Files
Aperant/.github/actions/setup-python-backend/action.yml
T
Andy 0b2cf9b06c ci: migrate ESLint to Biome, optimize workflows, fix tar vulnerability (#1289)
* ci: migrate ESLint to Biome, optimize workflows, fix tar vulnerability

- Replace ESLint with Biome (15-25x faster linting)
- Pin Biome to 2.3.11 for consistent behavior across local/CI
- Disable useArrowFunction rule (breaks vitest constructor mocks)
- Add composite actions for DRY workflow setup
- Fix tar vulnerability (CVE-2026-23745) by upgrading to v7.5.3
- Add @electron/rebuild override to ensure consistent tar version
- Update electron-builder to 26.4.0

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(workflows): address all 15 PR review findings

HIGH priority fixes:
- Add tar@7.5.3 override to frontend package.json (CVE-2026-23745)
- Use setup-node-frontend composite action in release.yml (4 build jobs)
- Use setup-node-frontend composite action in beta-release.yml (4 build jobs)

MEDIUM priority fixes:
- Add notarization status verification ('Accepted') before stapling
- Add blockmap files to beta-release asset copying (delta updates)
- Add DMG validation with fallback in release.yml
- Extract yq checksum to env block, single definition per step
- Fix snake_case to kebab-case in notarization action outputs

LOW priority fixes:
- Add config files (pyproject.toml, tsconfig*.json, biome.jsonc) to CI paths
- Document yq checksum requirement in merge-macos-manifests
- Always use jq for notarization ID parsing (no regex fallback)
- Add blockmap files to dry-run-summary job
- Change noControlCharactersInRegex from off to warn
- Rename biome.json to biome.jsonc, add comments explaining disabled rules

noSecrets rule kept off due to 2700+ false positives on normal strings.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(lint): correct biome.jsonc path in workflow triggers

The lint workflow path filter referenced 'biome.json' but the actual
config file is 'biome.jsonc' (renamed to support comments). This fix
ensures the lint workflow triggers when the Biome config is modified.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(workflows): address 6 PR review findings

- QUAL-001/002: Add DMG file existence checks before stapling
- QUAL-003: Quote all path variables in merge-macos-manifests
- QUAL-004: Add semver validation in update-readme.py
- QUAL-005: Document noDangerouslySetInnerHtml security rule decision
- LOGIC-001: Add warning when both notarization IDs are empty

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* feat(workflows): add gate jobs for branch protection

Add summary/gate jobs to match existing branch protection rules:
- CI Complete: aggregates test-python and test-frontend results
- Lint Complete: aggregates python and typescript lint results
- Security Summary: aggregates codeql and python-security results

These jobs provide a single status check for branch protection instead
of requiring individual job names which can change with matrix configs.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-18 14:29:50 +01:00

53 lines
1.5 KiB
YAML

name: 'Setup Python Backend'
description: 'Set up Python with uv package manager and cached dependencies for the backend'
inputs:
python-version:
description: 'Python version to use'
required: false
default: '3.12'
install-test-deps:
description: 'Whether to install test dependencies'
required: false
default: 'false'
outputs:
cache-hit:
description: 'Whether cache was hit'
value: ${{ steps.cache.outputs.cache-hit }}
runs:
using: 'composite'
steps:
- name: Set up Python ${{ inputs.python-version }}
uses: actions/setup-python@v5
with:
python-version: ${{ inputs.python-version }}
- name: Install uv package manager
uses: astral-sh/setup-uv@v4
with:
version: "latest"
- name: Cache uv dependencies
id: cache
uses: actions/cache@v4
with:
path: |
~/.cache/uv
~/AppData/Local/uv/cache
~/Library/Caches/uv
key: uv-${{ runner.os }}-${{ runner.arch }}-${{ inputs.python-version }}-${{ hashFiles('apps/backend/requirements.txt', 'tests/requirements-test.txt') }}
restore-keys: |
uv-${{ runner.os }}-${{ runner.arch }}-${{ inputs.python-version }}-
- name: Install dependencies
working-directory: apps/backend
shell: bash
run: |
uv venv
uv pip install -r requirements.txt
if [ "${{ inputs.install-test-deps }}" == "true" ]; then
uv pip install -r ../../tests/requirements-test.txt
fi