🎨 Palette: Add keyboard accessibility to UI badges #430
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Vision Code Quality & Tests | |
| on: | |
| push: | |
| branches: [main, master, develop] | |
| pull_request: | |
| branches: [main, master, develop] | |
| workflow_dispatch: | |
| jobs: | |
| quality: | |
| name: Code Quality Checks | |
| runs-on: windows-latest | |
| strategy: | |
| matrix: | |
| python-version: ["3.11", "3.12"] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@v4 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e ".[dev]" | |
| - name: Format check (ruff format) | |
| run: python -m ruff format --check . | |
| - name: Lint (ruff) | |
| run: python -m ruff check . | |
| - name: Type check (pyright) | |
| run: python -m pyright | |
| continue-on-error: true | |
| - name: Doc consistency check | |
| run: python scripts/check_doc_consistency.py | |
| - name: Security scan (bandit) | |
| run: python -m bandit -r . -f json -o bandit.json -ll # only fail on HIGH severity | |
| continue-on-error: true | |
| - name: Dependency vulnerability audit (pip-audit) | |
| run: | | |
| pip install pip-audit | |
| pip-audit --desc --format=json -o pip-audit.json || true | |
| continue-on-error: true | |
| - name: Upload pip-audit results | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: pip-audit-results-py${{ matrix.python-version }} | |
| path: pip-audit.json | |
| - name: Upload bandit results | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: bandit-results-py${{ matrix.python-version }} | |
| path: bandit.json | |
| tests: | |
| name: Unit & Integration Tests | |
| runs-on: windows-latest | |
| strategy: | |
| matrix: | |
| python-version: ["3.11", "3.12"] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@v4 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e ".[test]" | |
| - name: Run unit tests | |
| run: pytest -v --cov-report=xml --junit-xml=junit.xml --cov-fail-under=60 | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@v3 | |
| with: | |
| files: ./coverage.xml | |
| flags: unittests | |
| name: py${{ matrix.python-version }} | |
| - name: Upload test results | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: test-results-py${{ matrix.python-version }} | |
| path: junit.xml | |
| security: | |
| name: Security Vulnerability Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| scan-type: 'fs' | |
| scan-ref: '.' | |
| format: 'sarif' | |
| output: 'trivy-results.sarif' | |
| - name: Upload Trivy results to GitHub Security | |
| uses: github/codeql-action/upload-sarif@v3 | |
| if: always() | |
| with: | |
| sarif_file: 'trivy-results.sarif' | |
| summary: | |
| name: Quality Summary | |
| runs-on: ubuntu-latest | |
| needs: [quality, tests] | |
| if: always() | |
| steps: | |
| - name: Download artifacts | |
| uses: actions/download-artifact@v4 | |
| - name: Comment PR with results | |
| if: github.event_name == 'pull_request' | |
| uses: actions/github-script@v6 | |
| with: | |
| script: | | |
| let comment = '## 📊 Vision Quality Report\n\n'; | |
| comment += "This workflow uses the repo's current Python toolchain. Review the job logs and uploaded artifacts for exact pass/fail details.\n\n"; | |
| comment += '| Check | Where to look |\n'; | |
| comment += '|-------|---------------|\n'; | |
| comment += '| 📄 Doc consistency | `Code Quality Checks` job |\n'; | |
| comment += '| 🎨 Format (`ruff format --check`) | `Code Quality Checks` job |\n'; | |
| comment += '| ⚙️ Lint (`ruff check`) | `Code Quality Checks` job |\n'; | |
| comment += '| 🔍 Type Check (`pyright`) | `Code Quality Checks` job |\n'; | |
| comment += '| 🔒 Security (`bandit`) | `bandit-results-*` artifact |\n'; | |
| comment += '| ✅ Tests (`pytest`) | `Unit & Integration Tests` job |\n'; | |
| comment += '| 📈 Coverage (`coverage.xml`) | Codecov upload / test artifacts |\n'; | |
| try { | |
| await github.rest.issues.createComment({ | |
| issue_number: context.issue.number, | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| body: comment, | |
| }); | |
| } catch (error) { | |
| core.warning(`Skipping PR summary comment: ${error.message}`); | |
| } |