IssueLab/.github/workflows/ci.yml at main · Thu-ray/IssueLab · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
name: CI

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]

permissions:
  contents: read
  pull-requests: write
  security-events: write

jobs:
  test:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v7
        with:
          python-version: '3.13'
          enable-cache: true
      - run: uv sync
      - run: uv pip install pytest pytest-cov pytest-asyncio

      - name: Run tests with coverage
        run: |
          uv run pytest tests/ --cov=issuelab --cov-report=xml --cov-report=term-missing
        continue-on-error: false

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v4
        with:
          file: ./coverage.xml
          flags: unittests
          name: codecov-umbrella
          fail_ci_if_error: false

      - name: Check coverage threshold
        run: |
          uv run python - << 'PY'
          import sys
          import xml.etree.ElementTree as ET
          from pathlib import Path

          coverage_xml = Path("coverage.xml")
          if not coverage_xml.exists():
              print("❌ 未找到 coverage.xml（pytest-cov 未生成覆盖率报告）")
              sys.exit(1)

          root = ET.parse(coverage_xml).getroot()
          line_rate = root.attrib.get("line-rate")
          if line_rate is None:
              print("❌ coverage.xml 缺少 line-rate 字段，无法计算覆盖率")
              sys.exit(1)

          coverage = float(line_rate) * 100
          threshold = 40

          print(f"当前覆盖率: {coverage:.2f}%")
          if coverage < threshold:
              print(f"❌ 测试覆盖率 {coverage:.2f}% 低于阈值 {threshold}%")
              sys.exit(1)

          print(f"✅ 测试覆盖率 {coverage:.2f}% 达标")
          PY

  lint:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v7
        with:
          python-version: '3.13'
          enable-cache: true
      - run: uv sync --extra dev

      - name: Run ruff (linting)
        run: uv run ruff check src/ tests/ || true

      - name: Run ruff (formatting check)
        run: uv run ruff format --check src/ tests/ || true

      - name: Run mypy (type checking)
        run: uv run mypy src/issuelab --ignore-missing-imports || true

  security:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'
        continue-on-error: true

      - name: Upload Trivy results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: 'trivy-results.sarif'
        continue-on-error: true

  build:
    runs-on: ubuntu-latest
    needs: [test, lint]

    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v7
        with:
          python-version: '3.13'
          enable-cache: true
      - run: uv sync

      - name: Build package
        run: |
          uv build

      - name: Check package
        run: |
          uv run python -m issuelab list-agents

  quality-gate:
    runs-on: ubuntu-latest
    needs: [test, lint, build]
    if: always()

    steps:
      - name: Check all jobs status
        run: |
          if [ "${{ needs.test.result }}" != "success" ]; then
            echo "❌ Tests failed"
            exit 1
          fi

          if [ "${{ needs.build.result }}" != "success" ]; then
            echo "❌ Build failed"
            exit 1
          fi

          echo "✅ All quality checks passed"