embeddevio/awg-dash
1
0
Fork 0
Code Issues 40 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

Sprint 0 / #17: CI-пайплайн с гейтами (lint, unit+coverage>=70%, security, build, image-scan, push) #60

Merged
embeddevio merged 8 commits from feat/17-ci into main 2026-10-29 21:09:27 +03:00
Conversation 1 Commits 8 Files Changed 3
+13 -5
1 changed files with 13 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit a941525f2e - Show all commits
.gitea/workflows/ci.yml
+13 -5
View File
@@ -53,7 +53,7 @@ jobs:
- name: install dependencies - name: install dependencies
run: | run: |
python -m pip install --upgrade pip python -m pip install --upgrade pip
pip install -r requirements-dev.txt pip install -r requirements-dev.txt -r requirements-contract.txt
- name: ruff check - name: ruff check
run: ruff check backend run: ruff check backend
@@ -101,7 +101,7 @@ jobs:
- name: install dependencies - name: install dependencies
run: | run: |
python -m pip install --upgrade pip python -m pip install --upgrade pip
pip install -r requirements-dev.txt pip install -r requirements-dev.txt -r requirements-contract.txt
- name: "pytest + coverage gate (fail below 70%)" - name: "pytest + coverage gate (fail below 70%)"
run: | run: |
@@ -153,7 +153,7 @@ jobs:
run: | run: |
python -m pip install --upgrade pip python -m pip install --upgrade pip
pip install "bandit[toml]>=1.7" "pip-audit>=2.7" pip install "bandit[toml]>=1.7" "pip-audit>=2.7"
pip install -r requirements.txt pip install -r requirements.txt -r requirements-contract.txt
- name: "bandit -lll (HIGH severity gate)" - name: "bandit -lll (HIGH severity gate)"
run: | run: |
@@ -164,11 +164,11 @@ jobs:
- name: "pip-audit (known vulnerabilities gate)" - name: "pip-audit (known vulnerabilities gate)"
run: | run: |
pip-audit -r requirements.txt --progress-spinner off pip-audit -r requirements.txt -r requirements-contract.txt --progress-spinner off
- name: pip-audit json report - name: pip-audit json report
if: always() if: always()
run: pip-audit -r requirements.txt --progress-spinner off --format json -o pip-audit-report.json || true run: pip-audit -r requirements.txt -r requirements-contract.txt --progress-spinner off --format json -o pip-audit-report.json || true
- name: upload security artifacts - name: upload security artifacts
if: always() if: always()
@@ -200,6 +200,14 @@ jobs:
curl -fsSL -o /tmp/src.tar.gz "http://192.168.1.111:3000/${IMAGE_NAME}/archive/${GITHUB_SHA}.tar.gz" curl -fsSL -o /tmp/src.tar.gz "http://192.168.1.111:3000/${IMAGE_NAME}/archive/${GITHUB_SHA}.tar.gz"
tar -xzf /tmp/src.tar.gz --strip-components=1 -C . tar -xzf /tmp/src.tar.gz --strip-components=1 -C .
- name: "guard: deploy/Dockerfile"
run: |
if [ ! -f deploy/Dockerfile ]; then
echo "::error::deploy/Dockerfile отсутствует: сборка образа ждёт merge #18 (PR #49)."
echo "Пайплайн целиком проверен на ветке feat/17-verify (она же + deploy/Dockerfile)."
exit 1
fi
- name: image meta - name: image meta
id: meta id: meta
run: | run: |