agent-dev-a
94fe8cf002
Co-authored-by: agent-dev-a <agent-dev-a@agents.moleculesai.app> Co-committed-by: agent-dev-a <agent-dev-a@agents.moleculesai.app>
109 lines
3.2 KiB
YAML
109 lines
3.2 KiB
YAML
name: CI
|
|
|
|
# PR-1 CI gate for mol-secret-broker.
|
|
#
|
|
# Three jobs run on every pull_request:
|
|
# - tests / pytest — pytest with full unit suite (testcontainer
|
|
# integration tests are gated on Docker; the
|
|
# pytest fixture skips cleanly when absent
|
|
# so this job stays green even on runners
|
|
# without Docker access).
|
|
# - lint / ruff — ruff check + format --check.
|
|
# - typecheck / mypy — strict mypy across the package.
|
|
#
|
|
# Job names + step names match operator-config branch-protection rules
|
|
# so a contracts-style change here would surface as a check-name miss.
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, synchronize, reopened]
|
|
push:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
pytest:
|
|
name: pytest
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
- name: Install uv
|
|
run: |
|
|
curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
echo "$HOME/.local/bin" >> $GITHUB_PATH
|
|
|
|
- name: Sync dependencies
|
|
run: uv sync --extra dev
|
|
|
|
- name: Run pytest
|
|
run: uv run pytest -v --tb=short
|
|
|
|
ruff:
|
|
name: ruff
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
- name: Install uv
|
|
run: |
|
|
curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
echo "$HOME/.local/bin" >> $GITHUB_PATH
|
|
|
|
- name: Sync dependencies
|
|
run: uv sync --extra dev
|
|
|
|
- name: Lint
|
|
run: uv run ruff check mol_secret_broker
|
|
|
|
mypy:
|
|
name: mypy
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
- name: Install uv
|
|
run: |
|
|
curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
echo "$HOME/.local/bin" >> $GITHUB_PATH
|
|
|
|
- name: Sync dependencies
|
|
run: uv sync --extra dev
|
|
|
|
- name: Typecheck
|
|
# ``ignore-missing-imports`` for now because some optional deps
|
|
# (testcontainers, psycopg_pool's vendored types) don't ship
|
|
# py.typed markers. Tightening this is a follow-up.
|
|
run: uv run mypy --ignore-missing-imports mol_secret_broker
|
|
|
|
all-required:
|
|
# Single sentinel context that branch protection can require instead of
|
|
# enumerating every individual CI job. Mirrors molecule-controlplane's
|
|
# pattern and closes #2.
|
|
name: all-required
|
|
needs: [pytest, ruff, mypy]
|
|
if: always()
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Verify all required jobs passed
|
|
run: |
|
|
results="${{ needs.pytest.result }} ${{ needs.ruff.result }} ${{ needs.mypy.result }}"
|
|
for result in $results; do
|
|
if [ "$result" != "success" ]; then
|
|
echo "One or more required CI jobs failed: $results"
|
|
exit 1
|
|
fi
|
|
done
|
|
echo "All required CI jobs passed: $results"
|