Add homelab CI with hard ruff/pytest gates

Adds .gitea/workflows/ci.yml (python-ci with tesseract + libgl for the OCR/opencv tests, plus gitleaks secret-scan) and ruff.toml (E4/E7/E9/F/I, line-length 120). Cleans up the remaining unused-variable findings so the lint gate is green.
2026-07-26 15:37:45 -04:00
parent 2ac7638e31
commit 17be9cef33
4 changed files with 48 additions and 3 deletions
@@ -0,0 +1,44 @@
+---
+# Homelab CI — Python lane + secret scan. Lint and tests are HARD gates.
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  python-ci:
+    runs-on: [homelab, self-hosted, linux, python]
+    container:
+      image: node:20-bookworm
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Python tooling
+        run: |
+          apt-get update -qq
+          DEBIAN_FRONTEND=noninteractive apt-get install -y -qq \
+            python3 python3-pip python3-venv \
+            tesseract-ocr libgl1 libglib2.0-0
+          python3 -m pip install --upgrade pip --break-system-packages
+          pip install -r requirements.txt --break-system-packages
+          pip install pytest ruff --break-system-packages
+
+      - name: Ruff lint (hard gate)
+        run: ruff check .
+
+      - name: Pytest (hard gate)
+        run: pytest -q
+
+  secret-scan:
+    runs-on: [homelab, self-hosted, linux, heavy]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Gitleaks
+        run: |
+          docker run --rm -v "$PWD:/repo" ghcr.io/gitleaks/gitleaks:latest \
+            detect --source /repo --no-banner --redact