Proxy-lobes + pairwise gateway auth: serve a dropped role by following its own referral (#127 phase 1 / #115) (0.45.0) #264
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Tests | |
| on: | |
| pull_request: | |
| branches: [main] | |
| push: | |
| branches: [main] | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| # Promote SONAR_TOKEN to job env so the SonarCloud step can gate on | |
| # `env.SONAR_TOKEN != ''` — `secrets.*` isn't allowed in `if:`. This | |
| # makes the step a no-op on fork PRs (where the secret isn't injected) | |
| # and on any repo that hasn't configured the token yet. | |
| env: | |
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| # Sonar needs full git history for accurate "new code" blame attribution. | |
| fetch-depth: 0 | |
| - uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4 | |
| - run: uv python install 3.12 | |
| - run: uv sync | |
| - run: uv run pytest -n auto --cov=lobes --cov-report=xml:coverage.xml --cov-report=term -v | |
| - name: SonarCloud Scan | |
| if: env.SONAR_TOKEN != '' | |
| uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6 | |
| env: | |
| SONAR_HOST_URL: https://sonarcloud.io | |
| lint: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: '20' | |
| - uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4 | |
| - run: uv python install 3.12 | |
| - run: uv sync | |
| - name: black --check | |
| run: uv run black --check lobes tests | |
| - name: isort --check | |
| run: uv run isort --check-only lobes tests | |
| - name: flake8 | |
| run: uv run flake8 lobes tests | |
| - name: bandit | |
| run: uv run bandit -c pyproject.toml -r lobes | |
| - name: markdownlint-cli2 | |
| run: | | |
| npm install -g markdownlint-cli2@0.21.0 | |
| markdownlint-cli2 "**/*.md" "#node_modules" "#.local" | |
| - name: afi rubric gate | |
| run: uv run afi cli doctor . --strict | |
| version-check: | |
| # Only run on PR events. On push to main after a merged PR, the comparison | |
| # would always fail (PR_VERSION == MAIN_VERSION because HEAD and origin/main | |
| # point at the same commit). Restricting the trigger avoids that. | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| fetch-depth: 0 | |
| - run: git fetch origin main | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Check version bump | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| # AgentCulture rule: every PR bumps the version — even docs/config/CI. | |
| # See CLAUDE.md and the version-bump skill for rationale. | |
| PR_VERSION=$(python3 -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])") | |
| MAIN_VERSION=$(git show origin/main:pyproject.toml 2>/dev/null | python3 -c "import sys,tomllib; print(tomllib.loads(sys.stdin.read())['project']['version'])" 2>/dev/null || echo "") | |
| if [ -z "$MAIN_VERSION" ]; then | |
| echo "No pyproject.toml on main yet — skipping version check (initial scaffold)." | |
| exit 0 | |
| fi | |
| if [ "$PR_VERSION" = "$MAIN_VERSION" ]; then | |
| MARKER="<!-- version-check -->" | |
| BODY="⚠️ **Version not bumped** — \`pyproject.toml\` still has \`$PR_VERSION\` (same as main). Bump before merging to avoid a failed PyPI publish. | |
| $MARKER" | |
| EXISTING=$(gh api repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments \ | |
| --jq '.[] | select(.body | contains("<!-- version-check -->")) | .id' | head -1) | |
| if [ -n "$EXISTING" ]; then | |
| gh api repos/${{ github.repository }}/issues/comments/$EXISTING \ | |
| -X PATCH -f body="$BODY" > /dev/null | |
| else | |
| gh pr comment ${{ github.event.pull_request.number }} --body "$BODY" || true | |
| fi | |
| echo "::error::Version $PR_VERSION matches main. Bump before merging." | |
| exit 1 | |
| else | |
| echo "Version bumped: $MAIN_VERSION -> $PR_VERSION" | |
| fi |