Skip to content
Backend CI - Lint & Test

chore(deps)(deps): bump the patch-updates group across 1 directory with 3 updates #15

Sign in to view logs

chore(deps)(deps): bump the patch-updates group across 1 directory with 3 updates

chore(deps)(deps): bump the patch-updates group across 1 directory with 3 updates #15

Workflow file for this run

.github/workflows/backend-ci.yml at b80016d
name: Backend CI - Lint & Test
on:
push:
branches:
- main
paths:
- 'app/**'
- 'worker/**'
- '*.py'
- 'requirements.txt'
- 'pyproject.toml'
- '.github/workflows/backend-ci.yml'
pull_request:
paths:
- 'app/**'
- 'worker/**'
- '*.py'
- 'requirements.txt'
- 'pyproject.toml'
- '.github/workflows/backend-ci.yml'
workflow_dispatch:
jobs:
lint-and-format:
name: Lint & Format Check
runs-on: ubuntu-latest
strategy:
matrix:
python-version: ["3.11", "3.12"]
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v5
with:
python-version: ${{ matrix.python-version }}
cache: 'pip'
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install ruff black isort mypy
pip install -r requirements.txt
- name: Run ruff check
run: |
ruff check app/ worker/ scripts/ --output-format=github
- name: Run black check
run: |
black --check app/ worker/ scripts/
- name: Run isort check
run: |
isort --check-only app/ worker/
- name: Run mypy type check
run: |
mypy app/ worker/
continue-on-error: true # Don't fail the build for mypy initially
security-scan:
name: Security Scan
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Set up Python 3.11
uses: actions/setup-python@v5
with:
python-version: "3.11"
cache: 'pip'
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install pip-audit bandit[toml]
pip install -r requirements.txt
- name: Run pip-audit for dependency vulnerabilities
run: |
pip-audit --desc --skip-editable
continue-on-error: true # Don't fail on vulnerabilities initially
- name: Run bandit for code security issues
run: |
bandit -r app/ worker/ -f json -o bandit-report.json || true
bandit -r app/ worker/ -f screen
continue-on-error: true # Don't fail on security issues initially
- name: Upload bandit report
if: always()
uses: actions/upload-artifact@v4
with:
name: bandit-security-report
path: bandit-report.json
retention-days: 30
test:
name: Test with PostgreSQL
runs-on: ubuntu-latest
services:
postgres:
image: postgres:15
env:
POSTGRES_USER: postgres
POSTGRES_PASSWORD: postgres
POSTGRES_DB: postgres
ports:
- 5432:5432
options: >-
--health-cmd pg_isready
--health-interval 10s
--health-timeout 5s
--health-retries 5
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Set up Python 3.11
uses: actions/setup-python@v5
with:
python-version: "3.11"
cache: 'pip'
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install pytest pytest-cov pytest-asyncio httpx
pip install -r requirements.txt
- name: Apply database schema
env:
DATABASE_URL: postgresql://postgres:postgres@localhost:5432/postgres
run: |
PGPASSWORD=postgres psql -h localhost -U postgres -d postgres -f sql/schema.sql
- name: Run pytest with coverage
env:
DATABASE_URL: postgresql://postgres:postgres@localhost:5432/postgres
SESSION_SECRET: test-secret-key-for-ci-only
FRONTEND_ORIGIN: http://localhost:5173
run: |
pytest tests/ --cov=app --cov-report=xml --cov-report=term --cov-report=html -v
- name: Generate coverage summary
if: always()
run: |
echo "## Test Coverage Summary" >> $GITHUB_STEP_SUMMARY
echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
coverage report --skip-empty >> $GITHUB_STEP_SUMMARY || echo "Coverage report generation failed" >> $GITHUB_STEP_SUMMARY
echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
- name: Upload coverage reports
if: always()
uses: actions/upload-artifact@v4
with:
name: coverage-reports
path: |
coverage.xml
htmlcov/
retention-days: 30
- name: Check coverage threshold
run: |
coverage report --fail-under=70 || echo "⚠️ Coverage is below 70% threshold"
docker-build:
name: Docker Build
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Build Docker image (CPU-compatible check)
uses: docker/build-push-action@v5
with:
context: .
file: ./Dockerfile
push: false
tags: transcript-create:test
cache-from: type=gha
cache-to: type=gha,mode=max
# Intentionally using the CPU PyTorch wheel index for CI builds to ensure CPU compatibility.
build-args: |
ROCM_WHEEL_INDEX=https://download.pytorch.org/whl/cpu