Merge pull request #18 from fralapo/fix/fps-reconcile #26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| # Runs the host-runnable (non-integration) test suite, a dependency | |
| # vulnerability scan, and the frontend build on every push and PR. | |
| # Heavy CV/ML integration tests (cv2/mediapipe/scenedetect) run in Docker | |
| # and are intentionally excluded here (`-m "not integration"`). | |
| on: | |
| push: | |
| branches: ["**"] | |
| pull_request: | |
| branches: ["**"] | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| backend: | |
| name: Backend (pytest + pip-audit) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| cache: pip | |
| - name: Install package (editable) + host-test deps + audit tooling | |
| run: | | |
| python -m pip install --upgrade pip | |
| # `.[host-tests]` pulls the light runtime subset the non-integration | |
| # suite imports (numpy/pydantic/fastapi/yt-dlp/…). `pip install -e .` | |
| # alone installs no runtime deps; the heavy CV/ML stack stays in Docker. | |
| pip install -e ".[host-tests]" | |
| pip install pytest pip-audit | |
| - name: Run host test suite (excludes integration) | |
| run: pytest -m "not integration" -q | |
| # Audit the pinned tree for known CVEs. Now BLOCKING (we're on a lock | |
| # file): a newly-disclosed CVE in any pinned dep fails CI so it gets | |
| # reviewed before merge. Two IDs are explicitly ignored with rationale: | |
| # - CVE-2025-3000 (torch): fixed in 2.7.0; we pin 2.11.0 > fix, so the | |
| # pip-audit hit is a stale/over-broad OSV range (false positive). | |
| # - CVE-2026-24049 (wheel): build-time-only ReDoS in metadata parsing, | |
| # not reachable at runtime. | |
| - name: Dependency vulnerability scan (full pinned tree) | |
| run: >- | |
| pip-audit -r requirements.lock --desc | |
| --ignore-vuln CVE-2025-3000 | |
| --ignore-vuln CVE-2026-24049 | |
| frontend: | |
| name: Frontend (build + lint) | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: dashboard | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: "20" | |
| cache: npm | |
| cache-dependency-path: dashboard/package-lock.json | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Lint | |
| run: npm run lint | |
| - name: Build | |
| run: npm run build |