Merge pull request #3 from sonicfieldlabs/codex/audit-backend-v0.6.5 #27
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| name: Python, Web, and macOS checks | |
| runs-on: macos-latest | |
| timeout-minutes: 20 | |
| defaults: | |
| run: | |
| working-directory: oida | |
| steps: | |
| - name: Checkout Oída | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| path: oida | |
| - name: Checkout Earworm | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| repository: sonicfieldlabs/earworm | |
| path: earworm | |
| - name: Checkout AKOÚŌ contract | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| repository: sonicfieldlabs/akouo | |
| path: akouo | |
| - name: Checkout Akousmata | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| repository: sonicfieldlabs/akousmata | |
| path: akousmata | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 | |
| - name: Install Python dependencies | |
| run: uv sync --extra dev | |
| # pytest collects the unittest.TestCase suite too; one runner is enough. | |
| - name: Run Python tests | |
| run: uv run pytest -q -W error::starlette.exceptions.StarletteDeprecationWarning | |
| - name: Lint Python | |
| run: uv run ruff check . | |
| - name: Compile Python modules | |
| run: uv run python -m compileall -q oida harness bench_adapter scripts tests | |
| # PyTorch has no patched release for two local-only advisories in APIs | |
| # Oída never calls: torch.export.load(.pt2) and torch.jit.script. | |
| - name: Audit dependency graph | |
| run: | | |
| uv export --all-extras --no-emit-project --no-emit-local | | |
| uvx --from pip-audit==2.10.1 pip-audit \ | |
| --requirement /dev/stdin \ | |
| --disable-pip \ | |
| --progress-spinner=off \ | |
| --ignore-vuln PYSEC-2026-139 \ | |
| --ignore-vuln CVE-2025-3000 | |
| - name: Check dashboard JavaScript | |
| run: | | |
| node --check oida/static/app.js | |
| node --check oida/static/remote.js | |
| - name: Build Python distributions and canonical dependency wheels | |
| run: | | |
| uv build | |
| mkdir -p "$RUNNER_TEMP/oida-wheels" | |
| uv build --wheel --out-dir "$RUNNER_TEMP/oida-wheels" ../akouo | |
| uv build --wheel --out-dir "$RUNNER_TEMP/oida-wheels" ../earworm/packages/py-akousma | |
| uv build --wheel --out-dir "$RUNNER_TEMP/oida-wheels" ../akousmata | |
| - name: Check Python distribution metadata | |
| run: uv run twine check dist/* | |
| - name: Smoke isolated Python wheel | |
| working-directory: ${{ runner.temp }} | |
| env: | |
| UV_FIND_LINKS: ${{ runner.temp }}/oida-wheels | |
| run: >- | |
| uv run --isolated --no-project | |
| --with "$GITHUB_WORKSPACE"/oida/dist/sonicfield_oida-*.whl | |
| python -c 'import importlib.resources as r; import oida, oida.reasoning.audio_router, oida.server; assert r.files("oida").joinpath("integration_assets", "codex", "README.md").is_file(); print(oida.__version__)' | |
| - name: Build macOS shell | |
| working-directory: oida/apps/macos | |
| run: | | |
| swift build | |
| swift build -Xswiftc -strict-concurrency=complete | |
| - name: Package unsigned app | |
| run: apps/macos/script/package_unsigned.sh | |
| - name: Release smoke | |
| run: scripts/release_smoke_with_stub.sh |