MajoorWaldi
e7c2443670
- Move token from local to session storage on client side - Set httpOnly cookie for server-side token on bootstrap/rotate - Add token validation and auto-sanitization - Implement retry logic for failed operations - Add input validation for collection names - Update toast durations and error handling
108 lines
3.0 KiB
YAML
108 lines
3.0 KiB
YAML
name: Python tests
|
|
|
|
on:
|
|
push:
|
|
branches: [ main, master ]
|
|
pull_request:
|
|
branches: [ main, master ]
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
quality:
|
|
runs-on: ubuntu-22.04
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
- name: Install quality tools
|
|
run: |
|
|
python -m pip install --upgrade pip
|
|
pip install -r requirements.txt
|
|
pip install xenon radon flake8 flake8-cognitive-complexity pip-audit bandit
|
|
|
|
- name: Check Python files encoding (no UTF-8 BOM)
|
|
run: python scripts/check_no_bom.py mjr_am_backend mjr_am_shared tests __init__.py scripts
|
|
|
|
- name: Complexity gate (stage A)
|
|
run: python -m xenon -b F -m D -a C mjr_am_backend mjr_am_shared tests __init__.py
|
|
|
|
- name: Complexity gate (new files, CC <= 10)
|
|
run: python scripts/check_cc_changed.py
|
|
|
|
- name: Audit Python dependencies
|
|
run: pip-audit --strict
|
|
|
|
- name: SAST scan (bandit)
|
|
run: bandit -r mjr_am_backend -ll -ii -x tests
|
|
|
|
- name: Install JS dependencies for audit
|
|
run: npm ci --ignore-scripts
|
|
|
|
- name: Audit JS dependencies
|
|
run: npm audit --audit-level=high
|
|
|
|
test:
|
|
runs-on: ubuntu-22.04
|
|
permissions:
|
|
contents: read
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
python-version: ["3.10", "3.12", "3.13", "3.14"]
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- name: Set up Python ${{ matrix.python-version }}
|
|
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
|
|
with:
|
|
python-version: ${{ matrix.python-version }}
|
|
|
|
- name: Install ExifTool and FFmpeg (includes ffprobe)
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y libimage-exiftool-perl ffmpeg
|
|
|
|
- name: Verify ExifTool and ffprobe
|
|
run: |
|
|
echo "ExifTool version:"
|
|
exiftool -ver || true
|
|
echo "ffprobe version:"
|
|
ffprobe -version || true
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
python -m pip install --upgrade pip
|
|
pip install -r requirements.txt
|
|
pip install pytest pytest-asyncio
|
|
|
|
- name: Run pytest
|
|
run: python -m pytest -q
|
|
|
|
typecheck:
|
|
runs-on: ubuntu-22.04
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
python -m pip install --upgrade pip
|
|
pip install -r requirements.txt
|
|
pip install mypy
|
|
|
|
- name: Run mypy
|
|
run: python -m mypy --config-file mypy.ini
|