audithub-mcp/.github/workflows/python.yml at main · Veridise/audithub-mcp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
name: Python Quality

on:
  push:
    branches: ["main"]
  pull_request:

permissions:
  contents: read

jobs:
  quality:
    name: Quality
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false

      - name: Setup uv
        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098  # v7.3.1

      - name: Setup Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          python-version-file: ".python-version"

      - name: Install dependencies
        run: uv sync --frozen

      - name: Supply chain audit
        if: ${{ !cancelled() }}
        run: uv run pip-audit --skip-editable

      - name: Lint (ruff)
        if: ${{ !cancelled() }}
        run: uv run ruff check src tests

      - name: Import sorting (ruff isort)
        if: ${{ !cancelled() }}
        run: uv run ruff check --select I src tests

      - name: Type check (mypy)
        if: ${{ !cancelled() }}
        run: uv run mypy

      - name: Unit tests
        if: ${{ !cancelled() }}
        run: uv run python -m pytest -m "not integration"

  integration:
    name: Integration
    runs-on: ubuntu-latest
    environment: "Configure CI/CD Testing"

    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
        with:
          persist-credentials: false

      - name: Setup uv
        uses: astral-sh/setup-uv@0c5e2b8115b80b4c7c5ddf6ffdd634974642d182  # v5.4.1

      - name: Setup Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
        with:
          python-version-file: ".python-version"

      - name: Install dependencies
        run: uv sync --frozen

      - name: Integration tests
        run: uv run python -m pytest
        env:
          AUDITHUB_BASE_URL: ${{ secrets.AUDITHUB_BASE_URL }}
          AUDITHUB_OIDC_CONFIGURATION_URL: ${{ secrets.AUDITHUB_OIDC_CONFIGURATION_URL }}
          AUDITHUB_OIDC_CLIENT_ID: ${{ secrets.AUDITHUB_OIDC_CLIENT_ID }}
          AUDITHUB_OIDC_CLIENT_SECRET: ${{ secrets.AUDITHUB_OIDC_CLIENT_SECRET }}
          AH_ALLOWED_ORG_IDS: ${{ vars.AH_ALLOWED_ORG_IDS }}
          AH_ALLOWED_PROJECT_IDS: ${{ vars.AH_ALLOWED_PROJECT_IDS }}