0b2cf9b06c
* ci: migrate ESLint to Biome, optimize workflows, fix tar vulnerability - Replace ESLint with Biome (15-25x faster linting) - Pin Biome to 2.3.11 for consistent behavior across local/CI - Disable useArrowFunction rule (breaks vitest constructor mocks) - Add composite actions for DRY workflow setup - Fix tar vulnerability (CVE-2026-23745) by upgrading to v7.5.3 - Add @electron/rebuild override to ensure consistent tar version - Update electron-builder to 26.4.0 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(workflows): address all 15 PR review findings HIGH priority fixes: - Add tar@7.5.3 override to frontend package.json (CVE-2026-23745) - Use setup-node-frontend composite action in release.yml (4 build jobs) - Use setup-node-frontend composite action in beta-release.yml (4 build jobs) MEDIUM priority fixes: - Add notarization status verification ('Accepted') before stapling - Add blockmap files to beta-release asset copying (delta updates) - Add DMG validation with fallback in release.yml - Extract yq checksum to env block, single definition per step - Fix snake_case to kebab-case in notarization action outputs LOW priority fixes: - Add config files (pyproject.toml, tsconfig*.json, biome.jsonc) to CI paths - Document yq checksum requirement in merge-macos-manifests - Always use jq for notarization ID parsing (no regex fallback) - Add blockmap files to dry-run-summary job - Change noControlCharactersInRegex from off to warn - Rename biome.json to biome.jsonc, add comments explaining disabled rules noSecrets rule kept off due to 2700+ false positives on normal strings. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(lint): correct biome.jsonc path in workflow triggers The lint workflow path filter referenced 'biome.json' but the actual config file is 'biome.jsonc' (renamed to support comments). This fix ensures the lint workflow triggers when the Biome config is modified. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(workflows): address 6 PR review findings - QUAL-001/002: Add DMG file existence checks before stapling - QUAL-003: Quote all path variables in merge-macos-manifests - QUAL-004: Add semver validation in update-readme.py - QUAL-005: Document noDangerouslySetInnerHtml security rule decision - LOGIC-001: Add warning when both notarization IDs are empty Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(workflows): add gate jobs for branch protection Add summary/gate jobs to match existing branch protection rules: - CI Complete: aggregates test-python and test-frontend results - Lint Complete: aggregates python and typescript lint results - Security Summary: aggregates codeql and python-security results These jobs provide a single status check for branch protection instead of requiring individual job names which can change with matrix configs. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
53 lines
1.5 KiB
YAML
53 lines
1.5 KiB
YAML
name: 'Setup Python Backend'
|
|
description: 'Set up Python with uv package manager and cached dependencies for the backend'
|
|
|
|
inputs:
|
|
python-version:
|
|
description: 'Python version to use'
|
|
required: false
|
|
default: '3.12'
|
|
install-test-deps:
|
|
description: 'Whether to install test dependencies'
|
|
required: false
|
|
default: 'false'
|
|
|
|
outputs:
|
|
cache-hit:
|
|
description: 'Whether cache was hit'
|
|
value: ${{ steps.cache.outputs.cache-hit }}
|
|
|
|
runs:
|
|
using: 'composite'
|
|
steps:
|
|
- name: Set up Python ${{ inputs.python-version }}
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: ${{ inputs.python-version }}
|
|
|
|
- name: Install uv package manager
|
|
uses: astral-sh/setup-uv@v4
|
|
with:
|
|
version: "latest"
|
|
|
|
- name: Cache uv dependencies
|
|
id: cache
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.cache/uv
|
|
~/AppData/Local/uv/cache
|
|
~/Library/Caches/uv
|
|
key: uv-${{ runner.os }}-${{ runner.arch }}-${{ inputs.python-version }}-${{ hashFiles('apps/backend/requirements.txt', 'tests/requirements-test.txt') }}
|
|
restore-keys: |
|
|
uv-${{ runner.os }}-${{ runner.arch }}-${{ inputs.python-version }}-
|
|
|
|
- name: Install dependencies
|
|
working-directory: apps/backend
|
|
shell: bash
|
|
run: |
|
|
uv venv
|
|
uv pip install -r requirements.txt
|
|
if [ "${{ inputs.install-test-deps }}" == "true" ]; then
|
|
uv pip install -r ../../tests/requirements-test.txt
|
|
fi
|