Skip to content

ci: add Python CI (compile + test gate) #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Masoud-Masoori merged 1 commit into from
Jun 4, 2026
Merged

ci: add Python CI (compile + test gate) #3

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 41 additions & 0 deletions .github/workflows/python-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
name: Python CI

on:
push:
branches: [main, master]
pull_request:
branches: [main, master]

permissions:
contents: read

concurrency:
group: python-ci-${{ github.ref }}
cancel-in-progress: true

jobs:
test:
runs-on: ubuntu-latest
timeout-minutes: 25

steps:
- uses: actions/checkout@v6

@coderabbitai coderabbitai Bot Jun 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Disable credential persistence in checkout step.

Line 22 currently leaves the Git auth token in local git config for later steps. Set persist-credentials: false to reduce token exposure during PR execution.

Suggested change 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- uses: actions/checkout@v6
- uses: actions/checkout@v6
with:
persist-credentials: false
🧰 Tools
🪛 zizmor (1.25.2)

[warning] 22-22: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 22-22: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/python-ci.yml at line 22, Update the GitHub Actions
checkout step to disable credential persistence: locate the actions/checkout@v6
step and add the persist-credentials: false input so the runner does not leave
the GITHUB_TOKEN in local git config for later steps; ensure the option name is
spelled exactly as persist-credentials and placed under the same step where
uses: actions/checkout@v6 is declared.


- uses: actions/setup-python@v6
Comment on lines +22 to +24

@coderabbitai coderabbitai Bot Jun 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Pin GitHub Actions to immutable commit SHAs.

Line 22 and Line 24 use movable tags (@v6), which violates pinned-action policy and weakens supply-chain integrity. Pin both actions to full commit SHAs.

Suggested change 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@<full_commit_sha>

-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@<full_commit_sha>
🧰 Tools
🪛 zizmor (1.25.2)

[warning] 22-22: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 22-22: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

[error] 24-24: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/python-ci.yml around lines 22 - 24, The workflow uses
movable tags for actions/checkout@v6 and actions/setup-python@v6; replace those
tags with their corresponding immutable commit SHAs (the full 40-character git
commit for each action) to satisfy the pinned-action policy. Update the uses
lines for actions/checkout and actions/setup-python to reference the exact
commit SHA strings for the versions you intend to use, confirming the SHAs on
the official GitHub repositories for those actions before committing.

with:
python-version: "3.11"
cache: pip

- name: Install dependencies
run: |
python -m pip install --upgrade pip
if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
if [ -f pyproject.toml ]; then pip install -e ".[dev]" || pip install -e . || true; fi

@coderabbitai coderabbitai Bot Jun 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Do not swallow editable-install failures.

Line 33 ends with || true, so packaging/dependency failures can be ignored and CI can pass incorrectly. Let this step fail when both editable installs fail.

Suggested change 
-          if [ -f pyproject.toml ]; then pip install -e ".[dev]" || pip install -e . || true; fi
+          if [ -f pyproject.toml ]; then pip install -e ".[dev]" || pip install -e .; fi
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/python-ci.yml at line 33, The CI step is swallowing
editable-install failures because the shell line ends with "|| true"; update the
command that runs pip editable installs (the line containing pip install -e
".[dev]" || pip install -e . || true) to remove the final "|| true" so the job
fails if both editable installs fail, ensuring installation errors are surfaced
in CI.

if [ -d tests ]; then pip install pytest; fi

- name: Compile
run: python -m compileall .

- name: Test
run: |
if [ -d tests ]; then pytest; else echo "No tests directory; compile check passed."; fi