Refactor CI workflow for quality and coverage #12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI Professional Grade | |
| on: | |
| push: | |
| branches: [ "master", "main", "dev" ] | |
| pull_request: | |
| branches: [ "master", "main" ] | |
| jobs: | |
| quality-and-security: | |
| name: Code Quality & Security Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v5 | |
| with: | |
| enable-cache: true # Обов'язково для швидкості | |
| - name: Set up Python | |
| run: uv python install 3.12 | |
| - name: Install dependencies | |
| run: uv sync --all-extras --dev | |
| # 1. Форматування: Код має бути ідеальним | |
| - name: Check formatting (Ruff) | |
| run: uv run ruff format --check . | |
| # 2. Поглиблений лінтинг: Включаємо правила безпеки (S) та складності (C90) | |
| - name: Lint with Ruff (All rules) | |
| run: uv run ruff check . --select E,F,B,S,C90 --ignore S101 | |
| # 3. Аудит залежностей: Шукаємо вразливі бібліотеки | |
| - name: Dependency Security Audit | |
| run: uv pip audit | |
| # 4. Статичний аналіз на вразливості коду | |
| - name: Security scan (Bandit) | |
| run: uv run bandit -r src/ | |
| tests: | |
| name: Tests (Py${{ matrix.python-version }}) | |
| needs: quality-and-security # Не запускаємо тести, якщо код "брудний" | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false # Бачимо помилки на всіх версіях | |
| matrix: | |
| python-version: ["3.11", "3.12"] | |
| services: | |
| rabbitmq: | |
| image: rabbitmq:4.0-management | |
| ports: | |
| - 5672:5672 | |
| options: >- | |
| --health-cmd "rabbitmq-diagnostics -q ping" | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v5 | |
| with: | |
| enable-cache: true | |
| - name: Set up Python ${{ matrix.python-version }} | |
| run: uv python install ${{ matrix.python-version }} | |
| - name: Install dependencies | |
| run: uv sync --all-extras --dev | |
| # 5. Тести з генерацією звіту про покриття (Coverage) | |
| - name: Run Tests with Coverage | |
| run: | | |
| uv run pytest --cov=src --cov-report=xml --cov-report=term-missing | |
| env: | |
| RABBITMQ_URL: "amqp://guest:guest@localhost:5672/" | |
| LOG_LEVEL: "DEBUG" | |
| # 6. Завантаження звіту (наприклад, у Codecov або просто як артефакт) | |
| - name: Upload coverage reports to Codecov | |
| uses: codecov/codecov-action@v4 | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| fail_ci_if_error: false |