Skip to content

Commit 5d62a09

Browse files
williabywilliaby
authored
Merge branch 'main' into dependabot/github_actions/actions/checkout-6.0.2
2 parents 07306ce + dd37ec0 commit 5d62a09

10 files changed

Lines changed: 689 additions & 40 deletions

‎.github/dependabot.yml‎

Lines changed: 0 additions & 40 deletions
This file was deleted.

‎.github/workflows/ci.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# CI/CD Pipeline for Claude Code Configuration
2+
# Delegates to the org-level reusable CI workflow for standard quality gates.
3+
name: CI
4+
5+
on:
6+
push:
7+
branches: [main, master, develop]
8+
pull_request:
9+
types: [opened, synchronize, reopened]
10+
branches: [main, master, develop]
11+
workflow_dispatch:
12+
13+
concurrency:
14+
group: ci-${{ github.ref }}
15+
cancel-in-progress: true
16+
17+
permissions: {}
18+
19+
jobs:
20+
ci:
21+
name: CI (Python 3.12)
22+
permissions:
23+
contents: read
24+
pull-requests: write
25+
checks: write
26+
uses: ByronWilliamsCPA/.github/.github/workflows/python-ci.yml@16979833c433ecb375f884552312b9fdf8c5ba6a # main
27+
with:
28+
python-version: "3.12"
29+
coverage-threshold: 80
30+
31+
# ==========================================================================
32+
# CI Gate: aggregates the CI result; must pass for branch protection
33+
# ==========================================================================
34+
ci-gate:
35+
name: CI Gate
36+
runs-on: ubuntu-latest
37+
needs: [ci]
38+
if: always()
39+
steps:
40+
- name: Harden runner
41+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
42+
with:
43+
egress-policy: audit
44+
- name: Check CI results
45+
env:
46+
CI_RESULT: ${{ needs.ci.result }}
47+
run: |
48+
if [ "$CI_RESULT" != "success" ]; then
49+
echo "::error::CI Gate failed: CI result is $CI_RESULT"
50+
exit 1
51+
fi
52+
echo "CI Gate passed"

‎.github/workflows/codeql.yml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
# CodeQL Security Analysis
2+
# Performs static application security testing (SAST) using GitHub CodeQL.
3+
#
4+
# IMPORTANT: GitHub's CodeQL "default setup" must remain DISABLED for this repo.
5+
# Default setup and custom advanced configuration cannot both upload SARIF to the
6+
# Security tab. To verify or disable: Settings > Code security > Code scanning > Default setup.
7+
name: CodeQL Analysis
8+
9+
on:
10+
push:
11+
branches: [main, master]
12+
pull_request:
13+
branches: [main, master]
14+
schedule:
15+
- cron: "0 7 * * 1"
16+
workflow_dispatch:
17+
18+
permissions:
19+
contents: read
20+
21+
concurrency:
22+
group: codeql-${{ github.ref }}
23+
cancel-in-progress: false
24+
25+
jobs:
26+
analyze:
27+
name: CodeQL Analyze (Python)
28+
runs-on: ubuntu-latest
29+
timeout-minutes: 30
30+
permissions:
31+
actions: read
32+
contents: read
33+
security-events: write
34+
35+
steps:
36+
- name: Harden the runner
37+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
38+
with:
39+
egress-policy: audit
40+
41+
- name: Checkout repository
42+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
43+
with:
44+
persist-credentials: false
45+
46+
- name: Set up Python
47+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
48+
with:
49+
python-version: "3.12"
50+
51+
- name: Install uv
52+
uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
53+
with:
54+
enable-cache: true
55+
56+
- name: Install dependencies
57+
run: uv sync --no-dev
58+
59+
- name: Initialize CodeQL
60+
uses: github/codeql-action/init@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
61+
with:
62+
languages: python
63+
build-mode: none
64+
queries: security-extended,security-and-quality
65+
66+
- name: Perform CodeQL Analysis
67+
uses: github/codeql-action/analyze@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
68+
with:
69+
category: "/language:python"

‎.github/workflows/coverage.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# Coverage Upload Workflow
2+
# Downloads coverage artifacts from CI and uploads to Qlty for quality tracking.
3+
# Triggers after the CI workflow succeeds so coverage is always in sync with CI.
4+
name: Coverage (Qlty)
5+
6+
on:
7+
workflow_run:
8+
workflows: ["CI"]
9+
types: [completed]
10+
branches: [main, master]
11+
workflow_dispatch:
12+
inputs:
13+
run-id:
14+
description: 'CI workflow run ID to download coverage from'
15+
required: false
16+
type: string
17+
18+
permissions:
19+
contents: read
20+
actions: read
21+
22+
jobs:
23+
upload-coverage:
24+
name: Upload Coverage to Qlty
25+
if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
26+
uses: ByronWilliamsCPA/.github/.github/workflows/python-qlty-coverage.yml@main
27+
with:
28+
coverage-artifact-name: coverage-reports
29+
coverage-file-path: coverage.xml
30+
workflow-run-id: ${{ github.event.workflow_run.id != null && github.event.workflow_run.id || '' }}
31+
skip-if-no-token: true
32+
secrets:
33+
QLTY_COVERAGE_TOKEN: ${{ secrets.QLTY_COVERAGE_TOKEN }}

