From c729fef9778342c60801f53a331f8999f3bcb860 Mon Sep 17 00:00:00 2001 From: cryptorugmunch Date: Fri, 3 Jul 2026 18:03:13 +0200 Subject: [PATCH] ci(forgejo): sync ci.yml with github workflow --- .forgejo/workflows/ci.yml | 177 ++++++++++++-------------------------- 1 file changed, 56 insertions(+), 121 deletions(-) diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml index 0b1d540..f2be213 100644 --- a/.forgejo/workflows/ci.yml +++ b/.forgejo/workflows/ci.yml @@ -2,6 +2,8 @@ # Copyright (c) 2026 Rug Munch Media LLC # Part of Pry — https://git.rugmunch.io/RugMunchMedia/pryscraper # Licensed under MIT. See LICENSE. +# +# Force workflow re-parse: bump cache key 2026-07-03-a name: CI on: @@ -10,147 +12,80 @@ on: pull_request: branches: [main] +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + env: - UV_BIN: /root/.local/bin/uv + PYTHON_VERSION: "3.12" jobs: lint: - runs-on: docker-x64 - container: - image: python:3.11-slim + runs-on: ubuntu-latest steps: - - name: Install Node.js for actions/checkout - run: | - apt-get update - apt-get install -y --no-install-recommends curl ca-certificates - curl -fsSL https://deb.nodesource.com/setup_22.x | bash - - apt-get install -y --no-install-recommends nodejs - rm -rf /var/lib/apt/lists/* - - uses: actions/checkout@v4 - - - name: Install system deps - run: | - apt-get update - apt-get install -y --no-install-recommends gcc libpq-dev curl git ca-certificates - rm -rf /var/lib/apt/lists/* - - - name: Install uv - run: | - curl -LsSf https://astral.sh/uv/install.sh | sh - ln -sf /root/.local/bin/uv /usr/local/bin/uv - ln -sf /root/.local/bin/uvx /usr/local/bin/uvx - - - name: Setup Python - run: | - uv python install 3.11 - uv venv --python 3.11 .venv - - - name: Install dependencies - run: | - uv pip install --python .venv/bin/python -r requirements.txt - uv pip install --python .venv/bin/python -e ".[dev]" - - - name: Lint (ruff) - run: source .venv/bin/activate && ruff check . --exit-non-zero-on-fix - - - name: Format check (ruff) - run: source .venv/bin/activate && ruff format --check . + - uses: actions/setup-python@v5 + with: + python-version: ${{ env.PYTHON_VERSION }} + cache: pip + cache-dependency-path: pyproject.toml + - run: pip install ruff + - run: ruff check . + - run: ruff format --check . typecheck: - runs-on: docker-x64 - container: - image: python:3.11-slim + runs-on: ubuntu-latest steps: - - name: Install Node.js for actions/checkout - run: | - apt-get update && apt-get install -y --no-install-recommends curl ca-certificates - curl -fsSL https://deb.nodesource.com/setup_22.x | bash - - apt-get install -y --no-install-recommends nodejs - rm -rf /var/lib/apt/lists/* - - uses: actions/checkout@v4 - - name: Install uv + setup - run: | - apt-get update && apt-get install -y --no-install-recommends curl ca-certificates && rm -rf /var/lib/apt/lists/* - curl -LsSf https://astral.sh/uv/install.sh | sh - ln -sf /root/.local/bin/uv /usr/local/bin/uv - ln -sf /root/.local/bin/uvx /usr/local/bin/uvx - uv python install 3.11 - uv venv --python 3.11 .venv - uv pip install --python .venv/bin/python -e ".[dev]" - - name: Type check (mypy) - run: source .venv/bin/activate && mypy . + - uses: actions/setup-python@v5 + with: + python-version: ${{ env.PYTHON_VERSION }} + cache: pip + cache-dependency-path: pyproject.toml + - run: pip install -e ".