chore(deps): update pycryptodome requirement from <4.0.0,>=3.18.0 to >=3.23.0,<4.0.0 #45
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI Pipeline | |
| on: | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| branches: [ main ] | |
| jobs: | |
| test: | |
| name: Test on Python ${{ matrix.python-version }} | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| python-version: ['3.8', '3.9', '3.10', '3.11', '3.12'] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| cache: 'pip' | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -r requirements.txt | |
| pip install pytest pytest-cov flake8 | |
| - name: Lint with flake8 | |
| run: | | |
| # Stop build if there are Python syntax errors or undefined names | |
| flake8 framework/ --count --select=E9,F63,F7,F82 --show-source --statistics | |
| # Exit-zero treats all errors as warnings | |
| flake8 framework/ --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics | |
| - name: Run unit tests | |
| run: | | |
| python tests/run_tests.py | |
| - name: Run tests with coverage | |
| run: | | |
| pytest tests/ --cov=framework --cov-report=xml --cov-report=term | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@v5 | |
| with: | |
| file: ./coverage.xml | |
| flags: unittests | |
| name: codecov-umbrella | |
| fail_ci_if_error: false | |
| lint: | |
| name: Code Quality | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: '3.11' | |
| cache: 'pip' | |
| - name: Install linting tools | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install flake8 pylint black isort | |
| - name: Check code formatting with black | |
| run: | | |
| black --check framework/ tests/ || true | |
| - name: Check import sorting with isort | |
| run: | | |
| isort --check-only framework/ tests/ || true | |
| - name: Lint with pylint | |
| run: | | |
| pylint framework/ --exit-zero --max-line-length=127 | |
| security: | |
| name: Security Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: '3.11' | |
| - name: Install security tools | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install bandit safety | |
| - name: Run bandit security scan | |
| run: | | |
| bandit -r framework/ -f json -o bandit-report.json || true | |
| bandit -r framework/ || true | |
| - name: Check dependencies for vulnerabilities | |
| run: | | |
| safety scan || true | |
| dependabot-auto-merge: | |
| name: Dependabot Auto-Merge | |
| runs-on: ubuntu-latest | |
| needs: [test, lint, security] | |
| if: github.actor == 'dependabot[bot]' && github.event_name == 'pull_request' | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| steps: | |
| - name: Get Dependabot metadata | |
| id: metadata | |
| uses: dependabot/fetch-metadata@v2 | |
| with: | |
| github-token: "${{ secrets.GITHUB_TOKEN }}" | |
| - name: Auto-merge minor and patch updates | |
| if: | | |
| steps.metadata.outputs.update-type == 'version-update:semver-minor' || | |
| steps.metadata.outputs.update-type == 'version-update:semver-patch' | |
| run: | | |
| echo "Auto-merging ${{ steps.metadata.outputs.update-type }} update" | |
| gh pr merge --auto --squash "${{ github.event.pull_request.html_url }}" | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Comment on major updates | |
| if: steps.metadata.outputs.update-type == 'version-update:semver-major' | |
| uses: actions/github-script@v8 | |
| with: | |
| script: | | |
| github.rest.issues.createComment({ | |
| issue_number: context.issue.number, | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| body: '**Major version update detected!**\n\nThis PR requires manual review as it may contain breaking changes.\n\nPlease:\n1. Review the changelog\n2. Run tests locally\n3. Merge manually when ready' | |
| }) |