Skip to content
CI

fix: add runner PYTHONPATH to CI test and audit steps #35

Sign in to view logs

fix: add runner PYTHONPATH to CI test and audit steps

fix: add runner PYTHONPATH to CI test and audit steps #35

Workflow file for this run

.github/workflows/ci.yml at 35af239
name: CI
on:
push:
branches: [main, claude/**]
pull_request:
branches: [main]
jobs:
test:
name: Unit Tests
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Set up Python 3.11
uses: actions/setup-python@v5
with:
python-version: "3.11"
cache: "pip"
cache-dependency-path: apps/api/requirements*.txt
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -r apps/api/requirements-test.txt
- name: Run unit tests
run: |
cd apps/api
PYTHONPATH=$PYTHONPATH:../../services/runner/app pytest tests/ --tb=short -v
- name: Run tests with coverage
run: |
cd apps/api
PYTHONPATH=$PYTHONPATH:../../services/runner/app pytest tests/ --cov=app --cov-report=xml --cov-report=term-missing
- name: Upload coverage report
uses: actions/upload-artifact@v4
with:
name: coverage-report
path: apps/api/coverage.xml
integration:
name: Integration Tests
runs-on: ubuntu-latest
needs: test
steps:
- uses: actions/checkout@v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Create .env file
run: |
cat > .env << 'EOF'
M87_API_KEY=m87-ci-test-key
M87_ENABLE_TEST_ENDPOINTS=true
POSTGRES_PASSWORD=ci-test-password
EOF
- name: Start services
run: |
docker compose -f infra/docker-compose.yml up -d --build
sleep 10
- name: Wait for API health
run: |
for i in {1..30}; do
if curl -s http://localhost:8000/health | grep -q '"ok":true'; then
echo "API is healthy"
exit 0
fi
echo "Waiting for API... ($i/30)"
sleep 2
done
echo "API failed to start"
docker compose -f infra/docker-compose.yml logs
exit 1
- name: Run proof-test.sh
run: ./scripts/proof-test.sh
- name: Collect logs on failure
if: failure()
run: |
docker compose -f infra/docker-compose.yml logs > docker-logs.txt
- name: Upload logs on failure
if: failure()
uses: actions/upload-artifact@v4
with:
name: docker-logs
path: docker-logs.txt
- name: Stop services
if: always()
run: docker compose -f infra/docker-compose.yml down -v
audit:
name: Audit Rail
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Set up Python 3.11
uses: actions/setup-python@v5
with:
python-version: "3.11"
cache: "pip"
cache-dependency-path: apps/api/requirements*.txt
- name: Set up Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
cache: "npm"
cache-dependency-path: apps/ui/package-lock.json
- name: Install Python dependencies
run: |
python -m pip install --upgrade pip
pip install -r apps/api/requirements-test.txt
- name: Install Node dependencies
run: |
cd apps/ui
npm ci
- name: Run audit.sh
env:
PYTHONPATH: ${{ github.workspace }}/services/runner/app
run: ./scripts/audit.sh
- name: Upload evidence artifacts
if: always()
uses: actions/upload-artifact@v4
with:
name: audit-evidence
path: evidence/
layer0-proof-rail:
name: Layer 0 Proof Rail
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Set up Python 3.11
uses: actions/setup-python@v5
with:
python-version: "3.11"
cache: "pip"
cache-dependency-path: apps/api/requirements*.txt
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -r apps/api/requirements-test.txt
- name: Run TOCTOU red-team probes
run: |
cd apps/api
python -m pytest tests/test_layer0_toctou_probes.py -v --tb=short
- name: Run Layer 0 traceable demo
run: |
python scripts/layer0_demo.py --json > layer0_proof.json 2>layer0_demo.log
python -c "
import json, sys
d = json.load(open('layer0_proof.json'))
v = d['verdict']
c = d['provenance']['repo_commit']
assert v == 'LAYER_0_ENFORCED', f'Verdict: {v}'
assert c != 'unknown', 'Missing commit provenance'
print(f'Layer 0 proof: {v} | commit: {c[:12]} | checks: {d[\"passed\"]}/{d[\"total_checks\"]}')
"
- name: Upload proof artifact
if: always()
uses: actions/upload-artifact@v4
with:
name: layer0-proof
path: |
layer0_proof.json
layer0_demo.log
lint:
name: Lint
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Set up Python 3.11
uses: actions/setup-python@v5
with:
python-version: "3.11"
- name: Check Python syntax
run: |
python -m py_compile apps/api/app/*.py
python -m py_compile apps/api/app/**/*.py 2>/dev/null || true
python -m py_compile apps/api/tests/*.py