ci: add Python CI (compile + test gate) - #3
Conversation
📝 WalkthroughWalkthroughA new GitHub Actions workflow named "Python CI" was added to automate testing on the ChangesPython CI Workflow
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/python-ci.yml:
- Line 33: The CI step is swallowing editable-install failures because the shell
line ends with "|| true"; update the command that runs pip editable installs
(the line containing pip install -e ".[dev]" || pip install -e . || true) to
remove the final "|| true" so the job fails if both editable installs fail,
ensuring installation errors are surfaced in CI.
- Around line 22-24: The workflow uses movable tags for actions/checkout@v6 and
actions/setup-python@v6; replace those tags with their corresponding immutable
commit SHAs (the full 40-character git commit for each action) to satisfy the
pinned-action policy. Update the uses lines for actions/checkout and
actions/setup-python to reference the exact commit SHA strings for the versions
you intend to use, confirming the SHAs on the official GitHub repositories for
those actions before committing.
- Line 22: Update the GitHub Actions checkout step to disable credential
persistence: locate the actions/checkout@v6 step and add the
persist-credentials: false input so the runner does not leave the GITHUB_TOKEN
in local git config for later steps; ensure the option name is spelled exactly
as persist-credentials and placed under the same step where uses:
actions/checkout@v6 is declared.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 7748f31a-4eff-47de-b7df-8aec914330e5
📒 Files selected for processing (1)
.github/workflows/python-ci.yml
| timeout-minutes: 25 | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v6 |
There was a problem hiding this comment.
Disable credential persistence in checkout step.
Line 22 currently leaves the Git auth token in local git config for later steps. Set persist-credentials: false to reduce token exposure during PR execution.
Suggested change
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v6
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v6 | |
| - uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 22-22: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 22-22: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/python-ci.yml at line 22, Update the GitHub Actions
checkout step to disable credential persistence: locate the actions/checkout@v6
step and add the persist-credentials: false input so the runner does not leave
the GITHUB_TOKEN in local git config for later steps; ensure the option name is
spelled exactly as persist-credentials and placed under the same step where
uses: actions/checkout@v6 is declared.
| - uses: actions/checkout@v6 | ||
|
|
||
| - uses: actions/setup-python@v6 |
There was a problem hiding this comment.
Pin GitHub Actions to immutable commit SHAs.
Line 22 and Line 24 use movable tags (@v6), which violates pinned-action policy and weakens supply-chain integrity. Pin both actions to full commit SHAs.
Suggested change
- - uses: actions/checkout@v6
+ - uses: actions/checkout@<full_commit_sha>
- - uses: actions/setup-python@v6
+ - uses: actions/setup-python@<full_commit_sha>🧰 Tools
🪛 zizmor (1.25.2)
[warning] 22-22: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 22-22: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 24-24: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/python-ci.yml around lines 22 - 24, The workflow uses
movable tags for actions/checkout@v6 and actions/setup-python@v6; replace those
tags with their corresponding immutable commit SHAs (the full 40-character git
commit for each action) to satisfy the pinned-action policy. Update the uses
lines for actions/checkout and actions/setup-python to reference the exact
commit SHA strings for the versions you intend to use, confirming the SHAs on
the official GitHub repositories for those actions before committing.
| run: | | ||
| python -m pip install --upgrade pip | ||
| if [ -f requirements.txt ]; then pip install -r requirements.txt; fi | ||
| if [ -f pyproject.toml ]; then pip install -e ".[dev]" || pip install -e . || true; fi |
There was a problem hiding this comment.
Do not swallow editable-install failures.
Line 33 ends with || true, so packaging/dependency failures can be ignored and CI can pass incorrectly. Let this step fail when both editable installs fail.
Suggested change
- if [ -f pyproject.toml ]; then pip install -e ".[dev]" || pip install -e . || true; fi
+ if [ -f pyproject.toml ]; then pip install -e ".[dev]" || pip install -e .; fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/python-ci.yml at line 33, The CI step is swallowing
editable-install failures because the shell line ends with "|| true"; update the
command that runs pip editable installs (the line containing pip install -e
".[dev]" || pip install -e . || true) to remove the final "|| true" so the job
fails if both editable installs fail, ensuring installation errors are surfaced
in CI.
1 participant
Applies the org python-ci workflow template (from
Mas-AI-Official/.github/workflow-templates) to this repo.What it does on every push/PR to main:
requirements.txton Python 3.11 (pip-cached)python -m compileall .— catches syntax errors across the repopytestif atests/dir exists; otherwise passes with a compile checkWhy python-ci, not node-ci:
package.jsonstill has the default"test": "... exit 1"script, which would make node-ci fail red. Python CI is green-safe today and gives an immediate regression gate. Add a real test script later and we can layer node-ci on top.🤖 Generated with Claude Code
Summary by CodeRabbit