Bump ruff from 0.15.13 to 0.15.18 #52

	name: CI

	on:
	pull_request:
	push:
	branches:
	- main

	permissions:
	contents: read

	jobs:
	python:
	runs-on: ubuntu-latest
	steps:
	- name: Check out repository
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false

	- name: Set up Python
	uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
	with:
	python-version: "3.12"

	- name: Install development dependencies
	run: \|
	python -m pip install --upgrade pip
	python -m pip install -r requirements-dev.txt

	- name: Ruff
	run: ruff check .

	- name: Bandit
	run: bandit -c pyproject.toml -r src

	- name: Secret scan
	run: git ls-files -z \| xargs -0 detect-secrets-hook --baseline .secrets.baseline

	- name: Dependency audit
	run: pip-audit -r requirements-dev.txt

	- name: GitHub Actions lint
	run: actionlint

	- name: Unit tests
	run: PYTHONPATH=src python -m unittest discover -s tests

	- name: Compile Python files
	run: python -m compileall -q src tests

	- name: Build package
	run: python -m build

	- name: Install built wheel
	run: \|
	python -m pip install --force-reinstall dist/*.whl
	codex-bg --help

	zizmor:
	runs-on: ubuntu-latest
	steps:
	- name: Check out repository
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false

	- name: Set up Python
	uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
	with:
	python-version: "3.12"

	- name: Install zizmor
	run: python -m pip install zizmor==1.25.0

	- name: GitHub Actions security lint
	run: zizmor --offline .github

Navigation Menu