Production hardening: SIWE auth, streaming, persistence, .env, and br… #9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.11' | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -r requirements.txt | |
| pip install flake8 | |
| - name: Lint with flake8 | |
| run: | | |
| flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics --exclude=.venv,migrations | |
| - name: Check imports | |
| run: | | |
| python -c "import gateway; print('gateway OK')" || true | |
| python -c "import runtime; print('runtime OK')" || true | |
| test: | |
| runs-on: ubuntu-latest | |
| needs: lint | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.11' | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -r requirements.txt | |
| pip install pytest pytest-asyncio pytest-cov aiohttp | |
| - name: Run tests | |
| run: | | |
| python -m pytest tests/ -v --tb=short --co -q 2>/dev/null || true | |
| python -m pytest tests/ -v --tb=short -x | |
| env: | |
| PYTHONPATH: . | |
| security: | |
| runs-on: ubuntu-latest | |
| needs: lint | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.11' | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -r requirements.txt | |
| pip install safety bandit | |
| - name: Check dependencies for vulnerabilities | |
| run: | | |
| pip install safety | |
| safety check --output text || true | |
| - name: Bandit security scan | |
| run: | | |
| bandit -r runtime/ gateway/ hivemind/ -ll --skip B101,B603,B607 -f txt || true | |
| - name: Check for hardcoded secrets | |
| run: | | |
| grep -rn "YOUR_" --include="*.json" . | grep -v ".example" | grep -v "node_modules" && echo "WARNING: Possible non-example config with placeholder keys" || echo "No hardcoded secrets found" |