chore(deps): Update a2a-sdk requirement from <1.0,>=0.3.20 to >=0.3.20,<2.0 #68
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main, master] | |
| pull_request: | |
| branches: [main, master] | |
| permissions: | |
| contents: read | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install | |
| run: pip install -e ".[dev]" | |
| - name: Ruff lint | |
| run: ruff check airlock tests examples | |
| - name: Ruff format | |
| run: ruff format --check airlock tests examples | |
| - name: Mypy | |
| run: mypy airlock || echo "::warning::mypy found type errors — see above for details" | |
| security: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install | |
| run: pip install -e ".[dev,redis,a2a]" bandit pip-audit | |
| - name: Bandit (security linter) | |
| run: bandit -r airlock -c pyproject.toml -f sarif -o bandit-results.sarif || true | |
| - name: Upload Bandit SARIF | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: bandit-results.sarif | |
| category: bandit | |
| continue-on-error: true | |
| - name: Bandit (check for HIGH severity) | |
| run: | | |
| bandit -r airlock -c pyproject.toml -f json -o bandit-check.json || true | |
| python -c " | |
| import json, sys | |
| with open('bandit-check.json') as f: | |
| data = json.load(f) | |
| results = data.get('results', []) | |
| high = [r for r in results if r['issue_severity'] == 'HIGH'] | |
| if high: | |
| for r in high: | |
| print(f\"HIGH: {r['issue_text']} at {r['filename']}:{r['line_number']}\") | |
| print(f'FAIL: {len(high)} HIGH severity findings') | |
| sys.exit(1) | |
| print(f'OK: No HIGH severity findings ({len(results)} total)') | |
| " | |
| - name: pip-audit (dependency vulnerabilities) | |
| run: pip-audit || echo "::warning::pip-audit found vulnerabilities — review output above" | |
| test: | |
| runs-on: ubuntu-latest | |
| needs: [lint] | |
| strategy: | |
| matrix: | |
| python-version: ["3.11", "3.12"] | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install | |
| run: pip install -e ".[dev,redis,a2a]" pytest-cov | |
| - name: Test with coverage | |
| run: python -m pytest tests/ -v --tb=short --cov=airlock --cov-report=term-missing --cov-report=xml | |
| - name: Upload coverage | |
| if: matrix.python-version == '3.12' | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: coverage-report | |
| path: coverage.xml | |
| dco: | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: DCO check | |
| run: | | |
| base=${{ github.event.pull_request.base.sha }} | |
| head=${{ github.event.pull_request.head.sha }} | |
| failed=0 | |
| for sha in $(git rev-list "$base".."$head"); do | |
| msg=$(git log -1 --format=%B "$sha") | |
| if ! echo "$msg" | grep -qi "Signed-off-by:"; then | |
| echo "FAIL: Commit $sha missing Signed-off-by" | |
| failed=1 | |
| fi | |
| done | |
| if [ "$failed" -eq 1 ]; then | |
| echo "" | |
| echo "All commits must include a DCO sign-off." | |
| echo "Use: git commit -s -m 'your message'" | |
| echo "See: https://developercertificate.org/" | |
| exit 1 | |
| fi | |
| echo "OK: All commits have DCO sign-off" | |
| docker-build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Docker build (gateway image) | |
| run: docker build -t airlock-gateway:ci . | |
| js: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: "20" | |
| cache: npm | |
| - name: Install npm workspaces | |
| run: npm ci | |
| - name: Build TypeScript SDK + MCP | |
| run: npm run build:js |