deps: bump pylint from 4.0.5 to 4.0.6 #94
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| env: | |
| PYTHON_VERSION: "3.11" | |
| UV_VERSION: "0.10.11" | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| test: | |
| name: Test | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: Set up Python | |
| uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| - name: Set up uv | |
| uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 | |
| with: | |
| version: ${{ env.UV_VERSION }} | |
| enable-cache: true | |
| - name: Install locked dependencies | |
| run: uv sync --frozen | |
| - name: Run full test suite (includes tests/evals) | |
| run: uv run pytest | |
| - name: Prune stale bytecode | |
| run: | | |
| find tests src -type d -name __pycache__ -prune -exec rm -rf {} + | |
| find . -name '*.pyc' -delete | |
| - name: Verify source compilation | |
| run: uv run python -m compileall src tests | |
| build: | |
| name: Build | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| needs: | |
| - test | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: Set up Python | |
| uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| - name: Set up uv | |
| uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 | |
| with: | |
| version: ${{ env.UV_VERSION }} | |
| enable-cache: true | |
| - name: Install locked dependencies | |
| run: uv sync --frozen | |
| - name: Build distribution artifacts | |
| run: | | |
| rm -rf build dist | |
| uv build | |
| - name: Smoke test built wheel | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| smoke_dir="$RUNNER_TEMP/package-smoke" | |
| uv venv "$smoke_dir" --python "${{ env.PYTHON_VERSION }}" | |
| uv pip install --python "$smoke_dir/bin/python" dist/*.whl | |
| "$smoke_dir/bin/python" - <<'PY' | |
| import importlib.metadata as metadata | |
| expected = {"bodhi-rag", "bodhi-rag-api", "bodhi-rag-index"} | |
| discovered = { | |
| entry_point.name | |
| for entry_point in metadata.entry_points(group="console_scripts") | |
| } | |
| missing = expected - discovered | |
| if missing: | |
| raise SystemExit(f"Missing console scripts: {sorted(missing)}") | |
| import bodhi_rag.interfaces.api.app | |
| print("All checks passed") | |
| PY | |
| "$smoke_dir/bin/bodhi-rag-index" --help | |
| security: | |
| name: Security | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| needs: | |
| - test | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: Set up Python | |
| uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| - name: Set up uv | |
| uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 | |
| with: | |
| version: ${{ env.UV_VERSION }} | |
| enable-cache: true | |
| - name: Install locked dependencies | |
| run: uv sync --frozen | |
| - name: Export resolved dependencies for audit | |
| run: uv export --no-emit-project -o /tmp/audit-requirements.txt | |
| # CVE-2026-45829 affects chromadb 1.0.0-1.5.9 server-side | |
| # (chromadb/server/fastapi). bodhi-rag uses chromadb.PersistentClient | |
| # in embedded mode; the vulnerable code path is unreachable. | |
| # The client-side variant is also unreachable today because the | |
| # adapter always passes pre-computed embeddings (asserted by | |
| # tests/contract/test_chroma_hardening.py). Remove this ignore | |
| # when chromadb>=1.5.10 lands. See pyproject.toml comment block. | |
| - name: Security audit (pip-audit) | |
| run: >- | |
| uv run --with pip-audit pip-audit | |
| -r /tmp/audit-requirements.txt | |
| --strict | |
| --disable-pip | |
| --ignore-vuln CVE-2026-45829 | |
| - name: Security scan (bandit) | |
| run: uv run --with bandit bandit -r src/ | |
| quality: | |
| name: Quality | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| needs: | |
| - test | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: Set up Python | |
| uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| - name: Set up uv | |
| uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 | |
| with: | |
| version: ${{ env.UV_VERSION }} | |
| enable-cache: true | |
| - name: Install locked dependencies | |
| run: uv sync --frozen | |
| - name: Quality ratchet | |
| run: uv run python scripts/quality_ratchet.py --baseline .github/quality-baseline.json |