Model-deploy command — load the local YAML model into serving Postgres #80
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| # The unbypassable quality + secret gate on every PR (local hooks can be skipped; | |
| # CI can't). Config lives in pyproject.toml so nothing is duplicated here. | |
| # Branch protection is what makes these checks *required* to merge. | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| lint-and-test: | |
| name: lint + test (py${{ matrix.python-version }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.10", "3.11", "3.12"] | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| # Lint + import sorting — blocking. Rules come from pyproject.toml. | |
| # packages/ holds the agami-core library. | |
| - name: ruff check | |
| run: uvx ruff@0.15.19 check plugins packages tests | |
| # Format check is informational for now: the tree has a large unformatted | |
| # backlog (~74 files). Flip `continue-on-error` off after a dedicated | |
| # `ruff format` pass makes the tree clean. | |
| - name: ruff format --check (informational) | |
| run: uvx ruff@0.15.19 format --check plugins packages tests | |
| continue-on-error: true | |
| # The suite imports the agami-core library, so install it editable with the | |
| # [model] extra (pydantic/pyyaml/sqlglot — sqlglot backs the binding-validation and | |
| # unit-resolution paths; without it ~287 tests skip). DB drivers are intentionally | |
| # omitted: those tests skip cleanly without a database. | |
| - name: pytest --cov | |
| run: >- | |
| uvx --python ${{ matrix.python-version }} | |
| --with pytest --with pytest-cov | |
| --with-editable "packages/agami-core[model,server]" | |
| pytest tests/ -q --cov=plugins --cov=packages/agami-core/src --cov-report=term-missing | |
| gitleaks: | |
| name: gitleaks (secret scan) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| fetch-depth: 0 # full history, so a secret in any commit is caught | |
| # Run the gitleaks binary directly: the gitleaks-action requires a paid | |
| # license for organization repos; the CLI does not. Pinned to a release. | |
| - name: gitleaks detect | |
| run: | | |
| V=8.30.1 | |
| base="https://github.com/gitleaks/gitleaks/releases/download/v${V}" | |
| curl -sSfL -O "${base}/gitleaks_${V}_linux_x64.tar.gz" | |
| curl -sSfL -O "${base}/gitleaks_${V}_checksums.txt" | |
| # Verify the download: pull the exact checksum line for our artifact and check it, | |
| # failing if that line is absent (so a renamed/missing entry can't skip verification). | |
| grep "gitleaks_${V}_linux_x64.tar.gz$" "gitleaks_${V}_checksums.txt" | sha256sum -c - | |
| tar -xzf "gitleaks_${V}_linux_x64.tar.gz" gitleaks | |
| ./gitleaks detect --source . --redact --no-banner |