[codex] Productize Cortex for first-100 beta readiness #176
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| python: | |
| name: Python checks and backend tests | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install backend test dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| python -m pip install -r backend/requirements.txt | |
| python -m pip install pytest | |
| - name: Compile Python sources | |
| run: | | |
| python -m compileall -q \ | |
| backend \ | |
| scripts \ | |
| capture.py \ | |
| github_store.py \ | |
| ingest.py \ | |
| instrumentation.py \ | |
| mcp_server.py \ | |
| redis_store.py \ | |
| ui.py | |
| - name: Run backend unit tests | |
| # pytest is the canonical runner: conftest.py provides fixtures + temp-dir | |
| # isolation that `unittest discover` bypasses, and some tests/subtests only | |
| # behave correctly under pytest. | |
| run: python -m pytest backend/tests -q | |
| - name: Run retrieval quality regression gate | |
| run: python scripts/retrieval_eval.py | |
| - name: Run adaptation quality evaluation | |
| run: python scripts/adaptation_eval.py | |
| - name: Check connector baseline contract | |
| run: python scripts/check_connector_baseline.py | |
| - name: Check beta docs currency | |
| run: python scripts/check_docs_current.py | |
| - name: Run backend beta smoke | |
| run: python scripts/backend_beta_smoke.py | |
| - name: Run lightweight ops readiness | |
| run: python scripts/ops_readiness_check.py --skip-tests --skip-build --output-root "$RUNNER_TEMP/cortex-empty-outputs" | |
| security-scan: | |
| name: Security scan (bandit + pip-audit) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install security tools | |
| run: | | |
| python -m pip install --upgrade pip | |
| python -m pip install bandit pip-audit | |
| - name: Bandit static security scan | |
| # Fail on MEDIUM-or-higher severity findings; documented false-positive test IDs are | |
| # skipped in .bandit.yaml. Verified this still fails on real issues (e.g. shell=True/B602). | |
| run: bandit -c .bandit.yaml -r backend scripts -ll | |
| - name: Audit backend dependencies for known vulnerabilities | |
| run: pip-audit --strict -r backend/requirements.txt | |
| - name: Audit top-level dependencies for known vulnerabilities | |
| run: pip-audit --strict -r requirements.txt | |
| distribution: | |
| name: Distribution site and update manifest | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Validate distribution site | |
| run: python scripts/check_distribution_site.py | |
| - name: Validate site update manifest | |
| run: python scripts/validate_update_manifest.py site/downloads/latest.json | |
| obsidian-plugin: | |
| name: Obsidian plugin build | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: "22" | |
| cache: npm | |
| cache-dependency-path: packages/obsidian-cortex-plugin/package-lock.json | |
| - name: Typecheck and build Obsidian plugin | |
| run: scripts/check_obsidian_plugin.sh | |
| macos-app: | |
| name: macOS app build | |
| runs-on: macos-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@v4 | |
| - name: Build app bundle | |
| env: | |
| CORTEX_BUNDLE_PYTHON: "0" | |
| CORTEX_CODESIGN_IDENTITY: "-" | |
| CORTEX_CODESIGN_TIMESTAMP: "0" | |
| run: ./macos/build.sh | |
| - name: Verify ad-hoc signed app | |
| run: codesign --verify --deep --strict --verbose=2 macos/build/Cortex.app |