QectorWorkbench\*' -DestinationPath "release_assets\QectorWorkbench-${{ github.run_number }}-win64.zip" | |
| - name: Write release manifest | |
| shell: pwsh | |
| run: python scripts/write_release_manifest.py --version "3.5.0-ci.${{ github.run_number }}" --zip "release_assets\QectorWorkbench-${{ github.run_number }}-win64.zip" | |
| - name: Upload build artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: QectorWorkbench-Windows-${{ github.run_number }} | |
| path: release_assets/ | |
| retention-days: 30 |