Public Access
Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 gitea-actions-bot
|
6d3622465e | ||
 emil
|
8633980062 | ||
|
gitea-actions-bot
|
693e7962da | ||
|
devx-ci-bot
|
9408111088 | ||
|
emil
|
349057bf5d | ||
|
gitea-actions-bot
|
3b2a278f87 | ||
|
devx-ci-bot
|
127f781076 | ||
 kireto
|
d41972093b | ||
|
gitea-actions-bot
|
5e0befe777 |
+25
-13
@@ -33,21 +33,40 @@ jobs:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
# Implements: REQ-1 (DEVX-176) — docs-only changes skip the heavy
|
||||
# quality steps. Detection needs only git, so it runs before setup.
|
||||
- name: Detect docs-only change
|
||||
id: docs-only
|
||||
if: github.event_name == 'pull_request'
|
||||
run: |
|
||||
HEAD="${{ github.event.pull_request.head.sha || github.sha }}"
|
||||
DOCS_ONLY=true
|
||||
while IFS= read -r f; do
|
||||
case "$f" in
|
||||
docs/*|*.md|.devin/*) ;;
|
||||
*) DOCS_ONLY=false; break;;
|
||||
esac
|
||||
done < <(git diff --name-only "origin/master...$HEAD")
|
||||
echo "docs-only=$DOCS_ONLY" >> "$GITHUB_OUTPUT"
|
||||
echo "docs-only=$DOCS_ONLY"
|
||||
- name: Set up environment
|
||||
env:
|
||||
CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
|
||||
run: make setup-image
|
||||
# --- quality steps ---
|
||||
- name: Lint all
|
||||
if: steps.docs-only.outputs.docs-only != 'true'
|
||||
run: |
|
||||
. .venv/bin/activate 2>/dev/null || true
|
||||
export PATH="$HOME/.local/bin:$PATH"
|
||||
make lint-all
|
||||
- name: Unit tests with 100% coverage
|
||||
if: steps.docs-only.outputs.docs-only != 'true'
|
||||
run: |
|
||||
. .venv/bin/activate 2>/dev/null || true
|
||||
make pytest-cov
|
||||
- name: Check unit test speed
|
||||
if: steps.docs-only.outputs.docs-only != 'true'
|
||||
run: |
|
||||
. .venv/bin/activate 2>/dev/null || true
|
||||
python3 -m devx.tools.check_test_speed --max-seconds 15 --max-single-seconds 0.5
|
||||
@@ -60,10 +79,12 @@ jobs:
|
||||
export PATH="$HOME/.local/bin:$PATH"
|
||||
make devx-docs-check
|
||||
- name: Translation completeness check
|
||||
if: steps.docs-only.outputs.docs-only != 'true'
|
||||
run: |
|
||||
. .venv/bin/activate 2>/dev/null || true
|
||||
python3 -m devx.ci.check_translations
|
||||
- name: Dependency security scan
|
||||
if: steps.docs-only.outputs.docs-only != 'true'
|
||||
run: |
|
||||
. .venv/bin/activate 2>/dev/null || true
|
||||
# Install pip in venv if missing (needed by pip-audit)
|
||||
@@ -71,6 +92,7 @@ jobs:
|
||||
PIPAPI_PYTHON_LOCATION=$PWD/.venv/bin/python \
|
||||
pip-audit --desc --skip-editable 2>&1 || true
|
||||
- name: Workflow dry-run validation
|
||||
if: steps.docs-only.outputs.docs-only != 'true'
|
||||
run: |
|
||||
. .venv/bin/activate 2>/dev/null || true
|
||||
export PATH="$HOME/.local/bin:$PATH"
|
||||
@@ -137,19 +159,9 @@ jobs:
|
||||
. .venv/bin/activate 2>/dev/null || true
|
||||
export PATH="$HOME/.local/bin:$PATH"
|
||||
python3 -m devx.ci.release --dry-run
|
||||
- name: Notify on failure
|
||||
if: failure()
|
||||
env:
|
||||
CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
|
||||
run: |
|
||||
. .venv/bin/activate 2>/dev/null || true
|
||||
export PATH="$HOME/.local/bin:$PATH"
|
||||
python3 -m devx.ci.notify_failure \
|
||||
--repo "${{ github.repository }}" \
|
||||
--run-id "${{ github.run_id }}" \
|
||||
--workflow "ci/validate" \
|
||||
--commit "${{ github.sha }}" \
|
||||
--auto-login
|
||||
# Implements: REQ-2 (DEVX-176) — no failure-issue step in PR CI;
|
||||
# auto-created issues are for deploy-pipeline failures only
|
||||
# (post-merge keeps its notification).
|
||||
|
||||
auto-merge:
|
||||
# Auto-merge runs after validate passes. It reads the task ID
|
||||
|
||||
@@ -24,7 +24,9 @@ on:
|
||||
|
||||
concurrency:
|
||||
group: post-merge-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
# Implements: REQ-3 (DEVX-176) — queue instead of killing an in-flight
|
||||
# release/publish; a cancelled release can leave tag-without-publish.
|
||||
cancel-in-progress: false
|
||||
|
||||
env:
|
||||
PIP_BREAK_SYSTEM_PACKAGES: "1"
|
||||
|
||||
@@ -2,6 +2,18 @@
|
||||
|
||||
All notable changes to this project will be documented in this file.
