feat: Forward docker build secrets to parse-level verification (#27) #88
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| unit: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 | |
| - name: Unit tests (no network — fixtures) | |
| run: uv run --with pytest python -m pytest tests/ -q | |
| - name: Lint | |
| run: uv run --with ruff ruff check scripts/ tests/ | |
| shellcheck: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: ShellCheck | |
| # Floor at warning: SC2317/SC2329 (trap-handler "unreachable"/"unused") | |
| # are info-level false positives whose presence varies by shellcheck | |
| # version, so they must not gate CI across runner-image updates. | |
| run: | | |
| sudo apt-get update && sudo apt-get install -y shellcheck | |
| shellcheck --severity=warning scripts/*.sh | |
| yamllint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: yaml-lint | |
| uses: ibiqlik/action-yamllint@2576378a8e339169678f9939646ee3ee325e845c # v3.1.1 | |
| with: | |
| file_or_dir: action.yaml .github/workflows |