‎.github/workflows/fips-compatibility.yml‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
# FIPS Compatibility Check
2+
# Checks code and dependencies for FIPS 140-2/140-3 compliance issues.
3+
# Requires scripts/check_fips_compatibility.py at repo root.
4+
#
5+
# FIPS mode restricts cryptographic algorithms to NIST-approved ones, required for:
6+
# - US Government systems, Healthcare (HIPAA), Financial services
7+
# - Ubuntu LTS with fips-updates package
8+
#
9+
# Security note: workflow_dispatch inputs are passed via env vars (not direct
10+
# expression interpolation) to prevent command injection.
11+
name: FIPS Compatibility
12+
13+
on:
14+
push:
15+
branches: [main, master]
16+
paths:
17+
- 'src/**/*.py'
18+
- 'pyproject.toml'
19+
- 'requirements*.txt'
20+
- '.github/workflows/fips-compatibility.yml'
21+
pull_request:
22+
branches: [main, master]
23+
paths:
24+
- 'src/**/*.py'
25+
- 'pyproject.toml'
26+
- 'requirements*.txt'
27+
schedule:
28+
- cron: '0 10 * * 1'
29+
workflow_dispatch:
30+
inputs:
31+
strict_mode:
32+
description: 'Treat warnings as errors'
33+
required: false
34+
default: 'false'
35+
type: string
36+
37+
concurrency:
38+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
39+
cancel-in-progress: true
40+
41+
permissions:
42+
contents: read
43+
pull-requests: write
44+
45+
jobs:
46+
fips-check:
47+
name: FIPS Compliance Check
48+
runs-on: ubuntu-latest
49+
steps:
50+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
51+
52+
- name: Install uv
53+
uses: astral-sh/setup-uv@1e862dfacbd1d6d858c55d9b792c756523627244 # v7.1.4
54+
with:
55+
enable-cache: true
56+
57+
- name: Set up Python
58+
run: uv python install 3.12
59+
60+
- name: Install dependencies
61+
run: uv sync --frozen
62+
63+
- name: Run FIPS compatibility check
64+
id: fips-check
65+
env:
66+
STRICT_MODE: ${{ github.event.inputs.strict_mode }}
67+
run: |
68+
STRICT_FLAG=""
69+
if [ "$STRICT_MODE" = "true" ]; then
70+
STRICT_FLAG="--strict"
71+
fi
72+
73+
set +e
74+
uv run python scripts/check_fips_compatibility.py \
75+
--fix-hints \
76+
--include-tests \
77+
$STRICT_FLAG \
78+
2>&1 | tee fips-report.txt
79+
EXIT_CODE=${PIPESTATUS[0]}
80+
set -e
81+
82+
uv run python scripts/check_fips_compatibility.py \
83+
--json \
84+
--include-tests \
85+
> fips-report.json 2>/dev/null || true
86+
87+
echo "exit_code=$EXIT_CODE" >> "$GITHUB_OUTPUT"
88+
89+
if [ -f fips-report.json ]; then
90+
ERRORS=$(jq -r '.summary.errors' fips-report.json)
91+
WARNINGS=$(jq -r '.summary.warnings' fips-report.json)
92+
INFO=$(jq -r '.summary.info' fips-report.json)
93+
echo "errors=$ERRORS" >> "$GITHUB_OUTPUT"
94+
echo "warnings=$WARNINGS" >> "$GITHUB_OUTPUT"
95+
echo "info=$INFO" >> "$GITHUB_OUTPUT"
96+
fi
97+
98+
exit $EXIT_CODE
99+
100+
- name: Upload FIPS report
101+
if: always()
102+
uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
103+
with:
104+
name: fips-compatibility-report
105+
path: |
106+
fips-report.txt
107+
fips-report.json
108+
retention-days: 30
109+
110+
- name: Comment on PR
111+
if: always() && github.event_name == 'pull_request'
112+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
113+
with:
114+
script: |
115+
const errors = parseInt('${{ steps.fips-check.outputs.errors }}') || 0;
116+
const warnings = parseInt('${{ steps.fips-check.outputs.warnings }}') || 0;
117+
const info = parseInt('${{ steps.fips-check.outputs.info }}') || 0;
118+
119+
let status = 'PASSED';
120+
let emoji = 'PASS';
121+
if (errors > 0) {
122+
status = 'FAILED';
123+
emoji = 'FAIL';
124+
} else if (warnings > 0) {
125+
status = 'NEEDS REVIEW';
126+
emoji = 'WARN';
127+
}
128+
129+
const body = `## FIPS Compatibility Check: ${status}\n\n` +
130+
`| Metric | Count |\n|--------|-------|\n` +
131+
`| Errors | ${errors} |\n` +
132+
`| Warnings | ${warnings} |\n` +
133+
`| Info | ${info} |\n\n` +
134+
(errors > 0 ? 'This PR introduces FIPS-incompatible code or dependencies. ' +
135+
`Review the [workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for details.\n\n` : '') +
136+
(warnings > 0 && errors === 0 ? 'Some packages may need verification for FIPS compliance. See workflow artifacts for details.\n\n' : '');
137+
138+
github.rest.issues.createComment({
139+
owner: context.repo.owner,
140+
repo: context.repo.repo,
141+
issue_number: context.issue.number,
142+
body: body
143+
});

0 commit comments

Comments
 (0)