anti
99be4e64ad
- Add merge-to-testing job: after all CI checks pass on dev, auto-merge into testing with --no-ff for clear merge history - Move open-pr job to trigger on testing branch instead of dev - PR now opens testing → main instead of dev → main - Add bandit and pip-audit jobs to pr.yml PR gate for full suite coverage - PR gate test job now installs dev dependencies consistently
58 lines
1.3 KiB
YAML
58 lines
1.3 KiB
YAML
name: PR Gate
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
paths-ignore:
|
|
- "**/*.md"
|
|
- "docs/**"
|
|
|
|
jobs:
|
|
lint:
|
|
name: Lint (ruff)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.11"
|
|
- run: pip install ruff
|
|
- run: ruff check .
|
|
|
|
test:
|
|
name: Test (pytest)
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
matrix:
|
|
python-version: ["3.11", "3.12"]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: ${{ matrix.python-version }}
|
|
- run: pip install -e .[dev]
|
|
- run: pytest tests/ -v --tb=short
|
|
|
|
bandit:
|
|
name: SAST (bandit)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.11"
|
|
- run: pip install bandit
|
|
- run: bandit -r decnet/ -ll -x decnet/services/registry.py
|
|
|
|
pip-audit:
|
|
name: Dependency audit (pip-audit)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.11"
|
|
- run: pip install pip-audit
|
|
- run: pip install -e .[dev]
|
|
- run: pip-audit --skip-editable
|