Update __init__.py #128
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| schedule: | |
| # Weekly (Mon 06:00 UTC) so pip-audit catches newly disclosed CVEs even | |
| # without a code change. | |
| - cron: "0 6 * * 1" | |
| jobs: | |
| lint: | |
| name: Ruff (lint + format) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: "3.12" | |
| - name: Install ruff | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e ".[dev]" | |
| - name: Ruff lint | |
| run: ruff check . | |
| - name: Ruff format (check only) | |
| run: ruff format --check . | |
| typecheck: | |
| name: Pyright | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: "3.12" | |
| - name: Install package + pyright | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e ".[dev]" | |
| - name: Pyright | |
| run: pyright | |
| test: | |
| name: Tests (py${{ matrix.python-version }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.11", "3.12", "3.13"] | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e ".[dev]" | |
| - name: Run tests with coverage | |
| run: coverage run -m pytest tests -q | |
| # `coverage report` enforces `fail_under` (85% from pyproject.toml). | |
| - name: Coverage report (enforces fail_under) | |
| run: coverage report | |
| - name: Coverage XML | |
| if: always() | |
| run: coverage xml | |
| - name: Upload coverage report | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: coverage-py${{ matrix.python-version }} | |
| path: coverage.xml | |
| if-no-files-found: ignore | |
| package: | |
| name: Build wheel, install & smoke test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: "3.12" | |
| - name: Build sdist + wheel | |
| run: | | |
| python -m pip install --upgrade pip build | |
| python -m build | |
| - name: Install the built wheel into a clean venv | |
| run: | | |
| python -m venv /tmp/wheeltest | |
| /tmp/wheeltest/bin/python -m pip install --upgrade pip | |
| /tmp/wheeltest/bin/python -m pip install dist/*.whl | |
| - name: Smoke test the installed wheel | |
| # Run from a neutral directory: if we ran inside the checkout, the | |
| # source `app/` tree would shadow the installed wheel on sys.path | |
| # and we'd be testing the source, not the built artifact. | |
| run: | | |
| set -euxo pipefail | |
| NEUTRAL_DIR=$(mktemp -d) | |
| cd "$NEUTRAL_DIR" | |
| PY=/tmp/wheeltest/bin/python | |
| "$PY" - <<'PY' | |
| import importlib.metadata as md | |
| import app | |
| loc = app.__file__ | |
| assert "site-packages" in loc, f"imported source, not wheel: {loc}" | |
| md.version("python-agent-web") | |
| print("wheel import OK:", loc) | |
| PY | |
| - name: Upload distributions | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: dist | |
| path: dist/* | |
| audit: | |
| name: pip-audit (dependency CVEs) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: "3.12" | |
| - name: Install pip-audit | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install "pip-audit>=2.7" | |
| # Audit the PROJECT's dependency closure resolved from pyproject.toml | |
| # (fastapi, uvicorn, sqlalchemy, ... + transitives) — NOT the whole | |
| # runner environment, which would flag unrelated tooling like | |
| # pip/setuptools. Record accepted/unfixable advisories in | |
| # .pip-audit-known-vulnerabilities. | |
| - name: pip-audit | |
| run: | | |
| IGNORE_VULNS="" | |
| if [ -f .pip-audit-known-vulnerabilities ]; then | |
| while IFS= read -r vuln_id || [ -n "$vuln_id" ]; do | |
| # Skip blank lines and comments | |
| case "$vuln_id" in ''|\#*) continue ;; esac | |
| IGNORE_VULNS="$IGNORE_VULNS --ignore-vuln $vuln_id" | |
| done < .pip-audit-known-vulnerabilities | |
| fi | |
| pip-audit . --strict --progress-spinner=off $IGNORE_VULNS |