malkuthro
2babbafb6b
* chore(security): pin Actions and update aiohttp * fix(security): generate universal test lock * fix(security): harden relock safeguards
110 lines
3.3 KiB
YAML
110 lines
3.3 KiB
YAML
name: CI
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
push:
|
|
branches: [main]
|
|
schedule:
|
|
- cron: "23 6 * * 1"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
lint-smoke:
|
|
name: Lint & Smoke
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
|
|
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
|
|
with:
|
|
python-version: "3.11"
|
|
|
|
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
|
with:
|
|
node-version: "22"
|
|
|
|
- name: Install lint tools
|
|
run: pip install ruff==0.6.9
|
|
|
|
- name: Ruff check
|
|
run: ruff check .
|
|
|
|
- name: Compile all (syntax smoke)
|
|
run: python -m compileall -q -x '(\.venv|forks|upscaler_FIX/github_repos|nuke_CAM_exporter)' .
|
|
|
|
- name: Run JS smoke tests
|
|
run: |
|
|
node tests/js/test_ai_pipeline_preview.mjs
|
|
node tests/js/test_draft_guard.mjs
|
|
node tests/js/test_update_check.mjs
|
|
|
|
security-gate:
|
|
name: Security Gate
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
|
|
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
|
|
with:
|
|
python-version: "3.11"
|
|
|
|
- name: Install security tools
|
|
run: pip install bandit==1.7.10 pip-audit -c constraints-test.txt
|
|
|
|
- name: Bandit scan
|
|
run: bandit -r . -x ./.venv,./forks,./upscaler_FIX,./nuke_CAM_exporter -ll
|
|
|
|
- name: Dependency audit
|
|
run: pip-audit -r constraints-test.txt
|
|
|
|
- name: Audit all platform dependency pins
|
|
run: |
|
|
sed -E 's/[[:space:]]*;.*$//' constraints-test.txt > /tmp/constraints-all-platforms.txt
|
|
pip-audit --no-deps -r /tmp/constraints-all-platforms.txt
|
|
|
|
preflight:
|
|
name: Pre-flight Release
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
|
|
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
|
|
with:
|
|
python-version: "3.11"
|
|
|
|
- name: Run pre-flight (static + dispatch + workflow fixtures)
|
|
# manager-meta is skipped on PRs because the upstream node-map drift
|
|
# is owned by an external repo (ltdrdata/ComfyUI-Manager) and is
|
|
# tracked separately via issue #44. Re-enable by removing --skip
|
|
# once that issue is resolved upstream.
|
|
run: python tools/preflight_release.py --skip manager-meta -v
|
|
|
|
pytest:
|
|
name: Pytest
|
|
runs-on: ${{ matrix.os }}
|
|
strategy:
|
|
# Keep both lanes reporting even when one fails — a Windows-only
|
|
# failure with a green ubuntu lane is exactly the signal this
|
|
# matrix exists to surface.
|
|
fail-fast: false
|
|
matrix:
|
|
os: [ubuntu-latest, windows-latest]
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
|
|
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
|
|
with:
|
|
python-version: "3.11"
|
|
|
|
- name: Install test deps
|
|
# Install from the committed test lock so CI exercises the same
|
|
# dependency set that local bootstrap audits.
|
|
run: pip install -e ".[test]" -c constraints-test.txt
|
|
|
|
- name: Run pytest
|
|
run: pytest -q
|