-
Notifications
You must be signed in to change notification settings - Fork 9
chore(template): sync from mcp-ecosystem #26
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -1,33 +1,45 @@ | ||||||
| name: CI | ||||||
|
|
||||||
| on: | ||||||
| push: | ||||||
| branches: [main] | ||||||
| pull_request: | ||||||
| branches: [main] | ||||||
| push: | ||||||
| branches: [main] | ||||||
| workflow_dispatch: | ||||||
|
|
||||||
| jobs: | ||||||
| test: | ||||||
| runs-on: ubuntu-latest | ||||||
| strategy: | ||||||
| matrix: | ||||||
| python-version: ["3.11", "3.12"] | ||||||
|
|
||||||
| steps: | ||||||
| - uses: actions/checkout@v6 | ||||||
| - uses: actions/checkout@v4 | ||||||
|
|
||||||
| - name: Set up Python | ||||||
| uses: actions/setup-python@v6 | ||||||
| - name: Set up Python ${{ matrix.python-version }} | ||||||
| uses: actions/setup-python@v5 | ||||||
| with: | ||||||
| python-version: "3.11" | ||||||
|
|
||||||
| - name: Install uv | ||||||
| uses: astral-sh/setup-uv@v8.1.0 | ||||||
| python-version: ${{ matrix.python-version }} | ||||||
|
|
||||||
| - name: Install dependencies | ||||||
| run: | | ||||||
| uv venv | ||||||
| uv pip install -e ".[dev]" | ||||||
| python -m pip install --upgrade pip | ||||||
| pip install -e ".[dev]" | ||||||
|
|
||||||
| - name: Run linter | ||||||
| run: uv run ruff check . | ||||||
| - name: Lint with ruff | ||||||
| run: | | ||||||
| pip install ruff | ||||||
|
||||||
| pip install ruff |
Copilot
AI
Apr 22, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Similarly, pytest/pytest-asyncio/pytest-cov are installed again even though they’re already part of the .[dev] extras installed earlier. This adds time and can cause CI to use different versions than local/dev. Prefer removing this extra install (or pinning explicitly if intended).
| pip install pytest pytest-asyncio pytest-cov |
Copilot
AI
Apr 22, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Coverage is collected with --cov=src, but this project does not use a src/ layout/package, so coverage will be empty or misleading. Point --cov at the actual modules/packages in this repo (or use --cov=. / a specific package name).
| pytest --cov=src --cov-report=xml | |
| pytest --cov=. --cov-report=xml |
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,39 @@ | ||||||
| name: Dependabot auto-merge | ||||||
|
|
||||||
| on: | ||||||
| pull_request_target: | ||||||
| types: | ||||||
| - opened | ||||||
| - reopened | ||||||
| - synchronize | ||||||
| - ready_for_review | ||||||
|
|
||||||
| permissions: | ||||||
| contents: write | ||||||
| pull-requests: write | ||||||
|
|
||||||
| jobs: | ||||||
| auto-merge: | ||||||
| if: github.actor == 'dependabot[bot]' | ||||||
| runs-on: ubuntu-latest | ||||||
| steps: | ||||||
| - name: Fetch Dependabot metadata | ||||||
| id: meta | ||||||
| uses: dependabot/fetch-metadata@v2 | ||||||
|
||||||
| uses: dependabot/fetch-metadata@v2 | |
| uses: dependabot/fetch-metadata@d7267f607e9d3fb96fc2fbe83e0af444713e90b7 |
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -1,112 +1,75 @@ | ||||||
| name: Release Please | ||||||
| # Release workflow for Python packages | ||||||
| # | ||||||
| # How it works: | ||||||
| # 1. Create a git tag (e.g., v1.0.0) | ||||||
| # 2. Push the tag to trigger this workflow | ||||||
| # 3. Workflow builds and publishes to PyPI using Trusted Publishing | ||||||
| # | ||||||
| # PyPI Trusted Publishing: | ||||||
| # No API tokens needed! Configure at: | ||||||
| # https://pypi.org/manage/project/{package-name}/settings/publishing/ | ||||||
| # Add this repository as a trusted publisher. | ||||||
|
|
||||||
| name: Release | ||||||
|
|
||||||
| on: | ||||||
| push: | ||||||
| branches: | ||||||
| - main | ||||||
| workflow_dispatch: | ||||||
| tags: | ||||||
| - "v*" | ||||||
|
|
||||||
| permissions: | ||||||
| contents: write | ||||||
| issues: write | ||||||
| pull-requests: write | ||||||
| id-token: write | ||||||
|
|
||||||
| jobs: | ||||||
| release-please: | ||||||
| name: Release Please | ||||||
| runs-on: ubuntu-latest | ||||||
| outputs: | ||||||
| release_created: ${{ steps.release.outputs.release_created }} | ||||||
| tag_name: ${{ steps.release.outputs.tag_name }} | ||||||
| sha: ${{ steps.release.outputs.sha }} | ||||||
| steps: | ||||||
| - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4 | ||||||
| id: release | ||||||
| with: | ||||||
