Hiddenden/AegisGitea-MCP
5
0 Fork 0
Code Issues 2 Pull Requests Actions Packages Projects 1 Releases 1 Wiki Activity

ci: single Gitea Actions pipeline, uv-based image, scoped docker cleanup

Browse Source 
Replace lint/test/docker workflows with ci.yml (gitleaks, lint, test-unit, test-integration, test-mcp, build-and-push, docs-check, security). Rebuild the Dockerfile as a digest-pinned multi-stage uv build running as uid 1000, add .dockerignore, a hardened compose file and a gitleaks config. The integration harness now falls back to /etc/hostname and /proc/self to find its own container.
This commit is contained in:
Latte committed 2026-10-14 15:59:19 +02:00
1 parent 9e50859133
commit 1a039e32ab
16 files changed
+729 -404
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.gitea/workflows/publish.yml
+26 -16
View File
@@ -3,7 +3,7 @@ name: publish
# Build the Python package with uv and publish it to the self-hosted Gitea PyPI
# registry on merge. dev -> a dev package (aegis-gitea-mcp-dev, .devN versions);
# main -> the stable package (aegis-gitea-mcp). Gated on lint + tests so a release
# can never ship red. Reuses the REGISTRY_TOKEN package secret (same one docker.yml
# can never ship red. Reuses the REGISTRY_TOKEN package secret (same one ci.yml
# uses); if it is absent the job fails loudly instead of publishing anonymously.
on:
push:
@@ -13,7 +13,7 @@ on:
jobs:
# ---------------------------------------------------------------------------
# 1. Lint: ruff + black + mypy (same gate as the other workflows).
# 1. Lint (same gate as ci.yml, via uv and the lockfile).
# ---------------------------------------------------------------------------
lint:
runs-on: ubuntu-latest
@@ -24,19 +24,21 @@ jobs:
uses: actions/setup-python@v5
with:
python-version: "3.12"
- name: Set up uv
uses: astral-sh/setup-uv@v5
with:
version: "0.12.5"
enable-cache: false
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -r requirements-dev.txt
run: uv sync --locked
- name: Run lint
run: |
ruff check src tests
ruff format --check src tests
black --check src tests
mypy src
uv run ruff check .
uv run ruff format --check .
uv run mypy src
# ---------------------------------------------------------------------------
# 2. Test: pytest with coverage gate.
# 2. Test: unit tests with the coverage gate from pyproject.toml.
# ---------------------------------------------------------------------------
test:
runs-on: ubuntu-latest
@@ -47,12 +49,15 @@ jobs:
uses: actions/setup-python@v5
with:
python-version: "3.12"
- name: Set up uv
uses: astral-sh/setup-uv@v5
with:
version: "0.12.5"
enable-cache: false
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -r requirements-dev.txt
run: uv sync --locked
- name: Run tests
run: pytest --cov=aegis_gitea_mcp --cov-report=term-missing --cov-fail-under=80
run: uv run pytest
# ---------------------------------------------------------------------------
# 3. Build with uv and publish to the Gitea PyPI registry.
@@ -78,6 +83,9 @@ jobs:
- name: Set up uv
uses: astral-sh/setup-uv@v5
with:
version: "0.12.5"
enable-cache: false
- name: Require publish credentials
shell: bash
@@ -100,7 +108,9 @@ jobs:
CHANNEL="stable"
else
PKG_NAME="aegis-gitea-mcp-dev"
PKG_VERSION="${BASE}.dev${GITHUB_RUN_NUMBER}"
# Drop an existing .devN suffix (the committed version may be a
# development version) so the result has exactly one dev segment.
PKG_VERSION="${BASE%%.dev*}.dev${GITHUB_RUN_NUMBER}"
CHANNEL="dev"
fi
echo "pkg_name=${PKG_NAME}" >> "$GITHUB_OUTPUT"
@@ -133,7 +143,7 @@ jobs:
- name: Publish to Gitea PyPI registry
shell: bash
env:
# Reuse the existing package secret (same one docker.yml uses). The
# Reuse the existing package secret (same one ci.yml uses). The
# token authenticates as its owning Gitea user, so GITHUB_ACTOR is the
# username and the token is the password.
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}