fix(release): switch to workflow_run trigger, disable PyPI publishing… #282
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # CI/CD Pipeline | |
| # Runs tests, linting, type checking, and security scans. | |
| # | |
| # Features: | |
| # - Standard quality checks (tests, linting, type checking) | |
| # - Security scanning (Bandit, Safety) | |
| # - Optional SonarCloud/Codecov integration | |
| name: CI | |
| on: | |
| push: | |
| branches: [main, master, develop] | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| branches: [main, master, develop] | |
| workflow_dispatch: | |
| # Cancel in-progress runs for same PR/branch | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| checks: write | |
| # Uses org-level reusable workflow | |
| jobs: | |
| ci: | |
| name: CI Pipeline | |
| uses: ByronWilliamsCPA/.github/.github/workflows/python-ci.yml@961eb17d8e9b7fe0d8bfc5dbe9d23c824484fb11 # main | |
| with: | |
| python-version: '3.12' | |
| coverage-threshold: 80 | |
| source-directory: 'src' | |
| test-directory: 'tests' | |
| run-integration-tests: true | |
| run-security-tests: true | |
| fail-on-llm-tags: false | |
| # rag-processor uses hatchling as build backend, so editable installs | |
| # require the build step. The reusable defaults no-build: true; override. | |
| no-build: false | |
| playwright-e2e: | |
| name: Playwright E2E Tests | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| permissions: | |
| contents: read | |
| defaults: | |
| run: | |
| working-directory: frontend | |
| steps: | |
| - name: Harden runner | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| # egress-policy: block -- enabled 2026-05-23 (compliance audit). If a CI run fails on a network call, switch this single occurrence back to audit and capture the missing endpoint in the issue tracker. | |
| egress-policy: audit # TODO: switch to block after 2026-06-30 (compliance audit deferral) | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Setup Node | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: "20" | |
| cache: "npm" | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Install Playwright browsers | |
| run: npx playwright install --with-deps chromium | |
| - name: Run Playwright tests | |
| run: npx playwright test | |
| env: | |
| CLOUDFLARE_ENABLED: "false" | |
| BASE_URL: "http://localhost:3000" | |
| - name: Upload Playwright report | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: playwright-report | |
| path: frontend/playwright-report/ | |
| retention-days: 7 | |
| ci-gate: | |
| name: CI Gate | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| needs: [ci, playwright-e2e] | |
| if: always() | |
| steps: | |
| - name: Harden runner | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| # egress-policy: block -- enabled 2026-05-23 (compliance audit). If a CI run fails on a network call, switch this single occurrence back to audit and capture the missing endpoint in the issue tracker. | |
| egress-policy: audit # TODO: switch to block after 2026-06-30 (compliance audit deferral) | |
| - name: Check CI results | |
| env: | |
| CI_RESULT: ${{ needs.ci.result }} | |
| E2E_RESULT: ${{ needs.playwright-e2e.result }} | |
| run: | | |
| if [ "$CI_RESULT" != "success" ]; then | |
| echo "::error::CI Gate failed: CI result is $CI_RESULT" | |
| exit 1 | |
| fi | |
| if [ "$E2E_RESULT" != "success" ]; then | |
| echo "::error::CI Gate failed: Playwright E2E result is $E2E_RESULT" | |
| exit 1 | |
| fi | |
| echo "CI Gate passed" |