cognida/.github/workflows/ci-python.yml at main · larry-zy/cognida · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
name: CI - Python

on:
  push:
    branches: [main, develop]
    paths:
      - 'services/cognida-python/**'
      - '.github/workflows/ci-python.yml'
  pull_request:
    paths:
      - 'services/cognida-python/**'
      - '.github/workflows/ci-python.yml'

env:
  PYTHON_VERSION: "3.11"

defaults:
  run:
    working-directory: services/cognida-python

jobs:
  lint:
    name: 代码检查
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: 安装 uv
        uses: astral-sh/setup-uv@v4
        with:
          version: "latest"
      - name: 设置 Python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: 安装依赖 (dev)
        run: uv sync --frozen --extra dev
      # 棕地存量: ruff 全项目扫描存量告警多(约 880 项), 先作非阻断反馈,
      # 待用 `uv run ruff check --fix && uv run ruff format` 分批清理后再转为门禁。
      - name: ruff check (非阻断)
        run: uv run ruff check .
        continue-on-error: true
      - name: ruff format --check (非阻断)
        run: uv run ruff format --check .
        continue-on-error: true
      # mypy --strict 在棕地项目上存量告警多, 作非阻断反馈而非门禁
      # (与本仓库 PostToolUse hook 的"反馈回路"理念一致)。
      - name: mypy (非阻断)
        run: uv run mypy --ignore-missing-imports services core config
        continue-on-error: true

  test:
    name: 测试
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: 安装 uv
        uses: astral-sh/setup-uv@v4
        with:
          version: "latest"
      - name: 设置 Python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: 安装依赖 (全部 extras)
        run: uv sync --frozen --all-extras
      # 仅跑单元测试: integration/grpc/slow 需要真实数据库或 gRPC 服务, 不在 CI 内。
      # --cov-fail-under=0 覆盖 pyproject 中 80% 的阈值(棕地项目暂不硬门禁覆盖率)。
      # 注: 原有的接入前坏测试(import 断裂 / pandas 3.x 类型 / proto 转换)已全部
      # 修复, 隔离项(--ignore/--deselect)已移除, 全部有效单测纳入真门禁。
      - name: pytest (单元)
        run: >
          uv run pytest
          -m "not integration and not grpc and not slow"
          --cov=. --cov-report=xml --cov-report=term --cov-fail-under=0
      - name: 上传覆盖率
        uses: codecov/codecov-action@v4
        with:
          file: services/cognida-python/coverage.xml
          fail_ci_if_error: false

  security:
    name: 安全扫描
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: 安装 uv
        uses: astral-sh/setup-uv@v4
        with:
          version: "latest"
      - name: 设置 Python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: 安装扫描工具
        run: uv pip install --system safety bandit
      - name: safety (非阻断)
        run: safety check --json || true
      - name: bandit (非阻断)
        run: bandit -r services core mcp api tools grpc_service -f json || true