|
||||
|
||||
## [0.55.3] - 2026-09-21
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
- Honor repo bandit config in badge quality check
|
||||
|
||||
## [0.55.2] - 2026-09-19
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
- *(ci)* Supply git identity for dep-PR manifest commits
|
||||
|
||||
## [0.55.1] - 2026-09-19
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
@@ -16,12 +16,12 @@ quality badges.
|
||||
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
|
||||
[](https://www.python.org/downloads/)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
|
||||
[](https://www.python.org/downloads/)
|
||||
|
||||
## Why devx?
|
||||
|
||||
@@ -87,7 +87,7 @@ extra index and list devx in your dependencies:
|
||||
```toml
|
||||
[project]
|
||||
dependencies = [
|
||||
"devx>=0.55.1",
|
||||
"devx>=0.55.3",
|
||||
]
|
||||
|
||||
[tool.pip]
|
||||
@@ -101,8 +101,8 @@ pip install -e .
|
||||
```
|
||||
|
||||
> **Note:** If your project requires a specific devx version, pin it in
|
||||
> `dependencies` (for example, `"devx==0.55.1"`) or use a version constraint
|
||||
> (for example, `"devx>=0.55.1,<0.56"`).
|
||||
> `dependencies` (for example, `"devx==0.55.3"`) or use a version constraint
|
||||
> (for example, `"devx>=0.55.3,<0.56"`).
|
||||
|
||||
### Optional extras
|
||||
|
||||
|
||||
+8
-8
@@ -12,12 +12,12 @@ project to be reusable across all oblachno-oss repositories.
|
||||
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
|
||||
[](https://www.python.org/downloads/)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
|
||||
[](https://www.python.org/downloads/)
|
||||
|
||||
## Overview
|
||||
|
||||
@@ -74,14 +74,14 @@ Add devx to your `pyproject.toml` dependencies and configure the registry:
|
||||
```toml
|
||||
[project]
|
||||
dependencies = [
|
||||
"devx>=0.55.1",
|
||||
"devx>=0.55.3",
|
||||
]
|
||||
|
||||
[tool.pip]
|
||||
extra-index-url = "https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple"
|
||||
```
|
||||
|
||||
Pin a specific version if needed: `"devx==0.55.1"` or `"devx>=0.55.1,<0.56"`.
|
||||
Pin a specific version if needed: `"devx==0.55.3"` or `"devx>=0.55.3,<0.56"`.
|
||||
|
||||
### Optional extras
|
||||
|
||||
|
||||
@@ -0,0 +1,31 @@
|
||||
# DEVX-174: Set git identity in dep-PR target clone
|
||||
|
||||
## Problem
|
||||
|
||||
`create_dependency_pr` commits the manifest bump in a fresh clone of the
|
||||
target repo. The clone has no `user.name`/`user.email`, so `git commit`
|
||||
exits 128 ("Please tell me who you are") — observed in sso-bridge
|
||||
post-merge run 6284 after the digest and manifest bump both succeeded.
|
||||
|
||||
## Approach
|
||||
|
||||
REQ-1: Pass a CI bot identity inline (`git -c user.name=... -c
|
||||
user.email=... commit`) so the commit works in any environment without
|
||||
mutating global git config.
|
||||
|
||||
## Test Plan
|
||||
|
||||
- Unit test asserting the commit invocation carries `-c user.name` /
|
||||
`-c user.email` arguments.
|
||||
|
||||
## Deploy Plan
|
||||
|
||||
devx release; sso-bridge picks it up via its devx pin on next bump.
|
||||
|
||||
## Rollback Plan
|
||||
|
||||
Revert; dep-PR commit fails again in containers without git identity.
