Spaces:
Running
Running
| name: Quality | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| python: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - uses: astral-sh/setup-uv@v6 | |
| with: | |
| version: "0.8.22" | |
| - run: pip install poetry==2.1.3 | |
| - name: Verify locks without regeneration | |
| run: | | |
| poetry check --lock | |
| uv lock --check | |
| - run: poetry install | |
| - run: poetry run python -m compileall -q src tests deploy/backup_restore.py | |
| - run: poetry run pytest -q | |
| - name: Audit actual Python environment | |
| run: uvx pip-audit --path .venv/lib/python3.12/site-packages | |
| benchmark-helpers: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - run: python -m venv benchmarks/.venv | |
| - run: benchmarks/.venv/bin/pip install -r benchmarks/requirements.txt pytest | |
| - run: benchmarks/.venv/bin/pytest -q benchmarks/locomo/test_sota_helpers.py benchmarks/beam/test_beam_helpers.py | |
| frontend: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| project: [console, tui] | |
| defaults: | |
| run: | |
| working-directory: ${{ matrix.project }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: "22.22.0" | |
| cache: npm | |
| cache-dependency-path: ${{ matrix.project }}/package-lock.json | |
| - run: npm ci | |
| - if: matrix.project == 'console' | |
| run: npm audit --omit=dev --audit-level=high | |
| - if: matrix.project == 'tui' | |
| run: npm run typecheck | |
| - run: npm run build | |
| rust: | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: mcp-stdio-http-bridge | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@master | |
| with: | |
| toolchain: 1.85.0 | |
| - run: cargo test --locked | |
| image-light-smoke: | |
| runs-on: ubuntu-latest | |
| needs: [python, benchmark-helpers, frontend, rust] | |
| env: | |
| BRAINAPI_IMAGE: brainapi:ci | |
| BRAINAPI_ENV_FILE: env.light.example | |
| REDIS_PASSWORD: ci-redis-password | |
| POSTGRES_PASSWORD: ci-postgres-password | |
| POSTGRES_USERNAME: brainapi | |
| BRAINPAT_TOKEN: ci-system-token | |
| BACKUP_DIR: ${{ github.workspace }}/.backup-artifacts | |
| RELEASE_ARTIFACT_DIR: ${{ github.workspace }}/release-artifacts | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: docker/setup-buildx-action@v3 | |
| - name: Validate Compose and secret rejection | |
| run: | | |
| docker compose -f deploy/docker-compose.light.yaml config -q | |
| if env -u REDIS_PASSWORD docker compose -f deploy/docker-compose.light.yaml config -q; then exit 1; fi | |
| - name: Build exact test image | |
| run: docker build --platform linux/amd64 --load -t "$BRAINAPI_IMAGE" . | |
| - name: Export exact candidate image | |
| run: | | |
| mkdir -p "$RELEASE_ARTIFACT_DIR" | |
| docker save "$BRAINAPI_IMAGE" | gzip -1 > "$RELEASE_ARTIFACT_DIR/brainapi-image.tar.gz" | |
| - name: Generate image SBOM | |
| uses: anchore/sbom-action@v0 | |
| with: | |
| image: brainapi:ci | |
| format: spdx-json | |
| output-file: brainapi.spdx.json | |
| - name: Audit actual image | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: brainapi:ci | |
| severity: HIGH,CRITICAL | |
| ignore-unfixed: true | |
| exit-code: "1" | |
| format: json | |
| output: trivy.json | |
| - name: Light profile smoke | |
| run: | | |
| docker compose --project-name brainapi-ci -f deploy/docker-compose.light.yaml -f deploy/docker-compose.ci.yaml up -d --wait | |
| curl --fail --retry 12 --retry-delay 5 http://localhost/health | |
| python scripts/production_smoke.py exercise --profile light --system-token "$BRAINPAT_TOKEN" --artifact-dir "$RELEASE_ARTIFACT_DIR" | |
| - name: Light backup and clean restore | |
| run: | | |
| archive=$(deploy/brainapi-backup backup --profile light --project-name brainapi-ci --env-file deploy/env.light.example --compose-file deploy/docker-compose.ci.yaml --backup-dir "$BACKUP_DIR" | tail -1) | |
| deploy/brainapi-backup verify --profile light --env-file deploy/env.light.example --archive "$archive" | |
| cp "$archive/manifest.json" "$RELEASE_ARTIFACT_DIR/backup-light-manifest.json" | |
| docker compose --project-name brainapi-ci -f deploy/docker-compose.light.yaml -f deploy/docker-compose.ci.yaml down --volumes | |
| deploy/brainapi-backup restore --profile light --project-name brainapi-ci --env-file deploy/env.light.example --compose-file deploy/docker-compose.ci.yaml --archive "$archive" | |
| curl --fail --retry 12 --retry-delay 5 http://localhost/health | |
| python scripts/production_smoke.py verify-restore --profile light --system-token "$BRAINPAT_TOKEN" --artifact-dir "$RELEASE_ARTIFACT_DIR" | |
| - name: Record exact-image security evidence | |
| run: | | |
| cp brainapi.spdx.json "$RELEASE_ARTIFACT_DIR/brainapi.spdx.json" | |
| python scripts/write_security_artifact.py --trivy trivy.json --sbom "$RELEASE_ARTIFACT_DIR/brainapi.spdx.json" --image "$BRAINAPI_IMAGE" --output "$RELEASE_ARTIFACT_DIR/security.json" | |
| - name: Logs on failure | |
| if: failure() | |
| run: docker compose --project-name brainapi-ci -f deploy/docker-compose.light.yaml -f deploy/docker-compose.ci.yaml logs --no-color | |
| - name: Clean CI volumes | |
| if: always() | |
| run: docker compose --project-name brainapi-ci -f deploy/docker-compose.light.yaml -f deploy/docker-compose.ci.yaml down --volumes --remove-orphans | |
| - uses: actions/upload-artifact@v4 | |
| if: always() | |
| with: | |
| name: light-production-validation | |
| path: | | |
| release-artifacts/ | |
| trivy.json | |