"Claude Code Review workflow" #116
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main, develop, "feat/**"] | |
| pull_request: | |
| # Least privilege: this workflow only lints, type-checks, tests, and builds — | |
| # it never writes to the repo. Pin GITHUB_TOKEN to read-only so a compromised | |
| # build/test step (a malicious transitive dependency, a poisoned action) cannot | |
| # push, tamper with releases, or mint artifacts with an over-scoped token. | |
| permissions: | |
| contents: read | |
| jobs: | |
| python: | |
| name: Python lint, types, tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v5 | |
| - name: Set up Python | |
| run: uv python install 3.13 | |
| - name: Install (locked toolchain, dev extras) | |
| # Install from uv.lock, not a fresh resolve. `uv pip install` re-resolves | |
| # `ruff>=0.5` (and mypy/pytest) to the latest release every run, so a new | |
| # linter version can turn CI red on unchanged code with rules the pinned | |
| # ruff never flagged. `uv sync --locked` pins the whole toolchain to the | |
| # lockfile, keeping lint/type/test runs reproducible; bump deliberately | |
| # by updating uv.lock. | |
| run: uv sync --locked --extra dev | |
| - name: Ruff | |
| run: uv run ruff check src/ | |
| - name: Mypy (strict) | |
| run: uv run mypy src/ | |
| - name: Pytest | |
| run: uv run pytest -q -p no:warnings | |
| web: | |
| name: Dashboard build and unit tests | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: web | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| cache-dependency-path: web/package-lock.json | |
| - name: Install | |
| run: npm ci | |
| - name: Build bundle | |
| run: npm run build | |
| - name: Unit tests (Vitest) | |
| run: npm run test | |
| # Note: the built bundle is committed under src/caucus/ui/ as package | |
| # data. Vite content hashes are deterministic for a given toolchain, so | |
| # the canonical refresh is a local `npm run build` before committing. | |
| # A strict committed-vs-rebuilt diff is intentionally NOT enforced here | |
| # because it is sensitive to the exact Node/Vite versions of the runner. | |
| e2e: | |
| name: Dashboard E2E (Playwright) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v5 | |
| - name: Set up Python + package | |
| run: | | |
| uv python install 3.13 | |
| uv venv | |
| uv pip install -e ".[dev]" | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| cache-dependency-path: web/package-lock.json | |
| - name: Install web deps + build | |
| working-directory: web | |
| run: | | |
| npm ci | |
| npm run build | |
| - name: Install Playwright browser | |
| working-directory: web | |
| run: npx playwright install --with-deps chromium | |
| - name: Run E2E | |
| working-directory: web | |
| run: npm run e2e |