| token: ${{ secrets.RELEASE_PLEASE_TOKEN || github.token }} | ||||||
| config-file: release-please-config.json | ||||||
| manifest-file: .release-please-manifest.json | ||||||
|
|
||||||
| build-release: | ||||||
| name: Build Release | ||||||
| needs: release-please | ||||||
| if: ${{ needs.release-please.outputs.release_created == 'true' }} | ||||||
| build: | ||||||
| runs-on: ubuntu-latest | ||||||
| permissions: | ||||||
| contents: read | ||||||
| steps: | ||||||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | ||||||
| with: | ||||||
| ref: ${{ needs.release-please.outputs.sha }} | ||||||
| persist-credentials: false | ||||||
| - uses: actions/checkout@v4 | ||||||
|
|
||||||
| - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 | ||||||
| - uses: actions/setup-python@v5 | ||||||
| with: | ||||||
| python-version: "3.11" | ||||||
|
|
||||||
|
Comment on lines
+28
to
33
|
||||||
| - name: Install uv | ||||||
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | ||||||
|
|
||||||
| - name: Install dependencies | ||||||
| - name: Install build dependencies | ||||||
| run: | | ||||||
| uv venv | ||||||
| uv pip install -e ".[dev]" | ||||||
|
|
||||||
| - name: Run linter | ||||||
| run: uv run ruff check . | ||||||
|
|
||||||
| - name: Run tests | ||||||
| run: uv run pytest tests/ -v | ||||||
| python -m pip install --upgrade pip | ||||||
| pip install build | ||||||
|
|
||||||
| - name: Build package | ||||||
| run: uv build --out-dir dist | ||||||
| run: python -m build | ||||||
|
|
||||||
| - name: Upload artifacts | ||||||
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | ||||||
| uses: actions/upload-artifact@v4 | ||||||
| with: | ||||||
| name: dist | ||||||
| path: dist/ | ||||||
|
|
||||||
| publish-pypi: | ||||||
| name: Publish to PyPI | ||||||
| needs: build-release | ||||||
| needs: build | ||||||
| runs-on: ubuntu-latest | ||||||
| environment: pypi | ||||||
| permissions: | ||||||
| id-token: write | ||||||
| steps: | ||||||
| - name: Download artifacts | ||||||
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | ||||||
| uses: actions/download-artifact@v4 | ||||||
| with: | ||||||
| name: dist | ||||||
| path: dist/ | ||||||
|
|
||||||
| - name: Publish to PyPI | ||||||
| uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1 | ||||||
| with: | ||||||
| skip-existing: true | ||||||
| uses: pypa/gh-action-pypi-publish@release/v1 | ||||||
|
||||||
| uses: pypa/gh-action-pypi-publish@release/v1 | |
| uses: pypa/gh-action-pypi-publish@<FULL_40_CHARACTER_COMMIT_SHA> # release/v1 |
Copilot
AI
Apr 22, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
softprops/action-gh-release@v1 is a mutable tag. Pin to a commit SHA to reduce supply-chain risk for the release creation step.
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -18,7 +18,7 @@ jobs: | |||||
| name: CodeQL Analysis | ||||||
| runs-on: ubuntu-latest | ||||||
| steps: | ||||||
| - uses: actions/checkout@v6 | ||||||
| - uses: actions/checkout@v4 | ||||||
|
|
||||||
| - name: Initialize CodeQL | ||||||
| uses: github/codeql-action/init@v4 | ||||||
|
|
@@ -35,9 +35,9 @@ jobs: | |||||
| name: Dependency Audit | ||||||
| runs-on: ubuntu-latest | ||||||
| steps: | ||||||
| - uses: actions/checkout@v6 | ||||||
| - uses: actions/checkout@v4 | ||||||
|
|
||||||
| - uses: actions/setup-python@v6 | ||||||
| - uses: actions/setup-python@v5 | ||||||
| with: | ||||||
| python-version: "3.11" | ||||||
|
|
||||||
|
|
@@ -49,19 +49,21 @@ jobs: | |||||
|
|
||||||
| - name: Audit dependencies | ||||||
| run: pip-audit | ||||||
| continue-on-error: true | ||||||
|
||||||
| continue-on-error: true |
Copilot
AI
Apr 22, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
bandit is configured to scan src/, but this repository doesn’t have a src/ directory, so the scan will either error or effectively scan nothing (and with continue-on-error: true this can silently mask that). Update the scan target to match the actual code layout (e.g., repo root with appropriate excludes, or the real package/module directories).
| run: bandit -r src/ -ll | |
| run: bandit -r . -ll |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This change removes Dependabot updates for the
github-actionsecosystem. If actions versions are not managed elsewhere, this will stop automated security/version updates for workflow actions; consider re-adding thegithub-actionsentry or documenting the replacement update mechanism.