Repository navigation
Add Python CI quality checks #5
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
36 commits
Select commit
Hold shift + click to select a range
fde64db
Add Python quality tooling configuration
JonahMMay 15e122d
Add Python quality CI
JonahMMay c8b60e9
Fix display renderer lint issues
JonahMMay 08ef5ea
Fix display driver lint issues
JonahMMay faa342b
Run CI tools without packaging the hardware project
JonahMMay 7248dc9
Run quality tools directly with uv
JonahMMay d8b9831
Use StrEnum for display state
JonahMMay 36d8aa1
Fix display import ordering
JonahMMay 58b806d
Fix display driver import ordering
JonahMMay c9ef01c
Apply Ruff formatting to display driver
JonahMMay 01ba099
Apply Ruff formatting to display smoke test
JonahMMay a5989ec
Fix smoke test formatting
JonahMMay 9d3323f
Configure uv without packaging the hardware project
JonahMMay 901d6d7
Install CI dependencies in the uv environment
JonahMMay 8f01532
Use package import in display smoke test
JonahMMay 0f4a3c2
Use package-relative display imports
JonahMMay fbd2c99
Ignore external Waveshare import in ty
JonahMMay d7b38d3
Use current Node 24 GitHub Actions
JonahMMay bc810cd
Pin current GitHub Actions versions
JonahMMay 2ea3cb1
Add pytest coverage tooling
JonahMMay 4497782
Run pytest with 95 percent coverage
JonahMMay 65914a7
Remove hard-coded install user
JonahMMay 27d9dd8
Use the configured install user
JonahMMay 3418ad5
Parameterize display service user
JonahMMay 6cdac38
Add display unit tests with coverage
JonahMMay 5006a31
Replace smoke test with pytest suite
JonahMMay b77736b
Rewrite README for portable setup documentation
JonahMMay 6836c0c
Fix pytest lint errors
JonahMMay e3521ff
Configure pytest import path
JonahMMay 77908ee
Add pytest asyncio support
JonahMMay 303d3b0
Expand display tests to meet coverage target
JonahMMay 380144f
Fix hardware driver test expectations
JonahMMay f4c5e6a
Fix portable service installation paths
JonahMMay 29dab76
Parameterize display service install root
JonahMMay 3cf28ab
Clarify hardware and LVA prerequisites
JonahMMay da55996
Fix duplicate CI runs on pull requests
JonahMMay File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| name: Python quality | ||
|
|
||
| on: | ||
| push: | ||
| branches: [main] | ||
| pull_request: | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| quality: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
|
|
||
| - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 | ||
| with: | ||
| python-version: "3.13" | ||
|
|
||
| - name: Install Python dependencies | ||
| run: uv sync --dev | ||
|
|
||
| - name: Ruff lint | ||
| run: uv run ruff check . | ||
|
|
||
| - name: Ruff format | ||
| run: uv run ruff format --check . | ||
|
|
||
| - name: ty | ||
| run: uv run ty check | ||
|
|
||
| - name: Tests and coverage | ||
| run: uv run pytest --cov=display --cov-report=term-missing --cov-fail-under=95 | ||
|
|
||
| - name: Compile Python | ||
| run: uv run python -m compileall -q display | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🛡️ Detected with Advanced Tier | 🟠 Major | ⚡ Quick win
Security Misconfiguration
Reachability: External
Exploitability: Moderate
CWE: CWE-522 — Insufficiently Protected Credentials
Disable credential persistence before dependency installation.
actions/checkoutpersists theGITHUB_TOKENby default. A pull request can change dependency metadata, anduv sync --devcan execute dependency build code. That code can read the persisted token from Git configuration and exfiltrate it. Thecontents: readpermission limits token scope but does not prevent credential disclosure. Setpersist-credentials: false.Proposed fix
Based on learnings: jobs that install dependencies must disable persisted checkout credentials.
📝 Committable suggestion
🧰 Tools
🪛 zizmor (1.30.0)
[warning] 15-15: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents