Merge pull request #18 from sandeep-jay/docs/readme-product-voice #61
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| jobs: | |
| secrets-scan: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| - name: Run gitleaks | |
| uses: gitleaks/gitleaks-action@v2 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Byte-compile secret scanner | |
| run: python -m py_compile scripts/secret_patterns.py | |
| - name: Run in-repo secret scanner across tracked files | |
| run: | | |
| python - <<'PYSCAN' | |
| import subprocess, sys | |
| from pathlib import Path | |
| sys.path.insert(0, "scripts") | |
| from secret_patterns import find_secrets | |
| tracked = subprocess.check_output(["git", "ls-files"], text=True).splitlines() | |
| skip_ext = {".png",".jpg",".jpeg",".gif",".webp",".svg",".ico",".pdf",".zip",".gz",".tar",".lock",".parquet",".woff",".woff2",".so",".dylib",".dll",".bin"} | |
| hits = [] | |
| for rel in tracked: | |
| p = Path(rel) | |
| if p.suffix.lower() in skip_ext: | |
| continue | |
| try: | |
| text = p.read_text(encoding="utf-8", errors="ignore") | |
| except Exception: | |
| continue | |
| for f in find_secrets(text): | |
| hits.append((rel, f.line_no, f.name, f.line_excerpt)) | |
| print(f"Scanned {len(tracked)} tracked paths; findings={len(hits)}") | |
| for h in hits: | |
| print(f"::error file={h[0]},line={h[1]}::{h[2]} :: {h[3]}") | |
| sys.exit(1 if hits else 0) | |
| PYSCAN | |
| - name: Sanity-check git pre-commit hook against PR diff | |
| if: github.event_name == 'pull_request' | |
| run: | | |
| git config core.hooksPath .githooks | |
| base="${{ github.event.pull_request.base.sha }}" | |
| head="${{ github.event.pull_request.head.sha }}" | |
| git diff --name-only --diff-filter=ACMRT "$base" "$head" > /tmp/_pr_changed.txt || true | |
| if [ -s /tmp/_pr_changed.txt ]; then | |
| git reset --soft "$base" | |
| xargs -a /tmp/_pr_changed.txt git add -- | |
| .githooks/pre-commit | |
| else | |
| echo "no PR diff to scan" | |
| fi | |
| backend-lint: | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: backend | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| - name: Cache pip | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/.cache/pip | |
| key: ${{ runner.os }}-pip-lint-${{ hashFiles('backend/pyproject.toml', 'backend/tox.ini') }} | |
| restore-keys: | | |
| ${{ runner.os }}-pip-lint- | |
| ${{ runner.os }}-pip- | |
| - name: Install lint toolchain | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install tox | |
| - name: Run backend lint (ruff via tox -e lint) | |
| run: tox -e lint | |
| backend: | |
| runs-on: ubuntu-latest | |
| needs: backend-lint | |
| services: | |
| postgres: | |
| image: pgvector/pgvector:pg16 | |
| env: | |
| POSTGRES_USER: rag | |
| POSTGRES_PASSWORD: rag_dev_password | |
| POSTGRES_DB: rag_dev | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd "pg_isready -U rag -d rag_dev" | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| env: | |
| DATABASE_URL: postgresql://rag:rag_dev_password@127.0.0.1:5432/rag_dev | |
| TEST_DATABASE_URL: postgresql://rag:rag_dev_password@127.0.0.1:5432/rag_dev | |
| defaults: | |
| run: | |
| working-directory: backend | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| - name: Cache pip | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/.cache/pip | |
| key: ${{ runner.os }}-pip-${{ hashFiles('backend/pyproject.toml', 'backend/tox.ini') }} | |
| restore-keys: | | |
| ${{ runner.os }}-pip- | |
| - name: Install backend dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e .[dev] | |
| - name: Run migrations | |
| run: alembic upgrade head | |
| - name: Run backend tests (tox -e py311) | |
| run: tox -e py311 | |
| frontend-lint: | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: frontend | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: "20" | |
| cache: "npm" | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Lint frontend | |
| run: npm run lint | |
| frontend-build: | |
| runs-on: ubuntu-latest | |
| needs: frontend-lint | |
| defaults: | |
| run: | |
| working-directory: frontend | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: "20" | |
| cache: "npm" | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Build frontend | |
| run: npm run build | |
| frontend: | |
| runs-on: ubuntu-latest | |
| needs: [frontend-lint, frontend-build] | |
| defaults: | |
| run: | |
| working-directory: frontend | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: "20" | |
| cache: "npm" | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Install Playwright browsers | |
| run: npx playwright install --with-deps chromium | |
| - name: Run Playwright critical journeys | |
| run: npm run test:e2e tests/e2e/smoke.spec.ts tests/e2e/patients.spec.ts tests/e2e/chat.spec.ts tests/e2e/responsible-ai.spec.ts tests/e2e/encounter.spec.ts |