Repository navigation
build(deps): bump pydantic-settings from 2.14.2 to 2.15.0 in /mauverse-api #169
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: MAUverce CI | |
| on: | |
| push: | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| DOTNET_CLI_TELEMETRY_OPTOUT: "1" | |
| DOTNET_NOLOGO: "1" | |
| PIP_DISABLE_PIP_VERSION_CHECK: "1" | |
| jobs: | |
| backend: | |
| name: Backend tests and static checks | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 15 | |
| defaults: | |
| run: | |
| working-directory: mauverse-api | |
| steps: | |
| - name: Check out sources | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| - name: Set up Python | |
| uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: "3.11" | |
| cache: pip | |
| cache-dependency-path: | | |
| mauverse-api/requirements.txt | |
| mauverse-api/requirements-dev.txt | |
| - name: Install dependencies | |
| run: python -m pip install --requirement requirements-dev.txt | |
| - name: Verify dependency consistency | |
| run: python -m pip check | |
| - name: Run tests | |
| run: python -m unittest discover -s tests -v | |
| - name: Run Ruff | |
| run: ruff check . | |
| - name: Compile Python sources | |
| run: python -m compileall -q apps tests main.py | |
| api-image: | |
| name: API container smoke test | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 20 | |
| steps: | |
| - name: Check out sources | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| - name: Build image | |
| run: docker build --pull --tag mauverce-api:ci mauverse-api | |
| - name: Verify non-root runtime and health | |
| shell: bash | |
| run: | | |
| docker run --rm --entrypoint python mauverce-api:ci \ | |
| -c "import os; raise SystemExit(0 if os.geteuid() != 0 else 1)" | |
| container_id="$(docker run --detach \ | |
| --env SCHEDULE_DB_USER=test \ | |
| --env SCHEDULE_DB_PASSWORD=test \ | |
| --env DEBT_DB_USER=test \ | |
| --env DEBT_DB_PASSWORD=test \ | |
| mauverce-api:ci)" | |
| cleanup() { | |
| docker logs "$container_id" || true | |
| docker rm --force "$container_id" >/dev/null 2>&1 || true | |
| } | |
| trap cleanup EXIT | |
| for attempt in {1..30}; do | |
| running="$(docker inspect --format '{{.State.Running}}' "$container_id")" | |
| health="$(docker inspect --format '{{.State.Health.Status}}' "$container_id")" | |
| if [[ "$health" == "healthy" ]]; then | |
| exit 0 | |
| fi | |
| if [[ "$running" != "true" || "$health" == "unhealthy" ]]; then | |
| exit 1 | |
| fi | |
| sleep 2 | |
| done | |
| echo "Container did not become healthy within 60 seconds" >&2 | |
| exit 1 | |
| android-release: | |
| name: Android Release configuration | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 45 | |
| env: | |
| NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages | |
| defaults: | |
| run: | |
| working-directory: mauverse_mobile | |
| steps: | |
| - name: Check out sources | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| - name: Set up .NET SDK from global.json | |
| uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5 | |
| with: | |
| global-json-file: mauverse_mobile/global.json | |
| - name: Set up JDK | |
| uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5 | |
| with: | |
| distribution: temurin | |
| java-version: "17" | |
| - name: Restore NuGet cache | |
| uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5 | |
| with: | |
| path: ${{ env.NUGET_PACKAGES }} | |
| key: ${{ runner.os }}-nuget-${{ hashFiles('mauverse_mobile/global.json', 'mauverse_mobile/mau.csproj', 'mauverse_mobile.Tests/mauverse_mobile.Tests.csproj') }} | |
| restore-keys: | | |
| ${{ runner.os }}-nuget- | |
| - name: Install MAUI Android workload | |
| run: dotnet workload install maui-android --skip-manifest-update | |
| - name: Restore projects | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| dotnet restore mau.sln | |
| dotnet restore mau.csproj --runtime android-arm64 | |
| - name: Run mobile unit tests | |
| run: dotnet test ../mauverse_mobile.Tests/mauverse_mobile.Tests.csproj --configuration Release --no-restore --warnaserror | |
| - name: Build Release configuration | |
| run: >- | |
| dotnet build mau.csproj | |
| --configuration Release | |
| --framework net10.0-android | |
| --runtime android-arm64 | |
| --no-restore | |
| --warnaserror | |
