Vito Sansevero
323023d59c
Every job in test.yml and code-quality.yml gets timeout-minutes = ceil(1.5 x slowest of three green main runs) + 3, min 5, with the runs and times written above jobs:. The matrix and the coverage gate run python -m tests.run_suite. ci-workflow.test.mjs checks every job in the three CI workflows has a limit and that the matrix and coverage use the runner. Job names are unchanged.
43 lines
1.4 KiB
YAML
43 lines
1.4 KiB
YAML
name: Code Quality
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
# Superseded PR pushes cancel their older run. Every main push gets its own
|
|
# group (run_id), so no main commit's run is ever cancelled or dropped as pending.
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
jobs:
|
|
security:
|
|
name: bandit (high severity)
|
|
runs-on: ubuntu-latest
|
|
# ceil(1.5 x slowest of three green main runs) + 3, never under 5 (test.yml): runs 40257217665,
|
|
# 40254137380, 40240706583 took 23s / 16s / 23s -> 5 min.
|
|
timeout-minutes: 5
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Set up Python 3.10
|
|
uses: actions/setup-python@v7
|
|
with:
|
|
python-version: "3.10"
|
|
|
|
- name: Install bandit
|
|
run: pip install bandit[toml]
|
|
|
|
# Medium findings are reported without failing until they are triaged.
|
|
# High severity is a hard gate.
|
|
- name: Security report (medium and above, informational)
|
|
run: bandit -r . -ll -q --exclude ./tests,./reference,./venv,./tools/vendor/node_modules --exit-zero
|
|
- name: Security scan (high severity gate)
|
|
run: bandit -r . -lll -q --exclude ./tests,./reference,./venv,./tools/vendor/node_modules
|