Repository navigation
ci: finish adapter parity with the family baseline (1.2.0) - #24
Merged
Merged
Conversation
Contributor
|
Thanks for opening your first pull request on tornadoapi-guard! Quick checklist before review (most of these are enforced by CI, but worth a glance):
See CONTRIBUTING.md for the full workflow and the Code of Conduct for the community standards we follow. Welcome aboard — a maintainer will review shortly. |
- modernize: pull_request instead of pull_request_target, actions on v7, python -m build for the release, docs-deploy concurrency - add live-smoke, upstream-drift, and docksec workflows - add examples/advanced_app (nginx edge, healthchecks, admin token) - enforce the 100% coverage gate - version 1.2.0: adapter train alignment, changelog documents the delta
github-actions
Bot
added
documentation
rennf93
changed the title
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…validation - behavior_scan_response_body=True so the return_monitor 404 demo is valid - whitelist includes the Docker client networks (gateway IPs were flagged) - redis healthcheck + service_healthy ordering for deterministic startup
- write_error uses a static reason-phrase lookup instead of reflecting request-derived text (py/reflective-xss) - Dockerfile: --no-install-recommends, non-root user, HEALTHCHECK - drop the accidentally committed generated live_smoke_stack/ and ignore it
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings tornadoapi-guard fully onto the adapter baseline (guard-core/fastapi-guard conventions) and onto the 1.2.0 adapter train.
Modernization
pull_requestinstead ofpull_request_targetin ci.yml (PR code no longer runs with base-branch secrets context)python -m buildinstead of the legacysetup.py sdist bdist_wheeldocs-deployconcurrency group in docs.ymlNew workflows (previously missing vs the adapter set)
live-smoke.yml: builds the wheel from the checkout, stages it into the example app, docker compose up, curl assertionsupstream-drift.yml: daily suite run against a wheel built from guard-core@masterdocksec.yml: Dockerfile scanning, verbatim from fastapi-guard's pinsNew: examples/advanced_app
Production-shaped topology matching the other adapters' advanced examples: nginx edge (connection shedding + forwarded headers), Redis-backed guard state, /health + /ready orchestration endpoints (guard-excluded), route-scoped strict rate limit, admin-token-protected route, custom debug-block check. Locally verified end to end: compose up --wait, / 200, /health 200, /ready 200, ?debug=true 403, admin without token 400, with token 200, 6-request burst on /rate/strict -> 429s.
Coverage:
--cov-fail-under=100enforced (measured 100.0% locally).Version: 1.0.0 -> 1.2.0 per the adapter train; CHANGELOG documents the delta. Tag/publish still awaits an explicit release go.
Note for the maintainer: repo secrets are missing
TWINE_USERNAMEandIPINFO_TOKEN(onlyTWINE_PASSWORDis set), so the twine-based release and the CI IPINFO fallback would need those set before the next publish.Full pre-commit suite (ruff, mypy, vulture, bandit, radon, xenon, deptry) passes locally.