feat(api): launch-promo foundation — admin manual award + /me status (#724) #654
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| branches: [develop, main] | |
| types: [opened, synchronize, reopened] | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: oven-sh/setup-bun@v2 | |
| - run: bun install --frozen-lockfile | |
| - run: bun run lint | |
| typecheck: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: oven-sh/setup-bun@v2 | |
| - run: bun install --frozen-lockfile | |
| - run: bun run typecheck | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: oven-sh/setup-bun@v2 | |
| - run: bun install --frozen-lockfile | |
| - run: bun run test:coverage | |
| # Codecov upload (#471). No token needed for public repos. | |
| # `directory: ./coverage` picks up the per-package lcov files | |
| # that bun test --coverage writes into each workspace. | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@v4 | |
| if: ${{ !cancelled() }} | |
| with: | |
| flags: bun | |
| fail_ci_if_error: false | |
| # Per-package lcov files land under coverage/ in each | |
| # workspace; codecov-action recurses by default. | |
| files: ./ornn-api/coverage/lcov.info,./ornn-web/coverage/lcov.info,./sdk/typescript/coverage/lcov.info | |
| python-sdk-test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.12" | |
| cache: pip | |
| cache-dependency-path: sdk/python/pyproject.toml | |
| - name: Install ornn-sdk (python) | |
| working-directory: sdk/python | |
| run: pip install -e ".[dev]" | |
| - name: Lint (ruff) | |
| working-directory: sdk/python | |
| run: ruff check . | |
| - name: Format check (ruff) | |
| working-directory: sdk/python | |
| run: ruff format --check . | |
| - name: Type check (mypy) | |
| working-directory: sdk/python | |
| run: mypy | |
| - name: Run pytest with coverage | |
| working-directory: sdk/python | |
| run: pytest -q --cov=src/ornn_sdk --cov-report=xml --cov-report=term | |
| # Codecov upload (#471) — same as the bun job but for the | |
| # Python SDK's coverage.xml. | |
| - name: Upload Python coverage to Codecov | |
| uses: codecov/codecov-action@v4 | |
| if: ${{ !cancelled() }} | |
| with: | |
| flags: python | |
| fail_ci_if_error: false | |
| files: ./sdk/python/coverage.xml | |
| # Audit the Python SDK's transitive deps for known CVEs (#445). | |
| # We install the runtime deps directly (httpx + dev tools) rather | |
| # than `pip install -e .` because pip-audit refuses editable | |
| # installs of packages that aren't on PyPI yet (ornn-sdk is held | |
| # for v1 per #473). The audit walks the resolved env via the OSV | |
| # database — transitive deps (h11, anyio, certifi, idna, …) are | |
| # all covered. | |
| python-sdk-audit: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.12" | |
| - name: Install runtime + dev deps directly | |
| working-directory: sdk/python | |
| # Read the bounds from pyproject.toml without installing | |
| # ornn-sdk itself. tomllib is stdlib in 3.11+; we're on 3.12. | |
| run: | | |
| python -c " | |
| import tomllib, subprocess, sys | |
| cfg = tomllib.load(open('pyproject.toml', 'rb')) | |
| deps = cfg['project']['dependencies'] | |
| deps += cfg['project']['optional-dependencies']['dev'] | |
| subprocess.check_call([sys.executable, '-m', 'pip', 'install', *deps]) | |
| " | |
| pip install pip-audit | |
| - name: Audit dependencies | |
| working-directory: sdk/python | |
| # `--strict` fails on any known CVE in the installed env. | |
| run: pip-audit --strict | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: oven-sh/setup-bun@v2 | |
| - run: bun install --frozen-lockfile | |
| - run: bun run build:web | |
| gitleaks: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install gitleaks | |
| run: | | |
| VERSION=$(curl -sI https://github.com/gitleaks/gitleaks/releases/latest | grep -i location | grep -oE 'v[0-9.]+' | head -1 | sed 's/^v//') | |
| curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" | tar xz | |
| sudo mv gitleaks /usr/local/bin/ | |
| - name: Scan for secrets | |
| run: gitleaks detect --source . --log-opts="origin/${{ github.base_ref }}..HEAD" --verbose | |
| audit: | |
| # Fails on any high or critical advisory in the Bun workspace. Moderate | |
| # and below print to the PR step summary but don't block — Dependabot | |
| # picks them up on the weekly cadence (.github/dependabot.yml). | |
| # | |
| # Ignored advisories — accepted residual risk documented in #385: | |
| # GHSA-r5fr-rjxr-66jc lodash-es high (via mermaid) | |
| # GHSA-f23m-r3pf-42rh lodash-es moderate (via mermaid) | |
| # lodash-es is archived at 4.17.21 with no upstream fix; the vulnerable | |
| # APIs (_.template / _.unset / _.omit) are not reachable through | |
| # mermaid's surface under our usage. | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: oven-sh/setup-bun@v2 | |
| - run: bun install --frozen-lockfile | |
| - name: Audit (high+critical block PR) | |
| run: bun audit --audit-level=high --ignore=GHSA-r5fr-rjxr-66jc --ignore=GHSA-f23m-r3pf-42rh | |
| - name: Audit summary (moderate+ — informational) | |
| if: ${{ !cancelled() }} | |
| run: | | |
| { | |
| echo "### bun audit — full report (moderate and above)" | |
| echo "" | |
| echo '```' | |
| bun audit --audit-level=moderate || true | |
| echo '```' | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| docker-build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: docker/setup-buildx-action@v4 | |
| - name: Build ornn-api image | |
| run: docker build -t ornn-api-ci -f ornn-api/Dockerfile . | |
| - name: Build ornn-web image | |
| # Runtime-config (PR #117) dropped all VITE_* build args — the image | |
| # is environment-agnostic, config.js is rendered from its template at | |
| # container startup via envsubst. CI just verifies the Dockerfile | |
| # builds cleanly. | |
| run: docker build -t ornn-web-ci -f ornn-web/Dockerfile . |