Skip to content
CI

Add CI, templates, changelog, and secret detection #1

Sign in to view logs

Add CI, templates, changelog, and secret detection

Add CI, templates, changelog, and secret detection #1

Workflow file for this run

.github/workflows/ci.yml at 88cd30b
name: CI
on:
pull_request:
branches: [main]
push:
branches: [main]
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
env:
PYTHON_VERSION: "3.12"
NODE_VERSION: "22"
OMOIOS_ENV: test
jobs:
lint:
name: Lint & Format
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: astral-sh/setup-uv@v4
with:
version: "latest"
- uses: actions/setup-python@v5
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Install dependencies
working-directory: backend
run: uv sync --group test
- name: Ruff check
working-directory: backend
run: uv run ruff check .
- name: Black check
working-directory: backend
run: uv run black --check .
test:
name: Tests
runs-on: ubuntu-latest
services:
postgres:
image: pgvector/pgvector:pg16
env:
POSTGRES_USER: postgres
POSTGRES_PASSWORD: postgres
POSTGRES_DB: omoi_os_test
ports:
- 15432:5432
options: >-
--health-cmd pg_isready
--health-interval 10s
--health-timeout 5s
--health-retries 5
redis:
image: redis:7
ports:
- 16379:6379
options: >-
--health-cmd "redis-cli ping"
--health-interval 10s
--health-timeout 5s
--health-retries 5
steps:
- uses: actions/checkout@v4
- uses: astral-sh/setup-uv@v4
with:
version: "latest"
- uses: actions/setup-python@v5
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Install dependencies
working-directory: backend
run: uv sync --group test
- name: Run migrations
working-directory: backend
env:
DATABASE_URL: postgresql+psycopg://postgres:postgres@localhost:15432/omoi_os_test
REDIS_URL: redis://localhost:16379
run: uv run alembic upgrade head
- name: Run tests
working-directory: backend
env:
DATABASE_URL: postgresql+psycopg://postgres:postgres@localhost:15432/omoi_os_test
REDIS_URL: redis://localhost:16379
run: uv run pytest --no-testmon -x -v
frontend:
name: Frontend Build
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: ${{ env.NODE_VERSION }}
- uses: pnpm/action-setup@v4
with:
version: 9
- name: Install dependencies
working-directory: frontend
run: pnpm install --frozen-lockfile
- name: Lint
working-directory: frontend
run: pnpm lint
- name: Build
working-directory: frontend
run: pnpm build
secrets-scan:
name: Secret Detection
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: actions/setup-python@v5
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Install detect-secrets
run: pip install detect-secrets
- name: Scan for secrets
run: |
detect-secrets scan \
--exclude-files '\.env\.example$' \
--exclude-files '\.lock$' \
--exclude-files 'pnpm-lock\.yaml$' \
--exclude-files 'uv\.lock$' \
--exclude-files '\.venv/' \
--exclude-files 'node_modules/' \
--exclude-secrets 'REDACTED_' \
--exclude-secrets 'change-me-in-production' \
--exclude-secrets 'dev-secret-key' \
--exclude-secrets 'postgres:postgres@localhost' \
> .secrets-results.json
- name: Check results
run: |
if detect-secrets audit --report .secrets-results.json 2>/dev/null | grep -q "True"; then
echo "Potential secrets detected! Review .secrets-results.json"
detect-secrets audit --report .secrets-results.json
exit 1
fi
echo "No secrets detected."