Project-Basira/.github/workflows/ci.yml at main · MoTechSys/Project-Basira · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
# Quality gates for every push and pull request. Each job mirrors a local `make` target (README §Development).
name: ci
on:
  push:
    branches: [main]
  pull_request:
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true
permissions: { contents: read }
jobs:
  backend:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: "3.12", cache: pip }
      - run: pip install -e "./backend[dev,mcp]" pip-audit
      - name: lint + types
        run: cd backend && ruff check app tests && ruff format --check app tests && mypy app
      # Corpus-backed tests need the fixture, which is cut from the full index. The corpora are
      # sha256-pinned in corpus/manifest.json, so the build is reproducible; cached by manifest hash.
      - uses: actions/cache@v4
        with:
          path: |
            corpus/data
            corpus/index
          key: corpus-${{ hashFiles('corpus/manifest.json', 'corpus/build_index.py', 'corpus/fetch*.py') }}
      - name: corpora + translations + index + fixture
        run: |
          python corpus/fetch.py
          python corpus/fetch_translations.py
          [ -f corpus/index/meta.json ] || python corpus/build_index.py
          python corpus/build_fixture.py
      - name: tests (must not skip corpus cases)
        run: cd backend && pytest -q -rs
      - name: eval (fixture, 3 repeats, fail on any unsafe verdict)
        run: python eval/run_eval.py --repeats 3 --fail-on-unsafe
      - name: dependency audit (local package skipped; it is not on PyPI)
        run: pip-audit --skip-editable
  frontend:
    runs-on: ubuntu-latest
    defaults: { run: { working-directory: frontend } }
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 22, cache: npm, cache-dependency-path: frontend/package-lock.json }
      - run: npm ci
      - run: npm run lint && npm run typecheck && npm test -- --run
      - run: npm run build
      - run: npm audit --omit=dev --audit-level=high
  bot:
    runs-on: ubuntu-latest
    defaults: { run: { working-directory: integrations/telegram } }
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: "3.12", cache: pip }
      - run: pip install -e '.[dev]' && pip install -e '../../backend'
      - run: ruff check . && ruff format --check . && mypy --strict . && pytest -q
  secrets:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - uses: gitleaks/gitleaks-action@v2
        env: { GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}" }
  docker:
    runs-on: ubuntu-latest
    needs: [backend, frontend]
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - run: docker build --build-arg BUILD_SHA=${GITHUB_SHA::7} -t basira:ci .
      - name: smoke
        run: |
          docker run -d --name basira-ci -p 8000:8000 basira:ci
          for i in $(seq 1 60); do curl -sf localhost:8000/health && break; sleep 1; done
          curl -sf localhost:8000/health | grep -q '"boot":"snapshot"'
          curl -sf localhost:8000/health | grep -q "\"build_sha\":\"${GITHUB_SHA::7}\""
          curl -sf localhost:8000/v1/check -H 'Content-Type: application/json' -d '{"text":"قال تعالى: ﴿قل هو الله أحد﴾"}' | grep -q '"status":"found"'