Public Access
Compare commits
4
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Emil Simeonov
|
85a36d42cd | ||
|
Emil Simeonov
|
454fbaf56a | ||
 emil
|
349057bf5d | ||
|
gitea-actions-bot
|
3b2a278f87 |
+25
-13
@@ -33,21 +33,40 @@ jobs:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
# Implements: REQ-1 (DEVX-176) — docs-only changes skip the heavy
|
||||
# quality steps. Detection needs only git, so it runs before setup.
|
||||
- name: Detect docs-only change
|
||||
id: docs-only
|
||||
if: github.event_name == 'pull_request'
|
||||
run: |
|
||||
HEAD="${{ github.event.pull_request.head.sha || github.sha }}"
|
||||
DOCS_ONLY=true
|
||||
while IFS= read -r f; do
|
||||
case "$f" in
|
||||
docs/*|*.md|.devin/*) ;;
|
||||
*) DOCS_ONLY=false; break;;
|
||||
esac
|
||||
done < <(git diff --name-only "origin/master...$HEAD")
|
||||
echo "docs-only=$DOCS_ONLY" >> "$GITHUB_OUTPUT"
|
||||
echo "docs-only=$DOCS_ONLY"
|
||||
- name: Set up environment
|
||||
env:
|
||||
CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
|
||||
run: make setup-image
|
||||
# --- quality steps ---
|
||||
- name: Lint all
|
||||
if: steps.docs-only.outputs.docs-only != 'true'
|
||||
run: |
|
||||
. .venv/bin/activate 2>/dev/null || true
|
||||
export PATH="$HOME/.local/bin:$PATH"
|
||||
make lint-all
|
||||
- name: Unit tests with 100% coverage
|
||||
if: steps.docs-only.outputs.docs-only != 'true'
|
||||
run: |
|
||||
. .venv/bin/activate 2>/dev/null || true
|
||||
make pytest-cov
|
||||
- name: Check unit test speed
|
||||
if: steps.docs-only.outputs.docs-only != 'true'
|
||||
run: |
|
||||
. .venv/bin/activate 2>/dev/null || true
|
||||
python3 -m devx.tools.check_test_speed --max-seconds 15 --max-single-seconds 0.5
|
||||
@@ -60,10 +79,12 @@ jobs:
|
||||
export PATH="$HOME/.local/bin:$PATH"
|
||||
make devx-docs-check
|
||||
- name: Translation completeness check
|
||||
if: steps.docs-only.outputs.docs-only != 'true'
|
||||
run: |
|
||||
. .venv/bin/activate 2>/dev/null || true
|
||||
python3 -m devx.ci.check_translations
|
||||
- name: Dependency security scan
|
||||
if: steps.docs-only.outputs.docs-only != 'true'
|
||||
run: |
|
||||
. .venv/bin/activate 2>/dev/null || true
|
||||
# Install pip in venv if missing (needed by pip-audit)
|
||||
@@ -71,6 +92,7 @@ jobs:
|
||||
PIPAPI_PYTHON_LOCATION=$PWD/.venv/bin/python \
|
||||
pip-audit --desc --skip-editable 2>&1 || true
|
||||
- name: Workflow dry-run validation
|
||||
if: steps.docs-only.outputs.docs-only != 'true'
|
||||
run: |
|
||||
. .venv/bin/activate 2>/dev/null || true
|
||||
export PATH="$HOME/.local/bin:$PATH"
|
||||
@@ -137,19 +159,9 @@ jobs:
|
||||
. .venv/bin/activate 2>/dev/null || true
|
||||
export PATH="$HOME/.local/bin:$PATH"
|
||||
python3 -m devx.ci.release --dry-run
|
||||
- name: Notify on failure
|
||||
if: failure()
|
||||
env:
|
||||
CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
|
||||
run: |
|
||||
. .venv/bin/activate 2>/dev/null || true
|
||||
export PATH="$HOME/.local/bin:$PATH"
