analyse deps: améliore la détection et la fiabilité #270
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [ main, develop ] | |
| pull_request: | |
| branches: [ main, develop ] | |
| workflow_dispatch: | |
| env: | |
| PYTHON_VERSION: '3.11' | |
| CACHE_VERSION: v1 | |
| jobs: | |
| lint: | |
| name: Lint and static analysis | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| cache: 'pip' | |
| cache-dependency-path: | | |
| requirements.txt | |
| constraints.txt | |
| - name: Upgrade pip | |
| run: python -m pip install --upgrade pip | |
| - name: Install linters and tools | |
| run: python -m pip install ruff mypy bandit pip-audit safety cyclonedx-py | |
| - name: Ruff (lint) | |
| run: ruff check . --output-format=github | |
| - name: Ruff (format check) | |
| run: ruff format --check . | |
| - name: Mypy (type check) | |
| run: mypy --config-file pyproject.toml utils Plugins_SDK engine_sdk bcasl | |
| - name: Bandit (security) | |
| run: bandit -r utils Plugins_SDK engine_sdk bcasl -f json -o bandit-report.json | |
| - name: pip-audit (dependencies) | |
| if: hashFiles('requirements.txt') != '' | |
| run: pip-audit -r requirements.txt --format=json --output=pip-audit-report.json | |
| - name: Safety check | |
| if: hashFiles('requirements.txt') != '' | |
| run: safety check -r requirements.txt --json --output safety-report.json | |
| continue-on-error: true | |
| - name: Generate SBOM | |
| if: hashFiles('requirements.txt') != '' | |
| run: cyclonedx-py -r requirements.txt -o sbom.json | |
| - name: Upload security reports | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: security-reports | |
| path: | | |
| bandit-report.json | |
| pip-audit-report.json | |
| safety-report.json | |
| sbom.json | |
| if-no-files-found: ignore | |
| format: | |
| name: Code formatting | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| cache: 'pip' | |
| - name: Install black | |
| run: python -m pip install black | |
| - name: Black format check | |
| run: black --check --diff . | |
| types: | |
| name: Type checking | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| cache: 'pip' | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| if [ -f requirements.txt ]; then pip install -r requirements.txt; fi | |
| pip install mypy | |
| - name: MyPy type check | |
| run: mypy --config-file pyproject.toml utils Plugins_SDK engine_sdk bcasl | |
| tests: | |
| name: Tests | |
| runs-on: ubuntu-latest | |
| env: | |
| QT_QPA_PLATFORM: offscreen | |
| strategy: | |
| matrix: | |
| python-version: ['3.10', '3.11', '3.12'] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| cache: 'pip' | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| if [ -f requirements.txt ]; then pip install -r requirements.txt; fi | |
| - name: Run tests with pytest | |
| run: | | |
| if [ -d tests ]; then | |
| python -m pytest tests/ -v --tb=short --cov=utils --cov=Plugins_SDK --cov=engine_sdk --cov=bcasl --cov-report=xml --cov-report=term-missing | |
| else | |
| echo "No tests directory found, skipping tests" | |
| fi | |
| - name: Upload coverage to Codecov | |
| if: matrix.python-version == '3.11' | |
| uses: codecov/codecov-action@v4 | |
| with: | |
| file: ./coverage.xml | |
| flags: unittests | |
| name: codecov-umbrella | |
| fail_ci_if_error: false | |
| build: | |
| name: Build and test (${{ matrix.os }}, py${{ matrix.python-version }}) | |
| runs-on: ${{ matrix.os }} | |
| needs: lint | |
| env: | |
| QT_QPA_PLATFORM: offscreen | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| python-version: ['3.10', '3.11'] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| cache: 'pip' | |
| - name: Upgrade pip | |
| run: python -m pip install --upgrade pip | |
| - name: Install requirements (if present) | |
| if: hashFiles('requirements.txt') != '' | |
| run: python -m pip install -r requirements.txt | |
| - name: Install tooling (pytest, coverage, build) | |
| run: python -m pip install pytest coverage build | |
| - name: Verify sources compile | |
| run: python -m compileall -q . | |
| - name: Run tests with coverage (if tests/ exists) | |
| run: >- | |
| python -c "import os,sys,subprocess; sys.exit(subprocess.call([sys.executable,'-m','coverage','run','-m','pytest','-q'])) if os.path.isdir('tests') else 0" | |
| - name: Generate coverage XML (if coverage file exists) | |
| run: >- | |
| python -c "import os,sys,subprocess; sys.exit(subprocess.call([sys.executable,'-m','coverage','xml','-i'])) if os.path.isfile('.coverage') else 0" | |
| - name: Upload coverage artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: coverage-${{ matrix.os }}-py${{ matrix.python-version }} | |
| path: coverage.xml | |
| if-no-files-found: ignore | |
| # Packaging (sdist/wheel) intentionally disabled. | |
| # This project is distributed as a standalone binary, not a PyPI package. |