cayce
c855f01da5
ci.yml gains a postgres:16 service; alembic upgrade/downgrade/upgrade round-trip runs on PG, unit tests run -m "not integration", and the roles.sql integration suite runs with a postgresql-client install. (Gate executed locally against Postgres 18.6 — see PR description.)
64 lines
1.8 KiB
YAML
64 lines
1.8 KiB
YAML
name: ci
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
jobs:
|
|
lint-test-leaks:
|
|
runs-on: ubuntu-latest
|
|
services:
|
|
postgres:
|
|
image: postgres:16
|
|
env:
|
|
POSTGRES_USER: cayce
|
|
POSTGRES_PASSWORD: ci-only-not-a-secret
|
|
POSTGRES_DB: cayce_ops
|
|
ports:
|
|
- 5432:5432
|
|
options: >-
|
|
--health-cmd "pg_isready -U cayce -d cayce_ops"
|
|
--health-interval 5s --health-timeout 3s --health-retries 10
|
|
env:
|
|
CAYCE_OPS_DATABASE_URL: postgresql+psycopg://cayce:ci-only-not-a-secret@127.0.0.1:5432/cayce_ops
|
|
PGPASSWORD: ci-only-not-a-secret
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0 # gitleaks needs full history
|
|
|
|
- uses: astral-sh/setup-uv@v5
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
- name: Install (locked)
|
|
run: uv sync --frozen
|
|
|
|
- name: Lint (ruff)
|
|
run: uv run ruff check .
|
|
|
|
- name: Migrations upgrade/downgrade round-trip (Postgres 16)
|
|
run: |
|
|
uv run alembic upgrade head
|
|
uv run alembic downgrade 0001
|
|
uv run alembic upgrade head
|
|
uv run alembic downgrade base
|
|
uv run alembic upgrade head
|
|
|
|
- name: Alembic smoke (SQLite)
|
|
run: uv run alembic upgrade head
|
|
|
|
- name: Unit tests (pytest)
|
|
run: uv run pytest -m "not integration"
|
|
|
|
- name: Integration tests — roles.sql + daemon cycles (Postgres 16)
|
|
run: |
|
|
sudo apt-get update && sudo apt-get install -y postgresql-client
|
|
uv run pytest -m integration -v
|
|
|
|
- name: Secret scan (gitleaks, full history)
|
|
run: |
|
|
curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz | tar -xz gitleaks
|
|
./gitleaks detect --source . --log-opts="--all" -v
|