feat(ai): default LangGraph backend and slim ChatAgent (2.1.0) #178
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Tests | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main, develop] | |
| env: | |
| UV_EXTRA: dev | |
| jobs: | |
| # Core install: no AI/ML/scraper extras — public CLI + domain modules only. | |
| test-core: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | |
| with: | |
| enable-cache: true | |
| cache-dependency-glob: "uv.lock" | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.13" | |
| - name: Install core + dev only | |
| run: uv sync --frozen --extra dev --python "$(command -v python3)" | |
| - name: Core smoke (status, help) | |
| run: | | |
| uv run openfatture --help | |
| uv run openfatture status --json | |
| - name: Core tests (no AI / Lightning / scraper suites) | |
| run: | | |
| uv run --extra dev pytest -q --no-cov \ | |
| tests/cli tests/billing tests/storage tests/payment \ | |
| tests/pdf tests/platform tests/unit tests/events tests/hooks \ | |
| tests/i18n tests/integration \ | |
| --ignore=tests/integration/test_ai_integration.py \ | |
| --ignore=tests/cli/formatters/test_formatters_integration.py \ | |
| -m 'not performance and not benchmark and not slow and not e2e and not ollama' | |
| test: | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| python-version: ["3.12", "3.13"] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| - name: Install libomp on macOS | |
| if: runner.os == 'macOS' | |
| run: | | |
| if brew ls --versions libomp >/dev/null 2>&1; then | |
| echo "libomp already installed" | |
| else | |
| brew install libomp | |
| fi | |
| echo "DYLD_LIBRARY_PATH=/opt/homebrew/opt/libomp/lib:${DYLD_LIBRARY_PATH:-}" >> "$GITHUB_ENV" | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | |
| with: | |
| enable-cache: true | |
| cache-dependency-glob: "uv.lock" | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install dependencies (full extras) | |
| run: uv sync --frozen --all-extras | |
| - name: Run tests with pytest | |
| run: | | |
| uv run --extra dev pytest --cov=openfatture --cov-report=xml --cov-report=term-missing --cov-fail-under=49 | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@v4 | |
| with: | |
| file: ./coverage.xml | |
| flags: unittests | |
| name: codecov-${{ matrix.os }}-py${{ matrix.python-version }} | |
| fail_ci_if_error: false | |
| lint: | |
| runs-on: ubuntu-latest | |
| # Do not inherit workflow UV_EXTRA=dev: it conflicts with --all-extras installs | |
| # and can leave `uv run` unable to spawn tools from the full environment. | |
| env: | |
| UV_EXTRA: "" | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| - name: Install libomp on macOS | |
| if: runner.os == 'macOS' | |
| run: | | |
| brew list libomp || brew install libomp | |
| echo "DYLD_LIBRARY_PATH=/opt/homebrew/opt/libomp/lib:${DYLD_LIBRARY_PATH:-}" >> "$GITHUB_ENV" | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: '3.13' | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | |
| - name: Install dependencies | |
| # --all-extras includes product extras and the dev optional-dep group (ruff/mypy). | |
| run: uv sync --frozen --all-extras --python "$(command -v python3)" | |
| - name: Run Ruff format | |
| run: .venv/bin/ruff format --check . | |
| - name: Run Ruff check | |
| run: .venv/bin/ruff check . | |
| - name: Run MyPy | |
| run: .venv/bin/python -m mypy openfatture/ | |
| security: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@v0.36.0 | |
| with: | |
| scan-type: 'fs' | |
| scan-ref: '.' | |
| format: 'sarif' | |
| output: 'trivy-results.sarif' | |
| - name: Upload Trivy results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: 'trivy-results.sarif' | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: '3.13' | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | |
| - name: Install dependencies | |
| run: uv sync --frozen | |
| - name: Run Safety check | |
| run: uv run safety check --json | |
| continue-on-error: true | |
| - name: Run Bandit (Python SAST) | |
| # Advisory for now: the codebase has pre-existing findings (3 High, | |
| # 6 Medium). Results are surfaced in the Security tab via SARIF; triage | |
| # and tighten to a failing gate once the backlog is addressed. | |
| run: | | |
| uvx bandit -r openfatture/ -ll -f sarif -o bandit-results.sarif || true | |
| uvx bandit -r openfatture/ -ll || true | |
| - name: Upload Bandit results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v4 | |
| if: always() | |
| with: | |
| sarif_file: 'bandit-results.sarif' | |
| continue-on-error: true | |
| - name: Run pip-audit (dependency vulnerabilities) | |
| run: uvx pip-audit --strict || true | |
| continue-on-error: true | |
| permissions: | |
| contents: read | |
| security-events: write |