ilia
23a44c37a1
The OCR integration tests self-skip without the tesseract binary. Debian's tesseract reads the synthetic receipt dates differently than the brew build (2023 -> 2028), so keep those tests local-only for now.
48 lines
1.4 KiB
YAML
48 lines
1.4 KiB
YAML
---
|
|
# Homelab CI — Python lane + secret scan. Lint and tests are HARD gates.
|
|
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [master]
|
|
pull_request:
|
|
types: [opened, synchronize, reopened]
|
|
|
|
jobs:
|
|
python-ci:
|
|
runs-on: [homelab, self-hosted, linux, python]
|
|
container:
|
|
image: node:20-bookworm
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install Python tooling
|
|
run: |
|
|
apt-get update -qq
|
|
# No tesseract here on purpose: the OCR integration tests self-skip
|
|
# without the binary, and Debian's tesseract build misreads the
|
|
# synthetic fixtures that pass with the macOS/brew build.
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y -qq \
|
|
python3 python3-pip python3-venv \
|
|
libgl1 libglib2.0-0
|
|
python3 -m pip install --upgrade pip --break-system-packages
|
|
pip install -r requirements.txt --break-system-packages
|
|
pip install pytest ruff --break-system-packages
|
|
|
|
- name: Ruff lint (hard gate)
|
|
run: ruff check .
|
|
|
|
- name: Pytest (hard gate)
|
|
run: pytest -q
|
|
|
|
secret-scan:
|
|
runs-on: [homelab, self-hosted, linux, heavy]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
- name: Gitleaks
|
|
run: |
|
|
docker run --rm -v "$PWD:/repo" ghcr.io/gitleaks/gitleaks:latest \
|
|
detect --source /repo --no-banner --redact
|