risk-control/.github/workflows/ci.yml at e43a2eb07df9afcf79fdb44cb4bc638166a25e7d · thibaultcordier/risk-control · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
name: CI/CD Pipeline

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  release:
    types: [published]

env:
  UV_VERSION: "0.8.13"
  MIN_COVERAGE: 0
  PYTHON_VERSION: "3.13"  # Default Python version for non-matrix jobs

jobs:
  lint:
    name: Lint and Format
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Setup Python Environment
      uses: ./.github/actions/setup-python
      with:
        python-version: ${{ env.PYTHON_VERSION }}
        uv-version: ${{ env.UV_VERSION }}

    - name: Run linting
      run: |
        uv run make lint

    - name: Check code formatting
      run: |
        uv run make format

    - name: Run pre-commit hooks
      run: |
        uv run make pre-commit

  type-check:
    name: Type Checking
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Setup Python Environment
      uses: ./.github/actions/setup-python
      with:
        python-version: ${{ env.PYTHON_VERSION }}
        uv-version: ${{ env.UV_VERSION }}

    - name: Run type checking
      run: |
        uv run make type-check

  test:
    name: Tests
    runs-on: ${{ matrix.os }}
    needs: [lint, type-check]
    timeout-minutes: 30
    strategy:
      matrix:
        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
        os: [ubuntu-latest, macos-latest]

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Setup Python Environment
      uses: ./.github/actions/setup-python
      with:
        python-version: ${{ matrix.python-version }}
        uv-version: ${{ env.UV_VERSION }}
        cache-key: ${{ matrix.python-version }}

    - name: Run tests with coverage
      run: |
        uv run make tests

    - name: Generate coverage report
      run: |
        uv run make report-tests

    - name: Check coverage threshold
      run: |
        uv run coverage report --show-missing --fail-under=${{ env.MIN_COVERAGE }}

    - name: Upload coverage to Codecov
      uses: codecov/codecov-action@v5
      with:
        file: ./coverage.xml
        flags: unittests
        name: codecov-umbrella
        fail_ci_if_error: false
        token: ${{ secrets.CODECOV_TOKEN }}  # Optional: Add if you have a token

  security:
    name: Security Scan
    runs-on: ubuntu-latest
    needs: test
    timeout-minutes: 15

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Setup Python Environment
      uses: ./.github/actions/setup-python
      with:
        python-version: ${{ env.PYTHON_VERSION }}
        uv-version: ${{ env.UV_VERSION }}

    - name: Run bandit security scan
      run: |
        uv run bandit -r mlrisko/ -f json -o bandit-report.json || true

    - name: Run pip-audit for dependency vulnerabilities
      run: |
        uv run pip install pip-audit
        uv run pip-audit --format json --output pip-audit-report.json || true

    - name: Upload security scan results
      uses: actions/upload-artifact@v4
      with:
        name: security-scan-results
        path: |
          bandit-report.json
          pip-audit-report.json

  docs:
    name: Build Documentation
    runs-on: ubuntu-latest
    needs: [test, security]
    if: github.event_name == 'release'
    timeout-minutes: 20

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Setup Python Environment
      uses: ./.github/actions/setup-python
      with:
        python-version: ${{ env.PYTHON_VERSION }}
        uv-version: ${{ env.UV_VERSION }}

    - name: Install documentation dependencies
      run: |
        uv sync --group docs

    - name: Build documentation
      run: |
        uv run make docs

    - name: Deploy to GitHub Pages
      uses: peaceiris/actions-gh-pages@v3
      with:
        github_token: ${{ secrets.GITHUB_TOKEN }}
        publish_dir: ./site