ci: add GitHub Actions pipeline and fix legacy python linting errors#302
ci: add GitHub Actions pipeline and fix legacy python linting errors#302Lokesh-Madiri wants to merge 2 commits into
Conversation
📝 WalkthroughWalkthroughAdds a GitHub Actions CI workflow ( ChangesCI Pipeline and Linting Cleanup
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 28: The conflict-marker detection regex in the grep command uses
`^=======` which matches any line starting with 7 or more equals signs, causing
false positives when valid content contains multiple equals signs (like markdown
headers). Modify the pattern from `^=======` to `^=======$` to only match
exactly 7 equals signs on a line by themselves, which is the actual merge
conflict separator format.
- Around line 23-24: Replace all GitHub Actions version tags with full commit
SHAs instead of mutable tags like `@v4` or `@v5` to strengthen supply-chain
security. Specifically, update the actions/checkout references and any other
actions in the workflow file to use their commit SHA hashes. Additionally, add
`persist-credentials: false` to each checkout step to disable credential
persistence. Apply these changes across all affected locations where actions are
referenced in the CI workflow file.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: fb1fb9c6-7a33-4602-8b84-99acb98197a6
📒 Files selected for processing (12)
.github/workflows/ci.ymlbackend/backend/settings.pybackend/backend/urls.pybackend/campaigns/gmail_service.pybackend/campaigns/notifications.pybackend/campaigns/views.pybackend/leads/tests.pybackend/tenants/admin.pybackend/tenants/tests.pybackend/tenants/views.pybackend/users/views.pyruff.toml
💤 Files with no reviewable changes (6)
- backend/tenants/views.py
- backend/users/views.py
- backend/campaigns/gmail_service.py
- backend/tenants/tests.py
- backend/campaigns/notifications.py
- backend/tenants/admin.py
| - name: Checkout Code | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify mutable action refs still present (should be none after fix)
rg -n 'uses:\s*[^ ]+@v[0-9]+' .github/workflows/ci.yml
# Verify checkout steps explicitly disable credential persistence
rg -n -C2 'uses:\s*actions/checkout@' .github/workflows/ci.yml
rg -n 'persist-credentials:\s*false' .github/workflows/ci.ymlRepository: Kuldeeep18/LeadOrbit
Length of output: 655
Pin all GitHub Actions to commit SHAs and disable persisted checkout credentials.
Using mutable tags (@v4, @v5) instead of commit SHAs and leaving checkout credential persistence enabled weakens CI supply-chain hardening. Pin all actions to full commit SHAs and set persist-credentials: false on each checkout step.
Affected locations: lines 24, 39, 42, 61, 64.
Suggested hardening diff
- - name: Checkout Code
- uses: actions/checkout@v4
+ - name: Checkout Code
+ uses: actions/checkout@<FULL_LENGTH_COMMIT_SHA>
+ with:
+ persist-credentials: false
- - name: Checkout Code
- uses: actions/checkout@v4
+ - name: Checkout Code
+ uses: actions/checkout@<FULL_LENGTH_COMMIT_SHA>
+ with:
+ persist-credentials: false
- - name: Set up Python
- uses: actions/setup-python@v5
+ - name: Set up Python
+ uses: actions/setup-python@<FULL_LENGTH_COMMIT_SHA>
- - name: Checkout Code
- uses: actions/checkout@v4
+ - name: Checkout Code
+ uses: actions/checkout@<FULL_LENGTH_COMMIT_SHA>
+ with:
+ persist-credentials: false
- - name: Set up Python
- uses: actions/setup-python@v5
+ - name: Set up Python
+ uses: actions/setup-python@<FULL_LENGTH_COMMIT_SHA>🧰 Tools
🪛 zizmor (1.25.2)
[warning] 23-24: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 24-24: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 23 - 24, Replace all GitHub Actions
version tags with full commit SHAs instead of mutable tags like `@v4` or `@v5` to
strengthen supply-chain security. Specifically, update the actions/checkout
references and any other actions in the workflow file to use their commit SHA
hashes. Additionally, add `persist-credentials: false` to each checkout step to
disable credential persistence. Apply these changes across all affected
locations where actions are referenced in the CI workflow file.
Source: Linters/SAST tools
|
|
||
| - name: Check for merge conflict markers | ||
| run: | | ||
| if grep -rn --exclude-dir=.git -E "^<<<<<<< |^=======|^>>>>>>> " .; then |
There was a problem hiding this comment.
Tighten conflict-marker regex to avoid false positives.
^======= matches any line that starts with 7 =, not only merge separators. Restrict it to ^=======$ so valid content doesn’t fail CI.
Suggested diff
- if grep -rn --exclude-dir=.git -E "^<<<<<<< |^=======|^>>>>>>> " .; then
+ if grep -rn --exclude-dir=.git -E "^<<<<<<< .*$|^=======$|^>>>>>>> .*$" .; then
echo "Unresolved merge conflict markers found!"
exit 1
fi📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| if grep -rn --exclude-dir=.git -E "^<<<<<<< |^=======|^>>>>>>> " .; then | |
| if grep -rn --exclude-dir=.git -E "^<<<<<<< .*$|^=======$|^>>>>>>> .*$" .; then | |
| echo "Unresolved merge conflict markers found!" | |
| exit 1 | |
| fi |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 28, The conflict-marker detection regex in
the grep command uses `^=======` which matches any line starting with 7 or more
equals signs, causing false positives when valid content contains multiple
equals signs (like markdown headers). Modify the pattern from `^=======` to
`^=======$` to only match exactly 7 equals signs on a line by themselves, which
is the actual merge conflict separator format.
|
starred the repo and NOTE that the Issue #301 should be cleared(merged ) to face no issues while merging this pr |
1 participant
Fixes Issue
Closes #295
Description
This PR introduces an enterprise-grade Continuous Integration (CI) pipeline using GitHub Actions to automate linting, testing, and merge conflict checks. To ensure the new pipeline is strictly enforced without relying on legacy ignore rules, I also took the initiative to clean up all existing Python linting violations across the backend.
What was done
.github/workflows/ci.yml)main.runtime.txtproduction environment.pipcaching, action concurrency limits, and strict read-only permissions for performance and security.quality-checksjob that runs before linting and testing. It scans the codebase for leftover merge conflict markers (<<<<<<<,=======,>>>>>>>) to prevent broken code from being merged.ruff check .to the CI pipeline to enforce strict Python linting.ruff.tomlto configure the target Python version.F401,F811).settings.py,urls.py, andcampaigns/views.py(E402).E741).test-backendjob that safely installs dependencies and executespython manage.py test, ensuring all 71 backend tests pass automatically.Verification
ruffandmanage.py testchecks passed).git grepsuccessfully detects merge conflict markers and fails the pipeline if found.Screenshots
Note : The current working repo contains merge conflicts merge the neccesary pr that fix's that issue , else the ci created would show a error.
Summary by CodeRabbit