fix: pin MCQ OK/Cancel in Adw bottom bar (#15) #61
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Public OSS CI. | |
| # - test: GitHub-hosted ubuntu (needs apt Gtk4/Adw; DD self-hosted has no sudo) | |
| # - secrets-hygiene / sbom / audit: DynamicDevices self-hosted Linux for same-repo; | |
| # external fork PRs use ubuntu-latest (do not run untrusted fork code on lab runners) | |
| name: ci | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Install Gtk4 / Adw GI (dialog stack) | |
| run: | | |
| sudo apt-get update -qq | |
| sudo apt-get install -y -qq \ | |
| python3-gi gir1.2-gtk-4.0 gir1.2-adw-1 zenity | |
| - uses: astral-sh/setup-uv@v7 | |
| with: | |
| enable-cache: true | |
| - name: Sync + unit / contract tests | |
| run: | | |
| uv sync | |
| uv run python scripts/test_match_transcript.py | |
| uv run python scripts/test_doctor.py | |
| uv run python scripts/test_acks.py | |
| uv run python scripts/test_windows_backend.py | |
| uv run python scripts/test_contracts.py | |
| - name: Import package | |
| run: uv run python -c "import ask_question_mcp; print('ok')" | |
| secrets-hygiene: | |
| runs-on: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && fromJSON('["self-hosted","Linux"]') || 'ubuntu-latest' }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Block lab IPs and home paths in tracked text | |
| run: | | |
| set -euo pipefail | |
| # Pattern is split so this workflow file does not self-match. | |
| pat1='192\.168\.68\.55' | |
| pat2='/home/aj'"lennon" | |
| pat3='CF-Access-Client-Secret' | |
| pat4='X-API-Key:' | |
| bad=$(git grep -I -nE "${pat1}|${pat2}|${pat3}|${pat4}" -- \ | |
| ':!*.wav' ':!uv.lock' ':!.github/workflows/ci.yml' || true) | |
| if [ -n "$bad" ]; then | |
| echo "$bad" | |
| echo "::error::Forbidden private path/IP/secret pattern in tree" | |
| exit 1 | |
| fi | |
| echo "hygiene ok" | |
| sbom: | |
| runs-on: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && fromJSON('["self-hosted","Linux"]') || 'ubuntu-latest' }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: astral-sh/setup-uv@v7 | |
| with: | |
| enable-cache: true | |
| - name: Generate CycloneDX SBOM from lockfile | |
| run: | | |
| set -euo pipefail | |
| uv sync | |
| uv export --format requirements-txt --no-hashes --no-emit-project \ | |
| -o requirements-export.txt | |
| uvx --from cyclonedx-bom cyclonedx-py requirements requirements-export.txt \ | |
| -o sbom.cdx.json --of JSON | |
| test -s sbom.cdx.json | |
| python3 -c "import json; d=json.load(open('sbom.cdx.json')); print(d.get('bomFormat'), len(d.get('components') or []))" | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: sbom-cyclonedx | |
| path: sbom.cdx.json | |
| # Dependency vulnerability scan (CRA hygiene). | |
| # Fails on reported vulns — bump uv.lock rather than ignore. | |
| audit: | |
| runs-on: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && fromJSON('["self-hosted","Linux"]') || 'ubuntu-latest' }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: astral-sh/setup-uv@v7 | |
| with: | |
| enable-cache: true | |
| - name: pip-audit against uv.lock | |
| run: | | |
| set -euo pipefail | |
| uv sync | |
| uv export --format requirements-txt --no-hashes --no-emit-project \ | |
| -o requirements-export.txt | |
| uvx --python 3.12 pip-audit -r requirements-export.txt \ | |
| --progress-spinner off --disable-pip --no-deps |