deps(deps): bump cryptography (#96) #251
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| "on": | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: ['**'] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # ============================================================================ | |
| # LAYER 1: Fast feedback (~1-2 min) | |
| # ============================================================================ | |
| pre-commit: | |
| name: Pre-commit hooks | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: "3.12" | |
| - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v5 | |
| with: | |
| path: ~/.cache/pre-commit | |
| key: pre-commit-${{ env.pythonLocation }}-${{ hashFiles('.pre-commit-config.yaml') }} | |
| - run: pip install pre-commit | |
| - run: pre-commit run --show-diff-on-failure --color=always --all-files | |
| # ============================================================================ | |
| # LAYER 2: Testing | |
| # CI = all Python versions on Linux only (minimal, cheap: 1x minutes). | |
| # macOS (10x) / Windows (2x) spot-checks run at RELEASE time in cd.yml | |
| # (pre-release-tests), not on every push. | |
| # ============================================================================ | |
| test: | |
| name: Test (Python ${{ matrix.python-version }} / ${{ matrix.os }}) | |
| needs: [pre-commit] | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 20 | |
| permissions: | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest] | |
| python-version: ['3.11', '3.12', '3.13'] | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0 | |
| with: | |
| enable-cache: true | |
| - name: Install dependencies | |
| run: uv pip install -e ".[dev,gui]" --system | |
| - name: Check dependency hygiene (deptry) | |
| if: runner.os == 'Linux' && matrix.python-version == '3.12' | |
| run: deptry src tests | |
| - name: Run tests with coverage | |
| shell: bash | |
| run: | | |
| pytest tests/ -v \ | |
| --cov=src/certamen \ | |
| --cov-report=xml \ | |
| --cov-report=term-missing \ | |
| --cov-branch \ | |
| --junitxml=test-results.xml | |
| - name: Enforce coverage threshold | |
| if: runner.os == 'Linux' && matrix.python-version == '3.12' | |
| run: coverage report --fail-under=30 | |
| - name: Upload coverage report | |
| if: runner.os == 'Linux' && matrix.python-version == '3.12' | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: coverage-report | |
| path: | | |
| coverage.xml | |
| test-results.xml | |
| retention-days: 1 | |
| # ============================================================================ | |
| # LAYER 3: Quality analysis (non-blocking, main only) | |
| # ============================================================================ | |
| mutation-testing: | |
| name: Mutation Testing | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| continue-on-error: true | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: "3.12" | |
| - uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0 | |
| with: | |
| enable-cache: true | |
| - name: Install dependencies | |
| run: | | |
| uv pip install -e ".[dev]" --system | |
| uv pip install pytest-timeout --system | |
| - name: Run mutation testing | |
| env: | |
| PYTHONPATH: ${{ github.workspace }}/src | |
| run: | | |
| echo "=== Running Mutation Testing ===" | |
| cd ${{ github.workspace }} | |
| mutmut run || true | |
| - name: Generate mutation report | |
| run: | | |
| echo "=== Mutation Testing Results ===" | |
| mutmut results || true | |
| echo "" | |
| echo "=== Survived Mutants ===" | |
| mutmut results --survived 2>/dev/null || true | |
| complexity-checks: | |
| name: Complexity & Maintainability | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: "3.12" | |
| - run: pip install radon | |
| - name: Check cyclomatic complexity | |
| run: | | |
| echo "=== Cyclomatic Complexity Report ===" | |
| radon cc src/certamen/ --min B --show-complexity --total-average | |
| - name: Check maintainability index | |
| run: | | |
| echo "=== Maintainability Index Report ===" | |
| radon mi src/certamen/ --min B --show | |
| - name: Fail on high complexity | |
| run: | | |
| radon cc src/certamen/ --min C --total-average || \ | |
| (echo "::warning::High complexity detected (grade C or worse)" && exit 0) | |
| architecture-checks: | |
| name: Architecture & Import Contracts | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| continue-on-error: true | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: "3.12" | |
| - uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0 | |
| with: | |
| enable-cache: true | |
| - name: Install dependencies | |
| run: | | |
| uv pip install -e . --system | |
| uv pip install import-linter --system | |
| - name: Validate architecture | |
| run: lint-imports || echo "::warning::Architecture violations detected" | |
| frontend: | |
| name: Frontend (Biome + types) | |
| needs: [pre-commit] | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: "22" | |
| cache: npm | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: Install dependencies | |
| run: npm ci | |
| working-directory: frontend | |
| - name: Biome check (lint + format) | |
| run: npx biome ci . | |
| working-directory: frontend | |
| - name: Type check | |
| run: npx tsc -b | |
| working-directory: frontend | |
| - name: Unit tests (Vitest) | |
| run: npx vitest run | |
| working-directory: frontend |