germ/.github/workflows/ci.yml at 2cec849d44086b31e58a35ecd50825b4348db656 · sonicfieldlabs/germ · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
name: CI

on:
  push:
  pull_request:

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081 # v5
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: "22"
      - name: Install Python dependencies
        run: uv sync --extra dev
      - name: Python tests
        run: uv run pytest -q
      - name: Ruff
        run: uv run ruff check server tests
      # Stable Audio 3 still pins Torch 2.7.1 upstream. GERM overrides it with
      # the validated 2.10 pair. The two remaining local-only API findings are
      # tracked with a review deadline in SECURITY.md.
      - name: Audit all dependency extras
        run: |
          uv export --all-extras --no-emit-project --no-emit-local \
            --no-emit-package akousma --no-emit-package stable-audio-3 |
            uvx --from pip-audit==2.10.1 pip-audit \
              --requirement /dev/stdin \
              --disable-pip \
              --progress-spinner=off \
              --ignore-vuln PYSEC-2026-139 \
              --ignore-vuln CVE-2025-3000
      - name: Dashboard syntax
        run: |
          node --check dashboard/static/app.js
          node --check dashboard/static/dish.js
          node --check dashboard/static/micro_forms.js
          node --check dashboard/static/micro_render.js
          node --check dashboard/static/micro_unicode.js
          node --check dashboard/static/ui_utils.js
          node --check dashboard/static/wavetable_synth.js
      - name: Dashboard smoke
        run: node scripts/smoke_dashboard.mjs