fix(deps): override litellm transitive pins (aiohttp + python-dotenv) #17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: GPL-2.0-or-later | |
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: astral-sh/setup-uv@v7 | |
| with: | |
| version: "latest" | |
| - run: uv sync --all-extras | |
| - run: uv run ruff check src/ tests/ | |
| - run: uv run ruff format --check src/ tests/ | |
| - run: uv run mypy src/apmode/ --strict | |
| test: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| # pyproject declares 3.12-3.14 support; keep the CI matrix in | |
| # sync so 3.14-only regressions surface on every PR. | |
| python-version: ["3.12", "3.13", "3.14"] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: astral-sh/setup-uv@v7 | |
| with: | |
| version: "latest" | |
| - run: uv python install ${{ matrix.python-version }} | |
| - run: uv sync --all-extras --python ${{ matrix.python-version }} | |
| - run: uv run pytest tests/ -v --tb=short -n auto -m "not live and not slow" | |
| benchmarks: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: astral-sh/setup-uv@v7 | |
| with: | |
| version: "latest" | |
| - run: uv sync --all-extras | |
| - name: Suite A scenario validation | |
| run: uv run pytest tests/unit/test_benchmark_suite_a.py -v --tb=short | |
| - name: Suite A structure recovery assertions | |
| run: uv run pytest tests/unit/test_benchmark_simulation.py -v --tb=short | |
| policy-validation: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: astral-sh/setup-uv@v7 | |
| with: | |
| version: "latest" | |
| - run: uv sync --all-extras | |
| - run: uv run python -m apmode.governance.validate_policies policies/ | |
| security: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: astral-sh/setup-uv@v7 | |
| with: | |
| version: "latest" | |
| - run: uv sync --all-extras | |
| - name: Bandit static security analysis | |
| run: uv run bandit -r src/apmode/ -ll | |
| - name: pip-audit dependency CVE scan | |
| run: uv run pip-audit | |
| - name: Generate CycloneDX SBOM | |
| # pip-audit exits non-zero if CVEs are present but still writes | |
| # the SBOM; we always want the artifact, so tolerate a non-zero | |
| # exit and gate only on file presence. | |
| run: | | |
| uv run pip-audit --format cyclonedx-json --output bom.cdx.json || true | |
| test -s bom.cdx.json | |
| - name: Upload SBOM | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: sbom-cyclonedx-json | |
| path: bom.cdx.json | |
| if-no-files-found: error | |
| retention-days: 90 |