|
||||
python3 -m devx.ci.notify_failure \
|
||||
--repo "${{ github.repository }}" \
|
||||
--run-id "${{ github.run_id }}" \
|
||||
--workflow "ci/validate" \
|
||||
--commit "${{ github.sha }}" \
|
||||
--auto-login
|
||||
# Implements: REQ-2 (DEVX-176) — no failure-issue step in PR CI;
|
||||
# auto-created issues are for deploy-pipeline failures only
|
||||
# (post-merge keeps its notification).
|
||||
|
||||
auto-merge:
|
||||
# Auto-merge runs after validate passes. It reads the task ID
|
||||
|
||||
@@ -24,7 +24,9 @@ on:
|
||||
|
||||
concurrency:
|
||||
group: post-merge-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
# Implements: REQ-3 (DEVX-176) — queue instead of killing an in-flight
|
||||
# release/publish; a cancelled release can leave tag-without-publish.
|
||||
cancel-in-progress: false
|
||||
|
||||
env:
|
||||
PIP_BREAK_SYSTEM_PACKAGES: "1"
|
||||
|
||||
@@ -16,12 +16,12 @@ quality badges.
|
||||
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
|
||||
[](https://www.python.org/downloads/)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
|
||||
[](https://www.python.org/downloads/)
|
||||
|
||||
## Why devx?
|
||||
|
||||
|
||||
+6
-6
@@ -12,12 +12,12 @@ project to be reusable across all oblachno-oss repositories.
|
||||
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
|
||||
[](https://www.python.org/downloads/)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
|
||||
[](https://www.python.org/downloads/)
|
||||
|
||||
## Overview
|
||||
|
||||
|
||||
@@ -0,0 +1,40 @@
|
||||
# DEVX-175: Badge generation must honor repo bandit configuration
|
||||
|
||||
## Problem
|
||||
|
||||
`collect_quality()` in `generate_badges.py` runs `bandit -r src/` with no
|
||||
config file. Repos that declare a `[tool.bandit]` section in
|
||||
`pyproject.toml` (skip lists aligned with infrastructure patterns — for
|
||||
example sso-bridge skips B404/B603/B501) lint clean via `make lint-all`, but the
|
||||
quality badge still reports `bandit: FAIL` — a false-FAIL badge that
|
||||
contradicts the actual lint gate.
|
||||
|
||||
## Approach
|
||||
|
||||
REQ-1: When `pyproject.toml` exists in the target repo and contains a
|
||||
`[tool.bandit]` section, pass `-c pyproject.toml` to the bandit invocation
|
||||
in `collect_quality()`.
|
||||
|
||||
REQ-2: Repos without `[tool.bandit]` keep the current invocation unchanged.
|
||||
|
||||
## Test Plan
|
||||
|
||||
- Unit test: repo fixture with `[tool.bandit]` → command includes
|
||||
`-c pyproject.toml`; without the section → plain invocation.
|
||||
- Manual: `python -m devx.tools.generate_badges` in sso-bridge reports
|
||||
`bandit: pass`.
|
||||
|
||||
## Deploy Plan
|
||||
|
||||
devx release → repos pick it up on next devx pin bump; no infra changes.
|
||||
|
||||
## Rollback Plan
|
||||
|
||||
Revert the commit; badges revert to unconfigured bandit runs.
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [x] REQ-1 implemented with `# Implements: REQ-1` comment
|
||||
- [x] REQ-2 preserved (no config → unchanged command)
|
||||
- [x] Unit tests cover both branches
|
||||
- [x] `make lint-all` + `make pytest-cov` pass in devx
|
||||
@@ -0,0 +1,43 @@
|
||||
# DEVX-176: CI hygiene — docs fast-path, failure-notify scoping, post-merge cancel
|
||||
|
||||
## Problem
|
||||
|
||||
devx CI has the same inefficiencies fixed in infra (OBL-INFRA-613/615/616):
|
||||
docs-only PRs run the full quality suite (~10 min), CI failures auto-create
|
||||
issues (noise — the user decided issues are for deploy failures only), and
|
||||
post-merge `cancel-in-progress: true` can kill a release mid-publish.
|
||||
|
||||
## Approach
|
||||
|
||||
REQ-1: Docs-only PRs skip heavy validate steps (lint-all, unit tests,
|
||||
test-speed, translation check, security scan, workflow dry-run). Docs gate,
|
||||
spec validation, PR size, and auto-merge preconditions still run.
|
||||
Restricted to pull_request events.
