chore(deps): update llama-index-embeddings-ollama requirement (#45) #113
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_call: | |
| jobs: | |
| backend: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: astral-sh/setup-uv@v7 | |
| with: | |
| enable-cache: true | |
| - name: Install | |
| run: uv sync --extra dev --extra evals | |
| - name: Lint | |
| run: uv run ruff check src tests | |
| - name: Security scan (bandit) | |
| run: uv run bandit -c pyproject.toml -r src | |
| - name: Typecheck | |
| run: uv run mypy src | |
| - name: Test | |
| env: | |
| # Dummy values so config "is this configured?" checks pass; no real | |
| # network calls are made in the mocked test suite (see auth.py / | |
| # supabase_store.py — invalid tokens fail parsing before any | |
| # request reaches these URLs). | |
| SUPABASE_URL: https://example.com | |
| SUPABASE_SECRET_KEY: dummy-secret-key-for-ci | |
| SUPABASE_JWKS_URL: https://example.com/auth/v1/.well-known/jwks.json | |
| run: >- | |
| uv run python -m pytest tests/ -q | |
| --cov=src | |
| --cov-fail-under=73 | |
| --cov-report=term-missing | |
| --cov-report=xml:coverage.xml | |
| - name: Upload backend coverage | |
| if: always() | |
| uses: actions/upload-artifact@v7.0.1 | |
| with: | |
| name: backend-coverage | |
| path: coverage.xml | |
| if-no-files-found: warn | |
| - name: AI regression gate | |
| if: always() | |
| run: uv run python -m src.evals.regression_gate --output reports/ai-regression-${{ github.sha }}.json | |
| - name: Upload AI regression score | |
| if: always() | |
| uses: actions/upload-artifact@v7.0.1 | |
| with: | |
| name: ai-regression-${{ github.sha }} | |
| path: reports/ai-regression-${{ github.sha }}.json | |
| if-no-files-found: error | |
| ui: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| defaults: | |
| run: | |
| working-directory: ui | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: actions/setup-node@v5 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| cache-dependency-path: ui/package-lock.json | |
| - name: Install | |
| run: npm ci | |
| - name: Lint | |
| run: npx eslint src --max-warnings=0 | |
| - name: Typecheck | |
| run: npx tsc --noEmit -p tsconfig.app.json | |
| - name: Test with coverage | |
| run: npm run test:coverage | |
| - name: Upload UI coverage | |
| if: always() | |
| uses: actions/upload-artifact@v7.0.1 | |
| with: | |
| name: ui-coverage | |
| path: ui/coverage/ | |
| if-no-files-found: warn | |
| - name: Install Playwright browser | |
| run: npx playwright install --with-deps chromium | |
| - name: Browser smoke test | |
| run: npx playwright test | |
| - name: Upload Playwright failure artifacts | |
| if: failure() | |
| uses: actions/upload-artifact@v7.0.1 | |
| with: | |
| name: playwright-failure-artifacts | |
| path: | | |
| ui/playwright-report/ | |
| ui/test-results/ | |
| if-no-files-found: ignore | |
| retention-days: 14 | |
| security: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| needs: [backend, ui] | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Build image | |
| run: docker build -t cortex:${{ github.sha }} . | |
| - name: Generate container SBOM | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: cortex:${{ github.sha }} | |
| format: cyclonedx | |
| output: cortex-sbom.cdx.json | |
| scanners: vuln | |
| - name: Upload container SBOM | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: cortex-sbom-${{ github.sha }} | |
| path: cortex-sbom.cdx.json | |
| if-no-files-found: error | |
| retention-days: 30 | |
| - name: Scan repository dependencies and configuration | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: fs | |
| scan-ref: . | |
| scanners: vuln,misconfig,secret | |
| severity: HIGH,CRITICAL | |
| ignore-unfixed: true | |
| exit-code: 1 | |
| format: table | |
| - name: Scan container image | |
| if: always() | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: cortex:${{ github.sha }} | |
| scanners: vuln,misconfig,secret | |
| severity: HIGH,CRITICAL | |
| ignore-unfixed: true | |
| exit-code: 1 | |
| format: table |