| -p:ContinuousIntegrationBuild=true | |
| -maxcpucount:1 | |
| - name: Create unsigned artifact checksums | |
| shell: bash | |
| run: | | |
| mapfile -t artifacts < <(find bin/Release/net10.0-android \ | |
| -type f \( -name '*.aab' -o \( -name '*.apk' ! -name '*-Signed.apk' \) \) \ | |
| -print | sort) | |
| test "${#artifacts[@]}" -ge 2 | |
| sha256sum "${artifacts[@]}" > bin/Release/net10.0-android/checksums.txt | |
| - name: Upload unsigned CI artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: mauverce-android-release-unsigned | |
| path: | | |
| mauverse_mobile/bin/Release/net10.0-android/**/*.apk | |
| !mauverse_mobile/bin/Release/net10.0-android/**/*-Signed.apk | |
| mauverse_mobile/bin/Release/net10.0-android/**/*.aab | |
| mauverse_mobile/bin/Release/net10.0-android/checksums.txt | |
| if-no-files-found: error | |
| retention-days: 14 | |
| compression-level: 0 | |
| ios-release-unsigned: | |
| name: Native SwiftUI iPhone Release (unsigned) | |
| runs-on: macos-26 | |
| timeout-minutes: 35 | |
| env: | |
| MAUVERSE_SCHEDULE_TOKEN: ${{ secrets.MAUVERSE_SCHEDULE_TOKEN }} | |
| steps: | |
| - name: Check out sources | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| - name: Select Xcode 26.5 | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| developer_dir="/Applications/Xcode_26.5.app/Contents/Developer" | |
| test -d "$developer_dir" | |
| sudo xcode-select --switch "$developer_dir" | |
| - name: Install project generator | |
| run: brew install xcodegen | |
| - name: Generate native Xcode project | |
| working-directory: MauverseIOS | |
| run: xcodegen generate --spec project.yml | |
| - name: Report Apple toolchain and project | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| xcodebuild -version | |
| xcrun --sdk iphoneos --show-sdk-version | |
| xcodegen --version | |
| xcodebuild -project MauverseIOS/MAUverse.xcodeproj -list | |
| - name: Build native iPhone application without signing | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| test -n "$MAUVERSE_SCHEDULE_TOKEN" | |
| xcodebuild \ | |
| -project MauverseIOS/MAUverse.xcodeproj \ | |
| -scheme MAUverse \ | |
| -configuration Release \ | |
| -sdk iphoneos \ | |
| -destination 'generic/platform=iOS' \ | |
| -derivedDataPath "$PWD/build/DerivedData" \ | |
| CODE_SIGNING_ALLOWED=NO \ | |
| CODE_SIGNING_REQUIRED=NO \ | |
| CODE_SIGN_IDENTITY="" \ | |
| DEVELOPMENT_TEAM="" \ | |
| MAUVERSE_SCHEDULE_TOKEN="$MAUVERSE_SCHEDULE_TOKEN" \ | |
| clean build | |
| - name: Verify and package unsigned application | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| products_dir="build/DerivedData/Build/Products/Release-iphoneos" | |
| app_path="$(find "$products_dir" -maxdepth 1 -type d -name '*.app' -print -quit)" | |
| test -n "$app_path" | |
| if codesign --verify "$app_path" >/dev/null 2>&1; then | |
| echo "Refusing to upload a signed iOS application." >&2 | |
| exit 1 | |
| fi | |
| signing_material="$(find "$app_path" \ | |
| \( -type d -name '_CodeSignature' -o -type f -name 'embedded.mobileprovision' \) \ | |
| -print -quit)" | |
| if [[ -n "$signing_material" ]]; then | |
| echo "Signing material was found: $signing_material" >&2 | |
| exit 1 | |
| fi | |
| artifact_dir="build/unsigned-artifact" | |
| payload_dir="$artifact_dir/Payload" | |
| mkdir -p "$payload_dir" | |
| ditto "$app_path" "$payload_dir/$(basename "$app_path")" | |
| ( | |
| cd "$artifact_dir" | |
| /usr/bin/zip -qry "../mauverse-native-ios-arm64-unsigned.ipa" Payload | |
| ) | |
| { | |
| echo "commit=${GITHUB_SHA}" | |
| echo "target=native-swiftui" | |
| echo "runtime=ios-arm64" | |
| echo "signed=false" | |
| echo "provisioning_profile=false" | |
| echo "xcode=$(xcodebuild -version | tr '\n' ' ')" | |
| echo "iphoneos_sdk=$(xcrun --sdk iphoneos --show-sdk-version)" | |
| } > "build/build-metadata.txt" | |
| ( | |
| cd build | |
| shasum -a 256 mauverse-native-ios-arm64-unsigned.ipa > checksums.txt | |
| ) | |
| - name: Upload unsigned iPhone artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: mauverse-native-ios-arm64-release-unsigned | |
| path: | | |
| build/mauverse-native-ios-arm64-unsigned.ipa | |
| build/checksums.txt | |
| build/build-metadata.txt | |
| if-no-files-found: error | |
| retention-days: 14 | |
| compression-level: 0 |