malkuthroandClaude Opus 4.7
7121094780
* ci: add lint, syntax-smoke, and bandit security gate
Two gating jobs for PRs to main: ruff + python -m compileall ("Lint & Smoke")
and bandit static analysis ("Security Gate"). Bandit excludes vendored sub-trees
(forks/, upscaler_FIX/, nuke_CAM_exporter/).
Pattern lifted from malkuthro/ForgeFlow's CI. Status checks will be wired into
the Protect-main ruleset after first green run on main.
Refs #29
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* ci: exclude vendored sub-trees from lint and smoke
Ruff was flagging 93 errors in upscaler_FIX/github_repos/ComfyUI-multigpu/
(vendored upstream copies). Match bandit's exclude list so lint only checks
this repo's own code.
De-vendoring is tracked separately in #28.
Refs #29
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* chore: remove unused imports, add ruff config
- Drop unused os/json from k_easy_version.py and torch from k_easy_wan22_prompt.py.
- Add [tool.ruff] in pyproject.toml: extend-exclude vendored sub-trees,
per-file-ignores F841 for k_easy_resize.py (intentional symmetry vars
pad_b/pad_r/original_B/original_C are kept for clarity).
- CI workflow simplifies to plain `ruff check .` since config is now centralized.
Refs #29
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
47 lines
961 B
YAML
47 lines
961 B
YAML
name: CI
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
push:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
lint-smoke:
|
|
name: Lint & Smoke
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.11"
|
|
|
|
- name: Install lint tools
|
|
run: pip install ruff==0.6.9
|
|
|
|
- name: Ruff check
|
|
run: ruff check .
|
|
|
|
- name: Compile all (syntax smoke)
|
|
run: python -m compileall -q -x '(\.venv|forks|upscaler_FIX/github_repos|nuke_CAM_exporter)' .
|
|
|
|
security-gate:
|
|
name: Security Gate
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.11"
|
|
|
|
- name: Install bandit
|
|
run: pip install bandit==1.7.10
|
|
|
|
- name: Bandit scan
|
|
run: bandit -r . -x ./.venv,./forks,./upscaler_FIX,./nuke_CAM_exporter -ll
|