CI/CD

skipping false positive security audit #38

Workflow file for this run

	name: CI/CD

	on:
	push:
	branches: [main]
	tags: ["v*"]
	pull_request:
	branches: [main]

	permissions:
	contents: write
	id-token: write # trusted publishing to PyPI

	jobs:
	lint:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v5
	with:
	python-version: "3.11"
	cache: pip
	- run: pip install ruff
	- run: ruff check .
	- run: ruff format --check .

	test:
	runs-on: ubuntu-latest
	strategy:
	matrix:
	python-version: ["3.11", "3.12", "3.13"]
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v5
	with:
	python-version: ${{ matrix.python-version }}
	cache: pip
	- run: pip install -e ".[test]"
	- run: python -m pytest tests/ -v --cov --cov-report=term-missing --cov-report="markdown:coverage.md"
	- uses: actions/upload-artifact@v4
	if: matrix.python-version == '3.13'
	with:
	name: coverage-report
	path: coverage.md

	build:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0 # full history for hatch-vcs versioning
	- uses: actions/setup-python@v5
	with:
	python-version: "3.11"
	cache: pip
	- run: pip install build twine
	- run: python -m build
	- run: twine check dist/*
	- uses: actions/upload-artifact@v4
	with:
	name: dist
	path: dist/

	security:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v5
	with:
	python-version: "3.11"
	cache: pip
	- run: pip install bandit pip-audit
	- name: Bandit (static security analysis)
	run: bandit -r ble_mcp_server/ -c pyproject.toml
	- name: pip-audit (dependency vulnerabilities)
	continue-on-error: true
	run: \|
	pip install -e .
	pip-audit --strict --desc \| tee pip-audit-report.txt
	- uses: actions/upload-artifact@v4
	if: always()
	with:
	name: pip-audit-report
	path: pip-audit-report.txt
	- name: Summary
	if: always()
	run: \|
	echo "## Security scan results" >> "$GITHUB_STEP_SUMMARY"
	echo "### Bandit (static analysis)" >> "$GITHUB_STEP_SUMMARY"
	echo "Passed" >> "$GITHUB_STEP_SUMMARY"
	echo "### pip-audit (dependency vulnerabilities)" >> "$GITHUB_STEP_SUMMARY"
	echo '```' >> "$GITHUB_STEP_SUMMARY"
	if [ -f pip-audit-report.txt ]; then
	cat pip-audit-report.txt >> "$GITHUB_STEP_SUMMARY"
	else
	echo "No report generated" >> "$GITHUB_STEP_SUMMARY"
	fi
	echo '```' >> "$GITHUB_STEP_SUMMARY"

	release:
	if: startsWith(github.ref, 'refs/tags/v')
	needs: [lint, test, build, security]
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/download-artifact@v4
	with:
	name: dist
	path: dist/
	- name: Extract changelog
	if: ${{ !contains(github.ref_name, 'rc') }}
	run: \|
	# Extract the section for this version (e.g. "## 0.1.0" from tag "v0.1.0")
	VERSION="${GITHUB_REF_NAME#v}"
	awk "/^## ${VERSION}$/,/^## /" CHANGELOG.md \| head -n -1 > release-notes.md
	- name: Create GitHub Release
	env:
	GH_TOKEN: ${{ github.token }}
	run: \|
	if [[ "${{ github.ref_name }}" == rc ]]; then
	gh release create "${{ github.ref_name }}" \
	--title "${{ github.ref_name }}" \
	--generate-notes \
	--prerelease \
	dist/*
	else
	gh release create "${{ github.ref_name }}" \
	--title "${{ github.ref_name }}" \
	--notes-file release-notes.md \
	dist/*
	fi

	publish-testpypi:
	if: startsWith(github.ref, 'refs/tags/v') && contains(github.ref_name, 'rc')
	needs: release
	runs-on: ubuntu-latest
	environment: testpypi
	steps:
	- uses: actions/download-artifact@v4
	with:
	name: dist
	path: dist/
	- uses: pypa/gh-action-pypi-publish@release/v1
	with:
	repository-url: https://test.pypi.org/legacy/

	publish-pypi:
	if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, 'rc')
	needs: release
	runs-on: ubuntu-latest
	environment: pypi
	steps:
	- uses: actions/download-artifact@v4
	with:
	name: dist
	path: dist/
	- uses: pypa/gh-action-pypi-publish@release/v1

Navigation Menu

skipping false positive security audit #38

Workflow file

skipping false positive security audit #38

Uh oh!

Workflow file for this run