chore(deps): patch known security vulnerabilities #43

	name: CI

	on:
	push:
	branches:
	- main
	pull_request:
	workflow_dispatch:

	permissions:
	contents: read

	jobs:
	python:
	name: Python checks
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v5

	- name: Install uv
	uses: astral-sh/setup-uv@v8.1.0
	with:
	enable-cache: true

	- name: Set up Python
	uses: actions/setup-python@v6
	with:
	python-version-file: .python-version

	- name: Verify lockfile
	run: uv lock --check

	- name: Install dependencies
	run: uv sync --locked

	- name: Lint (ruff)
	run: uvx ruff check pure_auto_codeql Analyze.py config.py test

	- name: Run tests
	run: uv run pytest -q

	- name: Compile Python modules
	run: uv run python -m compileall -q Analyze.py pure_auto_codeql


	- name: Check diff whitespace
	run: git diff --check

	mcp-ripgrep:
	name: MCP ripgrep checks
	runs-on: ubuntu-latest
	defaults:
	run:
	working-directory: tools/mcp_ripgrep
	steps:
	- name: Checkout
	uses: actions/checkout@v5

	- name: Set up Node.js
	uses: actions/setup-node@v6
	with:
	node-version: "22"
	cache: npm
	cache-dependency-path: tools/mcp_ripgrep/package-lock.json

	- name: Install dependencies
	run: npm ci

	- name: Audit dependencies
	run: npm audit --audit-level=high

	- name: Build
	run: npm run build

Navigation Menu