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [x] REQ-1: dep-PR commit supplies explicit identity flags.
|
||||
@@ -0,0 +1,40 @@
|
||||
# DEVX-175: Badge generation must honor repo bandit configuration
|
||||
|
||||
## Problem
|
||||
|
||||
`collect_quality()` in `generate_badges.py` runs `bandit -r src/` with no
|
||||
config file. Repos that declare a `[tool.bandit]` section in
|
||||
`pyproject.toml` (skip lists aligned with infrastructure patterns — for
|
||||
example sso-bridge skips B404/B603/B501) lint clean via `make lint-all`, but the
|
||||
quality badge still reports `bandit: FAIL` — a false-FAIL badge that
|
||||
contradicts the actual lint gate.
|
||||
|
||||
## Approach
|
||||
|
||||
REQ-1: When `pyproject.toml` exists in the target repo and contains a
|
||||
`[tool.bandit]` section, pass `-c pyproject.toml` to the bandit invocation
|
||||
in `collect_quality()`.
|
||||
|
||||
REQ-2: Repos without `[tool.bandit]` keep the current invocation unchanged.
|
||||
|
||||
## Test Plan
|
||||
|
||||
- Unit test: repo fixture with `[tool.bandit]` → command includes
|
||||
`-c pyproject.toml`; without the section → plain invocation.
|
||||
- Manual: `python -m devx.tools.generate_badges` in sso-bridge reports
|
||||
`bandit: pass`.
|
||||
|
||||
## Deploy Plan
|
||||
|
||||
devx release → repos pick it up on next devx pin bump; no infra changes.
|
||||
|
||||
## Rollback Plan
|
||||
|
||||
Revert the commit; badges revert to unconfigured bandit runs.
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [x] REQ-1 implemented with `# Implements: REQ-1` comment
|
||||
- [x] REQ-2 preserved (no config → unchanged command)
|
||||
- [x] Unit tests cover both branches
|
||||
- [x] `make lint-all` + `make pytest-cov` pass in devx
|
||||
@@ -0,0 +1,43 @@
|
||||
# DEVX-176: CI hygiene — docs fast-path, failure-notify scoping, post-merge cancel
|
||||
|
||||
## Problem
|
||||
|
||||
devx CI has the same inefficiencies fixed in infra (OBL-INFRA-613/615/616):
|
||||
docs-only PRs run the full quality suite (~10 min), CI failures auto-create
|
||||
issues (noise — the user decided issues are for deploy failures only), and
|
||||
post-merge `cancel-in-progress: true` can kill a release mid-publish.
|
||||
|
||||
## Approach
|
||||
|
||||
REQ-1: Docs-only PRs skip heavy validate steps (lint-all, unit tests,
|
||||
test-speed, translation check, security scan, workflow dry-run). Docs gate,
|
||||
spec validation, PR size, and auto-merge preconditions still run.
|
||||
Restricted to pull_request events.
|
||||
|
||||
REQ-2: Remove the failure-issue step from `ci.yml` validate job.
|
||||
Post-merge keeps failure notification (release/publish failures are
|
||||
deploy-pipeline events).
|
||||
|
||||
REQ-3: post-merge `cancel-in-progress: false` — a new push queues instead
|
||||
of killing an in-flight release/publish.
|
||||
|
||||
## Test Plan
|
||||
|
||||
- `make workflow-lint` passes.
|
||||
- Docs-only PR: quality steps skipped, docs gate + spec + size + merge run.
|
||||
- Non-docs PR: unchanged behavior.
|
||||
|
||||
## Deploy Plan
|
||||
|
||||
Workflow-only change; takes effect on merge. No release needed.
|
||||
|
||||
## Rollback Plan
|
||||
|
||||
Revert the commit.
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [x] REQ-1 implemented — early docs-only step + step-level `if` gates
|
||||
- [x] REQ-2 implemented — notify step removed from ci.yml only
|
||||
- [x] REQ-3 implemented — post-merge concurrency flipped
|
||||
- [x] `make workflow-lint` passes
|
||||
@@ -48,12 +48,12 @@ Add devx to your `pyproject.toml`:
|
||||
```toml
|
||||
[project]
|
||||
dependencies = [
|
||||
"devx>=0.55.1",
|
||||
"devx>=0.55.3",
|
||||
]
|
||||
|
||||
[project.optional-dependencies]
|
||||
dev = [
|
||||
"devx>=0.55.1",
|
||||
"devx>=0.55.3",
|
||||
]
|
||||
```
|
||||
|
||||
|
||||
@@ -6,4 +6,4 @@ create_dependency_pr, auto_merge, release, publish), developer tooling
|
||||
molecule testing helpers for Ansible projects.