[dev]" + - run: mypy --python-version 3.12 --strict --ignore-missing-imports --exclude 'build/|dist/|.git/|__pycache__/' *.py test: - runs-on: docker-x64 - container: - image: python:3.11-slim + runs-on: ubuntu-latest steps: - - name: Install Node.js for actions/checkout - run: | - apt-get update && apt-get install -y --no-install-recommends curl ca-certificates - curl -fsSL https://deb.nodesource.com/setup_22.x | bash - - apt-get install -y --no-install-recommends nodejs - rm -rf /var/lib/apt/lists/* - - uses: actions/checkout@v4 - - name: Install uv + setup - run: | - apt-get update && apt-get install -y --no-install-recommends gcc libpq-dev curl ca-certificates && rm -rf /var/lib/apt/lists/* - curl -LsSf https://astral.sh/uv/install.sh | sh - ln -sf /root/.local/bin/uv /usr/local/bin/uv - ln -sf /root/.local/bin/uvx /usr/local/bin/uvx - uv python install 3.11 - uv venv --python 3.11 .venv - uv pip install --python .venv/bin/python -e ".[dev]" - - name: Test (pytest) - run: source .venv/bin/activate && pytest tests/ -x -q --tb=short -m "not integration" + - uses: actions/setup-python@v5 + with: + python-version: ${{ env.PYTHON_VERSION }} + cache: pip + cache-dependency-path: pyproject.toml + - run: pip install -e ".[dev]" + - run: pytest tests/ -v --cov=. --cov-report=term-missing --cov-fail-under=40 - secrets: - name: Secret scan (gitleaks) - runs-on: docker-x64 - container: - image: python:3.11-slim + security: + runs-on: ubuntu-latest steps: - - name: Install Node.js for actions/checkout - run: | - apt-get update && apt-get install -y --no-install-recommends curl ca-certificates - curl -fsSL https://deb.nodesource.com/setup_22.x | bash - - apt-get install -y --no-install-recommends nodejs - rm -rf /var/lib/apt/lists/* + - uses: actions/checkout@v4 + - uses: actions/setup-python@v5 + with: + python-version: ${{ env.PYTHON_VERSION }} + cache: pip + cache-dependency-path: pyproject.toml + - run: pip install bandit + - run: bandit -r . -x tests/,.venv,__pycache__ + gitleaks: + runs-on: ubuntu-latest + steps: - uses: actions/checkout@v4 with: fetch-depth: 0 - - name: Run gitleaks - run: | - apt-get update && apt-get install -y --no-install-recommends wget git ca-certificates && rm -rf /var/lib/apt/lists/* - wget -qO- https://github.com/gitleaks/gitleaks/releases/download/v8.24.0/gitleaks_8.24.0_linux_x64.tar.gz | tar -xz -C /usr/local/bin gitleaks - gitleaks detect --source . --redact --no-banner --no-git + - uses: gitleaks/gitleaks-action@v2 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - security: - name: Security audit (bandit) - runs-on: docker-x64 - container: - image: python:3.11-slim + commitlint: + if: github.event_name == 'pull_request' + runs-on: ubuntu-latest steps: - - name: Install Node.js for actions/checkout - run: | - apt-get update && apt-get install -y --no-install-recommends curl ca-certificates - curl -fsSL https://deb.nodesource.com/setup_22.x | bash - - apt-get install -y --no-install-recommends nodejs - rm -rf /var/lib/apt/lists/* - - uses: actions/checkout@v4 - - name: Install uv + setup - run: | - apt-get update && apt-get install -y --no-install-recommends curl ca-certificates && rm -rf /var/lib/apt/lists/* - curl -LsSf https://astral.sh/uv/install.sh | sh - ln -sf /root/.local/bin/uv /usr/local/bin/uv - ln -sf /root/.local/bin/uvx /usr/local/bin/uvx - uv python install 3.11 - uv venv --python 3.11 /tmp/bandit-venv - uv pip install --python /tmp/bandit-venv/bin/python bandit - - name: Bandit (high+medium severity) - run: source /tmp/bandit-venv/bin/activate && bandit -r . -x tests/,.venv,__pycache__ -ll + with: + fetch-depth: 0 + - uses: wagoid/commitlint-github-action@v6 + with: + configFile: .commitlintrc.yml