feat(header_injector): détection de licence robuste; pas d'injection … #20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [ main, develop ] | |
| pull_request: | |
| branches: [ main, develop ] | |
| workflow_dispatch: | |
| env: | |
| PYTHON_VERSION: '3.11' | |
| CACHE_VERSION: v1 | |
| jobs: | |
| lint: | |
| name: Lint and static analysis | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| cache: 'pip' | |
| cache-dependency-path: | | |
| requirements.txt | |
| constraints.txt | |
| - name: Upgrade pip | |
| run: python -m pip install --upgrade pip | |
| - name: Install linters and tools | |
| run: python -m pip install ruff mypy bandit pip-audit safety cyclonedx-py | |
| - name: Ruff (lint) | |
| run: ruff check . --output-format=github | |
| - name: Ruff (format check) | |
| run: ruff format --check . | |
| - name: Mypy (type check) | |
| run: mypy --config-file pyproject.toml utils API_SDK engine_sdk bcasl acasl | |
| - name: Bandit (security) | |
| run: bandit -r utils API_SDK engine_sdk bcasl acasl -f json -o bandit-report.json | |
| - name: pip-audit (dependencies) | |
| if: hashFiles('requirements.txt') != '' | |
| run: pip-audit -r requirements.txt --format=json --output=pip-audit-report.json | |
| - name: Safety check | |
| if: hashFiles('requirements.txt') != '' | |
| run: safety check -r requirements.txt --json --output safety-report.json | |
| continue-on-error: true | |
| - name: Generate SBOM | |
| if: hashFiles('requirements.txt') != '' | |
| run: cyclonedx-py -r requirements.txt -o sbom.json | |
| - name: Upload security reports | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: security-reports | |
| path: | | |
| bandit-report.json | |
| pip-audit-report.json | |
| safety-report.json | |
| sbom.json | |
| if-no-files-found: ignore | |
| format: | |
| name: Code formatting | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| cache: 'pip' | |
| - name: Install black | |
| run: python -m pip install black | |
| - name: Black format check | |
| run: black --check --diff . | |
| types: | |
| name: Type checking | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| cache: 'pip' | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| if [ -f requirements.txt ]; then pip install -r requirements.txt; fi | |
| pip install mypy | |
| - name: MyPy type check | |
| run: mypy --config-file pyproject.toml utils API_SDK engine_sdk bcasl acasl | |
| tests: | |
| name: Tests | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| python-version: ['3.10', '3.11', '3.12'] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| cache: 'pip' | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| if [ -f requirements.txt ]; then pip install -r requirements.txt; fi | |
| - name: Run tests with pytest | |
| run: | | |
| if [ -d tests ]; then | |
| python -m pytest tests/ -v --tb=short --cov=utils --cov=API_SDK --cov=engine_sdk --cov=bcasl --cov=acasl --cov-report=xml --cov-report=term-missing | |
| else | |
| echo "No tests directory found, skipping tests" | |
| fi | |
| - name: Upload coverage to Codecov | |
| if: matrix.python-version == '3.11' | |
| uses: codecov/codecov-action@v4 | |
| with: | |
| file: ./coverage.xml | |
| flags: unittests | |
| name: codecov-umbrella | |
| fail_ci_if_error: false | |
| build: | |
| name: Build and test (${{ matrix.os }}, py${{ matrix.python-version }}) | |
| runs-on: ${{ matrix.os }} | |
| needs: lint | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| python-version: ['3.10', '3.11'] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| cache: 'pip' | |
| - name: Upgrade pip | |
| run: python -m pip install --upgrade pip | |
| - name: Install requirements (if present) | |
| if: hashFiles('requirements.txt') != '' | |
| run: python -m pip install -r requirements.txt | |
| - name: Install tooling (pytest, coverage, build) | |
| run: python -m pip install pytest coverage build | |
| - name: Verify sources compile | |
| run: python -m compileall -q . | |
| - name: Run tests with coverage (if tests/ exists) | |
| run: >- | |
| python -c "import os,sys,subprocess; sys.exit(subprocess.call([sys.executable,'-m','coverage','run','-m','pytest','-q'])) if os.path.isdir('tests') else 0" | |
| - name: Generate coverage XML (if coverage file exists) | |
| run: >- | |
| python -c "import os,sys,subprocess; sys.exit(subprocess.call([sys.executable,'-m','coverage','xml','-i'])) if os.path.isfile('.coverage') else 0" | |
| - name: Upload coverage artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: coverage-${{ matrix.os }}-py${{ matrix.python-version }} | |
| path: coverage.xml | |
| if-no-files-found: ignore | |
| - name: Build distributions (sdist+wheel) if packaging configured | |
| if: >- | |
| hashFiles('pyproject.toml') != '' || | |
| hashFiles('setup.cfg') != '' || | |
| hashFiles('setup.py') != '' | |
| run: python -m build --sdist --wheel | |
| - name: Upload dist artifacts (if any) | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: dist-${{ matrix.os }}-py${{ matrix.python-version }} | |
| path: dist/* | |
| if-no-files-found: warn |