diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5830d4fd..adcac1a0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,7 +1,7 @@ name: CI -# This workflow runs tests and code quality checks -# It runs on every push and pull request to main and develop branches +# Runs tests across multiple Python versions and performs code quality checks +# Includes test coverage reporting and linting with flake8 and mypy on: push: @@ -9,25 +9,21 @@ on: pull_request: branches: [main, develop] -# Permissions needed for this workflow permissions: contents: read jobs: - # Job 1: Run Tests and Check Coverage - test-and-coverage: - name: Test & Coverage (${{ matrix.python-version }}) + test: runs-on: ubuntu-latest strategy: - fail-fast: false # Don't stop other versions if one fails + fail-fast: false matrix: python-version: ['3.10', '3.11', '3.12'] steps: - - name: Checkout code - uses: actions/checkout@v4 + - uses: actions/checkout@v4 - - name: Free Disk Space (Ubuntu) + - name: Free Disk Space uses: jlumbroso/free-disk-space@main with: tool-cache: false @@ -38,76 +34,42 @@ jobs: docker-images: true swap-storage: true - - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + - uses: actions/setup-python@v5 with: python-version: ${{ matrix.python-version }} - - name: Cache pip packages - uses: actions/cache@v4 - with: - path: ~/.cache/pip - key: ${{ runner.os }}-pip-${{ hashFiles('**/pyproject.toml') }} - restore-keys: | - ${{ runner.os }}-pip- - - - name: Install dependencies - run: | - python -m pip install --upgrade pip + - run: | pip install -e ".[dev]" - - name: Verify installation - run: python -c "import semantica; print(f'Version: {semantica.__version__}')" + - run: pytest --cov=semantica --cov-report=xml --cov-report=term-missing -v - - name: Run tests - # Runs pytest only if tests directory exists - run: | - if [ -d "tests" ] && [ "$(find tests -name 'test_*.py' -o -name '*_test.py' | wc -l)" -gt 0 ]; then - pytest --cov=semantica --cov-report=xml --cov-report=term-missing -v - else - echo "No tests found. Skipping." - fi - - - name: Upload coverage to Codecov - # Only upload coverage for Python 3.11 to avoid duplicates + - name: Upload coverage if: matrix.python-version == '3.11' uses: codecov/codecov-action@v3 with: file: ./coverage.xml - flags: unittests - name: codecov-umbrella - fail_ci_if_error: false - # Job 2: Check Code Quality (Linting) - quality-checks: - name: Code Quality Checks + lint: runs-on: ubuntu-latest steps: - - name: Checkout code - uses: actions/checkout@v4 + - uses: actions/checkout@v4 - - name: Set up Python - uses: actions/setup-python@v5 + - name: Free Disk Space + uses: jlumbroso/free-disk-space@main + with: + tool-cache: false + android: true + dotnet: true + haskell: true + large-packages: true + docker-images: true + swap-storage: true + + - uses: actions/setup-python@v5 with: python-version: '3.11' - - name: Install dependencies - run: | - python -m pip install --upgrade pip - pip install -e ".[dev]" + - run: pip install -e ".[dev]" - - name: Check formatting (black) - # Fails if code is not formatted correctly - run: black --check semantica/ - - - name: Check import sorting (isort) - # Fails if imports are not sorted correctly - run: isort --check-only semantica/ - - - name: Run linter (flake8) - # Fails if there are syntax errors or style violations - run: flake8 semantica/ - - - name: Type check (mypy) - # Fails if there are type errors - run: mypy semantica/ + - run: flake8 semantica/ + - run: mypy semantica/ diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml index bdb7b130..9dd3ce10 100644 --- a/.github/workflows/format.yml +++ b/.github/workflows/format.yml @@ -1,8 +1,7 @@ name: Format Code -# This workflow automatically formats code to match project standards -# It runs on pull requests and pushes to main/develop branches -# If it finds formatting issues on a push, it creates a PR to fix them +# Ensures code follows consistent formatting style on every push and pull request +# Prevents unformatted code from being merged and keeps the codebase tidy automatically on: pull_request: @@ -11,71 +10,40 @@ on: branches: [main, develop] workflow_dispatch: -# Permissions needed to write changes back to the repo permissions: contents: write pull-requests: write jobs: format: - name: Format Code runs-on: ubuntu-latest steps: - - name: Checkout code - uses: actions/checkout@v4 + - uses: actions/checkout@v4 - - name: Set up Python - uses: actions/setup-python@v5 + - uses: actions/setup-python@v5 with: python-version: '3.11' - - name: Install dependencies - run: | - python -m pip install --upgrade pip + - run: | pip install black isort - name: Check formatting - # On PRs, just check and report issues (don't auto-fix) if: github.event_name == 'pull_request' run: | - black --check semantica/ || echo "⚠️ Code formatting issues found. Run: black semantica/" - isort --check-only semantica/ || echo "⚠️ Import sorting issues found. Run: isort semantica/" - continue-on-error: true + black --check semantica/ + isort --check-only semantica/ - - name: Format with black - # On pushes, actually run the formatter + - name: Format code if: github.event_name != 'pull_request' - run: black semantica/ - - - name: Sort imports with isort - # On pushes, actually run the import sorter - if: github.event_name != 'pull_request' - run: isort semantica/ - - - name: Check for changes - # See if the formatters changed any files - if: github.event_name != 'pull_request' - id: verify-changed-files run: | - if [ -n "$(git status --porcelain)" ]; then - echo "changed=true" >> $GITHUB_OUTPUT - else - echo "changed=false" >> $GITHUB_OUTPUT - fi - - - name: Check for formatting changes - # Fail if code needs formatting (instead of auto-creating PR) - if: github.event_name != 'pull_request' && steps.verify-changed-files.outputs.changed == 'true' - run: | - echo "❌ Code formatting required!" - echo "" - echo "The following files need formatting:" - git status --porcelain - echo "" - echo "Please run the following commands locally:" - echo " black semantica/" - echo " isort semantica/" - echo "" - echo "Then commit and push the changes." - exit 1 + black semantica/ + isort semantica/ + - name: Create PR + if: github.event_name != 'pull_request' + uses: peter-evans/create-pull-request@v5 + with: + commit-message: "Auto-format code" + title: "Auto-format code" + branch: format/auto-format + delete-branch: true diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index c616983e..c962e98e 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -1,7 +1,7 @@ name: Security Scan -# This workflow scans for security vulnerabilities -# It runs on pushes, pull requests, and weekly on Mondays +# Scans dependencies and code for security vulnerabilities +# Runs on push, PR, weekly schedule, and manual trigger on: push: @@ -9,7 +9,7 @@ on: pull_request: branches: [main, develop] schedule: - - cron: '0 0 * * 1' # Weekly on Monday + - cron: '0 0 * * 1' workflow_dispatch: permissions: @@ -17,23 +17,15 @@ permissions: security-events: write jobs: - # Job 1: Check Dependencies for Vulnerabilities dependency-scan: - name: Dependency Security Scan runs-on: ubuntu-latest steps: - - name: Checkout code - uses: actions/checkout@v4 + - uses: actions/checkout@v4 - - name: Free Disk Space (Ubuntu) + - name: Free Disk Space uses: jlumbroso/free-disk-space@main with: - # this might remove tools that are actually needed, - # if set to "true" but frees about 6GB tool-cache: false - - # all of these default to true, but feel free to set to - # "false" if necessary for your workflow android: true dotnet: true haskell: true @@ -41,55 +33,24 @@ jobs: docker-images: true swap-storage: true - - name: Set up Python - uses: actions/setup-python@v5 + - uses: actions/setup-python@v5 with: python-version: '3.11' - - name: Install security tools - run: | - python -m pip install --upgrade pip + - run: | pip install safety pip-audit - - - name: Install project dependencies - run: | pip install -e ".[dev]" - - name: Run pip-audit - # Checks if any installed packages have known vulnerabilities - run: | - echo "Running pip-audit security scan..." - pip-audit --format json --output pip-audit-report.json - - - name: Run safety check - # Another tool to check for vulnerabilities - run: | - echo "Running safety security check..." - safety check --output json > safety-report.json + - run: pip-audit + - run: safety check continue-on-error: true - - name: Upload security reports - # Save the reports so you can download them later - if: always() - uses: actions/upload-artifact@v4 - with: - name: security-reports - path: | - pip-audit-report.json - safety-report.json - retention-days: 30 - - # Job 2: Scan Code for Vulnerabilities code-scan: - name: Code Security Scan runs-on: ubuntu-latest steps: - - name: Checkout code - uses: actions/checkout@v4 + - uses: actions/checkout@v4 - - name: Run Trivy vulnerability scanner - # Scans the file system for vulnerabilities - uses: aquasecurity/trivy-action@master + - uses: aquasecurity/trivy-action@master with: scan-type: 'fs' scan-ref: '.' @@ -97,13 +58,8 @@ jobs: output: 'trivy-results.sarif' severity: 'CRITICAL,HIGH' - - name: Upload Trivy results to GitHub Security - # Shows results in the "Security" tab of your repo + - uses: github/codeql-action/upload-sarif@v3 if: always() && hashFiles('trivy-results.sarif') != '' - uses: github/codeql-action/upload-sarif@v3 with: sarif_file: 'trivy-results.sarif' continue-on-error: true - - -