|
||||
"""
|
||||
|
||||
__version__ = "0.55.1"
|
||||
__version__ = "0.55.3"
|
||||
|
||||
@@ -505,7 +505,22 @@ def cli(
|
||||
add_files.append(spec_rel)
|
||||
subprocess.run(["git", "add", *add_files], check=True, cwd=workdir) # nosec B603 B607
|
||||
commit_msg = f"deps: bump {package} from {old_version} to {new_version}"
|
||||
subprocess.run(["git", "commit", "-m", commit_msg], check=True, cwd=workdir) # nosec B603 B607
|
||||
# Implements: REQ-1 — the fresh clone has no git identity in CI
|
||||
# containers; supply it inline (same bot identity as push_badges).
|
||||
subprocess.run( # nosec B603 B607
|
||||
[
|
||||
"git",
|
||||
"-c",
|
||||
"user.name=gitea-actions-bot",
|
||||
"-c",
|
||||
"user.email=actions@oblachno.fyi",
|
||||
"commit",
|
||||
"-m",
|
||||
commit_msg,
|
||||
],
|
||||
check=True,
|
||||
cwd=workdir,
|
||||
)
|
||||
subprocess.run( # nosec B603 B607
|
||||
["git", "-c", auth_cfg, "push", "origin", branch_name],
|
||||
check=True,
|
||||
|
||||
@@ -346,11 +346,18 @@ def collect_quality(repo_root: Path) -> dict[str, str | int]:
|
||||
results: list[bool] = []
|
||||
tool_names: list[str] = []
|
||||
|
||||
# Implements: REQ-1 (DEVX-175) — honor the repo's [tool.bandit] config so
|
||||
# the badge matches the project's actual lint gate (skip lists etc.).
|
||||
bandit_cmd = [sys.executable, "-m", "bandit", "-r", "src/"]
|
||||
pyproject = repo_root / "pyproject.toml"
|
||||
if pyproject.exists() and "[tool.bandit]" in pyproject.read_text():
|
||||
bandit_cmd += ["-c", "pyproject.toml"]
|
||||
|
||||
for cmd, name in [
|
||||
([sys.executable, "-m", "ruff", "check", "src/", "tests/"], "ruff check"),
|
||||
([sys.executable, "-m", "ruff", "format", "--check", "src/", "tests/"], "ruff format"),
|
||||
([sys.executable, "-m", "pyright"], "pyright"),
|
||||
([sys.executable, "-m", "bandit", "-r", "src/"], "bandit"),
|
||||
(bandit_cmd, "bandit"),
|
||||
]:
|
||||
rc, _stdout, stderr = run_command(cmd, cwd=repo_root)
|
||||
if rc == 0:
|
||||
|
||||
@@ -661,6 +661,10 @@ class TestBranchCreation:
|
||||
# PR title carries the task ID
|
||||
assert client.create_pr.call_args.kwargs["title"] == "OBL-INFRA-581: Bump sso_bridge to 0.9.1"
|
||||
mock_task.assert_called_once()
|
||||
# Commit supplies an explicit identity (fresh clones have none)
|
||||
commit = next(c for c in subprocess.run.call_args_list if "commit" in c.args[0])
|
||||
assert "user.name=gitea-actions-bot" in commit.args[0]
|
||||
assert "user.email=actions@oblachno.fyi" in commit.args[0]
|
||||
|
||||
def test_retries_404_until_published(self) -> None:
|
||||
import requests
|
||||
|
||||
@@ -365,6 +365,23 @@ class TestCollectQuality:
|
||||
badge = collect_quality(tmp_path)
|
||||
assert badge["message"] == "A"
|
||||
|
||||
@patch("devx.tools.generate_badges.run_command")
|
||||
def test_bandit_uses_repo_config_when_present(self, mock_run: MagicMock, tmp_path: Path) -> None: # type: ignore[no-untyped-def]
|
||||
(tmp_path / "pyproject.toml").write_text("[tool.bandit]\nskips = ['B501']\n")
|
||||
mock_run.return_value = (0, "", "")
|
||||
collect_quality(tmp_path)
|
||||
bandit_call = [c for c in mock_run.call_args_list if "bandit" in c.args[0]][0]
|
||||
assert "-c" in bandit_call.args[0]
|
||||
assert "pyproject.toml" in bandit_call.args[0]
|
||||
|
||||
@patch("devx.tools.generate_badges.run_command")
|
||||
def test_bandit_plain_invocation_without_repo_config(self, mock_run: MagicMock, tmp_path: Path) -> None: # type: ignore[no-untyped-def]
|
||||
(tmp_path / "pyproject.toml").write_text("[project]\nname = 'x'\n")
|
||||
mock_run.return_value = (0, "", "")
|
||||
collect_quality(tmp_path)
|
||||
bandit_call = [c for c in mock_run.call_args_list if "bandit" in c.args[0]][0]
|
||||
assert "-c" not in bandit_call.args[0]
|
||||
|
||||
|
||||
class TestGenerateBadges:
|
||||
@patch("devx.tools.generate_badges.collect_quality")
|
||||
|
||||
Reference in New Issue
Block a user