Release GERM 0.4.0 with the Sonic Matter Stack alignment #55
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081 # v5 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: "22" | |
| - name: Install Python dependencies | |
| run: uv sync --extra dev | |
| - name: Python tests | |
| run: uv run pytest -q | |
| - name: Ruff | |
| run: uv run ruff check server tests | |
| # Stable Audio 3 still pins Torch 2.7.1 upstream. GERM overrides it with | |
| # the validated 2.10 pair. The two remaining local-only API findings are | |
| # tracked with a review deadline in SECURITY.md. | |
| - name: Audit all dependency extras | |
| run: | | |
| uv export --all-extras --no-emit-project --no-emit-local \ | |
| --no-emit-package akousma --no-emit-package stable-audio-3 | | |
| uvx --from pip-audit==2.10.1 pip-audit \ | |
| --requirement /dev/stdin \ | |
| --disable-pip \ | |
| --progress-spinner=off \ | |
| --ignore-vuln PYSEC-2026-139 \ | |
| --ignore-vuln CVE-2025-3000 | |
| - name: Dashboard syntax | |
| run: | | |
| node --check dashboard/static/app.js | |
| node --check dashboard/static/dish.js | |
| node --check dashboard/static/micro_forms.js | |
| node --check dashboard/static/micro_render.js | |
| node --check dashboard/static/micro_unicode.js | |
| node --check dashboard/static/ui_utils.js | |
| node --check dashboard/static/wavetable_synth.js | |
| - name: Dashboard smoke | |
| run: node scripts/smoke_dashboard.mjs |