fix(notifications): atomicity, audit trail, and TOCTOU fixes for cons… #537
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # =============================================================================== | |
| # PLATFORM SERVICE CI/CD | |
| # =============================================================================== | |
| # All events: SQLite (fast, reliable — matches local dev + test.py settings) | |
| # PRs: Affected-module detection for focused test runs (~30s) | |
| # Master push: Full suite + coverage | |
| # | |
| # PostgreSQL production-parity testing is in nightly.yml and full-test.yml | |
| # (requires test suite hardening — tracked as tech debt). | |
| # Linting is consolidated in integration.yml (make lint). | |
| name: Platform Service CI/CD | |
| on: | |
| push: | |
| branches: [master, staging] | |
| paths: | |
| - 'services/platform/**' | |
| - 'shared/**' | |
| - 'scripts/affected_test_modules.py' | |
| - 'pyproject.toml' | |
| - 'uv.lock' | |
| - '.github/workflows/platform.yml' | |
| pull_request: | |
| branches: [master, staging] | |
| paths: | |
| - 'services/platform/**' | |
| - 'shared/**' | |
| - 'scripts/affected_test_modules.py' | |
| - 'pyproject.toml' | |
| - 'uv.lock' | |
| - '.github/workflows/platform.yml' | |
| workflow_dispatch: | |
| env: | |
| DJANGO_SETTINGS_MODULE: config.settings.test | |
| DJANGO_SECRET_KEY: test-secret-key-for-ci | |
| UV_PROJECT_ENVIRONMENT: ${{ github.workspace }}/.venv-linux | |
| jobs: | |
| platform-test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install uv and sync dependencies | |
| uses: astral-sh/setup-uv@v7 | |
| with: | |
| enable-cache: true | |
| cache-dependency-glob: "uv.lock" | |
| - name: Set up Python and install dependencies | |
| run: | | |
| uv python install | |
| uv sync --group platform --group dev | |
| - name: Detect affected test modules | |
| id: affected | |
| if: github.event_name == 'pull_request' | |
| env: | |
| PR_BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| run: | | |
| git fetch origin "$PR_BASE_SHA" --depth=1 || true | |
| CHANGED=$(git diff --name-only "$PR_BASE_SHA"...HEAD) | |
| if [ -z "$CHANGED" ]; then | |
| echo "modules=FULL" >> "$GITHUB_OUTPUT" | |
| echo "No changed files detected — running full suite" | |
| exit 0 | |
| fi | |
| MODULES=$(echo "$CHANGED" | "$UV_PROJECT_ENVIRONMENT/bin/python" scripts/affected_test_modules.py --verbose) | |
| echo "modules=$MODULES" >> "$GITHUB_OUTPUT" | |
| echo "Affected modules: $MODULES" | |
| - name: Run focused platform tests | |
| if: github.event_name == 'pull_request' && steps.affected.outputs.modules != 'FULL' && steps.affected.outputs.modules != '' | |
| env: | |
| MODULES: ${{ steps.affected.outputs.modules }} | |
| run: | | |
| cd services/platform | |
| # Convert dotted module paths to directory paths to avoid Python 3.13 | |
| # unittest.discover() bug where __file__ is None for namespace packages. | |
| DIRS=$(echo "$MODULES" | tr ' ' '\n' | sed 's/\./\//g' | tr '\n' ' ') | |
| PYTHONPATH=$(pwd) "$UV_PROJECT_ENVIRONMENT/bin/python" manage.py test $DIRS --verbosity=2 --failfast --parallel | |
| - name: Run full platform tests with coverage | |
| if: github.event_name != 'pull_request' || steps.affected.outputs.modules == 'FULL' || steps.affected.outputs.modules == '' | |
| run: | | |
| cd services/platform | |
| PYTHONPATH=$(pwd) "$UV_PROJECT_ENVIRONMENT/bin/coverage" run manage.py test tests --verbosity=2 --parallel | |
| "$UV_PROJECT_ENVIRONMENT/bin/coverage" xml -o coverage-platform.xml | |
| "$UV_PROJECT_ENVIRONMENT/bin/coverage" report --show-missing | |
| - name: Platform type checking | |
| run: make check-types-platform | |
| - name: Upload platform artifacts | |
| uses: actions/upload-artifact@v4 | |
| if: always() | |
| with: | |
| name: platform-reports | |
| path: | | |
| services/platform/htmlcov/ | |
| services/platform/coverage-platform.xml | |
| if-no-files-found: warn | |
| platform-security: | |
| runs-on: ubuntu-latest | |
| needs: platform-test | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install uv and sync dependencies | |
| uses: astral-sh/setup-uv@v7 | |
| with: | |
| enable-cache: true | |
| cache-dependency-glob: "uv.lock" | |
| - name: Set up Python and install dependencies | |
| run: | | |
| uv python install | |
| uv sync --group platform --group dev | |
| - name: Run Bandit SAST Security Scan | |
| continue-on-error: true | |
| run: | | |
| cd services/platform | |
| "$UV_PROJECT_ENVIRONMENT/bin/bandit" -r apps/ -ll -ii --exclude '*/tests/*,*/test_*' -f json -o bandit-report.json | |
| - name: Upload Security Reports | |
| uses: actions/upload-artifact@v4 | |
| if: always() | |
| with: | |
| name: security-reports | |
| path: services/platform/bandit-report.json | |
| if-no-files-found: warn |