|
||||
|
||||
REQ-2: Remove the failure-issue step from `ci.yml` validate job.
|
||||
Post-merge keeps failure notification (release/publish failures are
|
||||
deploy-pipeline events).
|
||||
|
||||
REQ-3: post-merge `cancel-in-progress: false` — a new push queues instead
|
||||
of killing an in-flight release/publish.
|
||||
|
||||
## Test Plan
|
||||
|
||||
- `make workflow-lint` passes.
|
||||
- Docs-only PR: quality steps skipped, docs gate + spec + size + merge run.
|
||||
- Non-docs PR: unchanged behavior.
|
||||
|
||||
## Deploy Plan
|
||||
|
||||
Workflow-only change; takes effect on merge. No release needed.
|
||||
|
||||
## Rollback Plan
|
||||
|
||||
Revert the commit.
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [x] REQ-1 implemented — early docs-only step + step-level `if` gates
|
||||
- [x] REQ-2 implemented — notify step removed from ci.yml only
|
||||
- [x] REQ-3 implemented — post-merge concurrency flipped
|
||||
- [x] `make workflow-lint` passes
|
||||
@@ -346,11 +346,18 @@ def collect_quality(repo_root: Path) -> dict[str, str | int]:
|
||||
results: list[bool] = []
|
||||
tool_names: list[str] = []
|
||||
|
||||
# Implements: REQ-1 (DEVX-175) — honor the repo's [tool.bandit] config so
|
||||
# the badge matches the project's actual lint gate (skip lists etc.).
|
||||
bandit_cmd = [sys.executable, "-m", "bandit", "-r", "src/"]
|
||||
pyproject = repo_root / "pyproject.toml"
|
||||
if pyproject.exists() and "[tool.bandit]" in pyproject.read_text():
|
||||
bandit_cmd += ["-c", "pyproject.toml"]
|
||||
|
||||
for cmd, name in [
|
||||
([sys.executable, "-m", "ruff", "check", "src/", "tests/"], "ruff check"),
|
||||
([sys.executable, "-m", "ruff", "format", "--check", "src/", "tests/"], "ruff format"),
|
||||
([sys.executable, "-m", "pyright"], "pyright"),
|
||||
([sys.executable, "-m", "bandit", "-r", "src/"], "bandit"),
|
||||
(bandit_cmd, "bandit"),
|
||||
]:
|
||||
rc, _stdout, stderr = run_command(cmd, cwd=repo_root)
|
||||
if rc == 0:
|
||||
|
||||
@@ -365,6 +365,23 @@ class TestCollectQuality:
|
||||
badge = collect_quality(tmp_path)
|
||||
assert badge["message"] == "A"
|
||||
|
||||
@patch("devx.tools.generate_badges.run_command")
|
||||
def test_bandit_uses_repo_config_when_present(self, mock_run: MagicMock, tmp_path: Path) -> None: # type: ignore[no-untyped-def]
|
||||
(tmp_path / "pyproject.toml").write_text("[tool.bandit]\nskips = ['B501']\n")
|
||||
mock_run.return_value = (0, "", "")
|
||||
collect_quality(tmp_path)
|
||||
bandit_call = [c for c in mock_run.call_args_list if "bandit" in c.args[0]][0]
|
||||
assert "-c" in bandit_call.args[0]
|
||||
assert "pyproject.toml" in bandit_call.args[0]
|
||||
|
||||
@patch("devx.tools.generate_badges.run_command")
|
||||
def test_bandit_plain_invocation_without_repo_config(self, mock_run: MagicMock, tmp_path: Path) -> None: # type: ignore[no-untyped-def]
|
||||
(tmp_path / "pyproject.toml").write_text("[project]\nname = 'x'\n")
|
||||
mock_run.return_value = (0, "", "")
|
||||
collect_quality(tmp_path)
|
||||
bandit_call = [c for c in mock_run.call_args_list if "bandit" in c.args[0]][0]
|
||||
assert "-c" not in bandit_call.args[0]
|
||||
|
||||
|
||||
class TestGenerateBadges:
|
||||
@patch("devx.tools.generate_badges.collect_quality")
|
||||
|
||||
Reference in New Issue
Block a user