| 1 | name: CI |
| 2 | |
| 3 | on: |
| 4 | push: |
| 5 | branches: |
| 6 | - main |
| 7 | pull_request: |
| 8 | branches: |
| 9 | - main |
| 10 | |
| 11 | permissions: |
| 12 | contents: read |
| 13 | |
| 14 | concurrency: |
| 15 | group: ${{ github.workflow }}-${{ github.ref }} |
| 16 | cancel-in-progress: true |
| 17 | |
| 18 | jobs: |
| 19 | python: |
| 20 | name: Python |
| 21 | runs-on: ubuntu-latest |
| 22 | |
| 23 | steps: |
| 24 | - name: Checkout code |
| 25 | uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 |
| 26 | with: |
| 27 | persist-credentials: false |
| 28 | |
| 29 | - name: Set up Python |
| 30 | uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 |
| 31 | with: |
| 32 | python-version: "3.12" |
| 33 | cache: pip |
| 34 | cache-dependency-path: requirements.txt |
| 35 | |
| 36 | - name: Install Python dependencies |
| 37 | run: | |
| 38 | python -m pip install --upgrade pip |
| 39 | python -m pip install -r requirements.txt pytest pip-audit |
| 40 | |
| 41 | - name: Audit Python dependencies |
| 42 | run: python -m pip_audit -r requirements.txt |
| 43 | |
| 44 | - name: Run Python tests |
| 45 | run: python -m pytest |
| 46 | |
| 47 | - name: Validate image registry |
| 48 | run: python scripts/manage_image_registry.py validate |
| 49 | |
| 50 | - name: Validate content images (no hotlinks/secrets) |
| 51 | run: python scripts/validate_content_images.py |