49 lines
1.5 KiB
YAML
49 lines
1.5 KiB
YAML
---
|
|
# Homelab CI — Python lane + secret scan.
|
|
# POLICY: lint and tests are HARD gates. Never add `|| true` to them.
|
|
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
types: [opened, synchronize, reopened]
|
|
|
|
jobs:
|
|
python-ci:
|
|
runs-on: [homelab, self-hosted, linux, python]
|
|
container:
|
|
image: node:20-bookworm
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install Python tooling
|
|
run: |
|
|
apt-get update -qq
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y -qq python3 python3-pip python3-venv
|
|
python3 -m pip install --upgrade pip --break-system-packages
|
|
if [ -f requirements.txt ]; then pip install -r requirements.txt --break-system-packages; fi
|
|
if [ -f requirements-dev.txt ]; then pip install -r requirements-dev.txt --break-system-packages; fi
|
|
pip install pytest ruff --break-system-packages
|
|
|
|
- name: Ruff lint (hard gate)
|
|
run: ruff check .
|
|
|
|
- name: Pytest (hard gate)
|
|
run: pytest -q
|
|
|
|
# Advisory-only scanners (allowed to be soft — they're noisy, not gates)
|
|
- name: Bandit (advisory)
|
|
run: pip install bandit --break-system-packages && bandit -r . -q || true
|
|
|
|
secret-scan:
|
|
runs-on: [homelab, self-hosted, linux, heavy]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
- name: Gitleaks
|
|
run: |
|
|
docker run --rm -v "$PWD:/repo" ghcr.io/gitleaks/gitleaks:latest \
|
|
detect --source /repo --config /repo/.gitleaks.toml --no-banner --redact
|