45 lines
2.0 KiB
YAML
45 lines
2.0 KiB
YAML
name: Verify Frame Flow
|
|
on:
|
|
push:
|
|
# Branch verification gates releases; tags do not duplicate the same build.
|
|
branches: ["**"]
|
|
pull_request:
|
|
workflow_dispatch:
|
|
jobs:
|
|
verify:
|
|
# The NAS Docker runner must never execute code from external forks.
|
|
if: github.server_url != 'https://github.com' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
DOCKER_PIP_INDEX_URL: ${{ vars.DOCKER_PIP_INDEX_URL }}
|
|
DOCKER_PIP_FALLBACK_INDEX_URL: ${{ vars.DOCKER_PIP_FALLBACK_INDEX_URL }}
|
|
CI_PIP_INDEX_URL: ${{ vars.CI_PIP_INDEX_URL }}
|
|
CI_PIP_FALLBACK_INDEX_URL: ${{ vars.CI_PIP_FALLBACK_INDEX_URL }}
|
|
ALPINE_MIRROR: ${{ vars.ALPINE_MIRROR }}
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
- uses: https://github.com/actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
|
|
with:
|
|
python-version: '3.14'
|
|
- name: Install CI dependencies with index diagnostics and fallback
|
|
run: python scripts/ci-install.py
|
|
- run: python -m ruff check pigway_frame_flow tests scripts
|
|
- run: python -m ruff format --check pigway_frame_flow tests scripts
|
|
- run: python -m mypy pigway_frame_flow
|
|
- run: python -m pytest -q
|
|
- name: Complete vulnerability audit with bounded network retries
|
|
run: python scripts/ci-audit.py
|
|
- name: Isolated Docker build, smoke and restart verification
|
|
run: |
|
|
. ./deploy/build-cn.env
|
|
python scripts/ci-compose-verify.py
|
|
- name: Cleanup isolated Docker resources
|
|
if: always()
|
|
run: |
|
|
if [ -n "${FRAME_FLOW_CI_COMPOSE:-}" ] && [ -f "$FRAME_FLOW_CI_COMPOSE" ]; then
|
|
python scripts/ci-compose-verify.py --cleanup
|
|
fi
|
|
|
|
# Production moved to Ubuntu Server. Release manually with scripts/server-release.py;
|
|
# the shared NAS runner performs isolated verification only.
|