From 268553e9dec95023b6009b4c1e249031b9514638 Mon Sep 17 00:00:00 2001 From: ilia Date: Sun, 26 Jul 2026 15:35:46 -0400 Subject: [PATCH] Keep workflows in ci-templates/ only; projects copy one in --- .gitea/workflows/ci.yml | 48 ----------------------------------------- 1 file changed, 48 deletions(-) delete mode 100644 .gitea/workflows/ci.yml diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml deleted file mode 100644 index d1ee41c..0000000 --- a/.gitea/workflows/ci.yml +++ /dev/null @@ -1,48 +0,0 @@ ---- -# Homelab CI — Python lane + secret scan. -# POLICY: lint and tests are HARD gates. Never add `|| true` to them. -name: CI - -on: - push: - branches: [main] - pull_request: - types: [opened, synchronize, reopened] - -jobs: - python-ci: - runs-on: [homelab, self-hosted, linux, python] - container: - image: node:20-bookworm - steps: - - uses: actions/checkout@v4 - - - name: Install Python tooling - run: | - apt-get update -qq - DEBIAN_FRONTEND=noninteractive apt-get install -y -qq python3 python3-pip python3-venv - python3 -m pip install --upgrade pip --break-system-packages - if [ -f requirements.txt ]; then pip install -r requirements.txt --break-system-packages; fi - if [ -f requirements-dev.txt ]; then pip install -r requirements-dev.txt --break-system-packages; fi - pip install pytest ruff --break-system-packages - - - name: Ruff lint (hard gate) - run: ruff check . - - - name: Pytest (hard gate) - run: pytest -q - - # Advisory-only scanners (allowed to be soft — they're noisy, not gates) - - name: Bandit (advisory) - run: pip install bandit --break-system-packages && bandit -r . -q || true - - secret-scan: - runs-on: [homelab, self-hosted, linux, heavy] - steps: - - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - name: Gitleaks - run: | - docker run --rm -v "$PWD:/repo" ghcr.io/gitleaks/gitleaks:latest \ - detect --source /repo --config /repo/.gitleaks.toml --no-banner --redact