GitHub Actions CI/CD Workflow

This repository includes a comprehensive GitHub Actions workflow for continuous integration and deployment.

Workflow Overview

The CI/CD pipeline (.github/workflows/ci.yml) includes four main jobs:

1. Code Quality & Security (code-quality)

• Linting: Uses flake8 to check for Python syntax errors and code style issues
• Formatting: Uses black to ensure consistent code formatting
• Security: Uses bandit to scan for security vulnerabilities
• Artifacts: Uploads security reports for review

2. Multi-Platform Compatibility Testing (test-compatibility)

• Python Versions: Tests on Python 3.7, 3.8, 3.9, 3.10, and 3.11
• Operating Systems: Tests on Ubuntu, Windows, and macOS
• Dependencies: Installs required system dependencies (ffmpeg, lame)
• Basic Validation: Syntax checks and import tests

3. Dependency Audit (dependency-audit)

• Security: Uses safety to check for known vulnerabilities in dependencies
• Reports: Generates vulnerability reports as artifacts

4. Build Summary (build-summary)

• Status Check: Aggregates results from all previous jobs
• Final Report: Provides overall CI/CD status

Workflow Triggers

The workflow runs on:

• Push to main or master branch
• Pull requests to main or master branch
• Manual trigger via GitHub UI (workflow_dispatch)

Requirements

The workflow automatically installs:

• Python Dependencies: Listed in requirements.txt
• System Dependencies:
  • Ubuntu: ffmpeg, lame
  • macOS: ffmpeg, lame (via Homebrew)
  • Windows: Dependencies handled by pip packages

Workflow Features

Performance Optimizations

• Caching: pip dependencies are cached to speed up builds
• Fail-Fast: Matrix builds fail independently to get faster feedback
• Parallel Execution: Jobs run concurrently when possible

Security & Best Practices

• Pinned Actions: Uses specific versions of GitHub Actions
• Security Scanning: Multiple layers of security analysis
• Artifact Storage: Security and vulnerability reports are preserved
• Matrix Strategy: Reduces redundant testing while maintaining coverage

Error Handling

• Graceful Failures: Individual matrix jobs can fail without stopping others
• Detailed Reporting: Clear status messages for debugging
• Artifact Uploads: Reports are uploaded even when jobs fail

Local Development

To run the same checks locally:

# Install dependencies
pip install -r requirements.txt

# Run linting
flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics

# Check formatting
black --check --diff .

# Security scan
bandit -r .

# Dependency vulnerability check
pip install safety
safety check

Viewing Results

• Actions Tab: View workflow runs in the GitHub repository
• Pull Requests: Status checks appear in PR reviews
• Artifacts: Download detailed reports from completed runs
• Status Badges: Add workflow status badges to README if desired

Customization

The workflow can be customized by:

• Modifying the Python version matrix in ci.yml
• Adding or removing operating systems
• Adjusting code quality tool configurations
• Adding additional security or testing tools
• Modifying trigger conditions

For more information about GitHub Actions, see the official documentation.