Add GitHub Actions CI (lint, egress-isolation, tests + coverage)#3
Merged
Merged
Conversation
.github/workflows/ci.yml runs on push to master and every pull request: - lint: `pre-commit run --all-files` (ruff, markdownlint, the Mermaid validator, and hygiene hooks) with a cached hook environment. - egress-isolation: a new static gate (scripts/check_egress_isolation.py) that fails the build if a data server — calibration-tracker, evidence-ledger, ach-engine, or the shared common/staleness helpers — gains a direct network import. Realizes Phase-4 control #1 (osint-toolkit is the sole egress surface); osint-toolkit is exempt. - test: pytest on Python 3.11, 3.12, and 3.13, installing the latest deps. Least-privilege permissions (contents: read) and per-ref concurrency cancellation. Adds a CI badge and a CI note to the README. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fd4FtxJFV2fVSSoD7urqqn
- The test matrix gains Python 3.14 as an experimental, continue-on-error entry (setup-python allow-prereleases). It is exercised on real runners but does not gate the build until its dependency wheels are confirmed — promote it to required by dropping `experimental`. - pytest now runs under coverage (pytest-cov). A fail_under=80 floor guards against regression (current line coverage ~85%); CI prints the per-file term-missing report. Config lives in pyproject [tool.coverage.*], omitting the thin __main__.py entry-point shims. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fd4FtxJFV2fVSSoD7urqqn
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds continuous integration (builds on the pre-commit + Mermaid setup from #2, already on
master)..github/workflows/ci.ymlruns on push tomasterand every pull request:pre-commit run --all-filesscripts/check_egress_isolation.pycommon/staleness) gains a direct network import.osint-toolkit(the sole egress surface) is exempt.pyteston Python 3.11 / 3.12 / 3.13 (+ 3.14 preview) under coveragecontinue-on-erroruntil its dependency wheels are confirmedCoverage
pytest-covwith afail_under = 80floor (config inpyproject.toml, omitting the thin__main__.pyshims); current line coverage is ~85%. CI prints the per-fileterm-missingreport.Hardening
Least-privilege
permissions: contents: readand per-ref concurrency cancellation. Adds a CI badge and a CI note to the README.Verified locally
import socketin a data server, and correctly exemptsosint-toolkit.🤖 Generated with Claude Code
https://claude.ai/code/session_01Fd4FtxJFV2fVSSoD7urqqn
Generated by Claude Code