fix(notifier): intelligently select use_tls vs start_tls based on smt… #17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| env: | |
| PYTHON_VERSION: "3.12" | |
| jobs: | |
| lint: | |
| name: Lint (ruff) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| cache: pip | |
| - run: pip install -r requirements-dev.txt | |
| - run: ruff check . | |
| typecheck: | |
| name: Type check (mypy) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| cache: pip | |
| - run: pip install -r requirements-dev.txt | |
| - run: mypy app | |
| test: | |
| name: Test & coverage | |
| runs-on: ubuntu-latest | |
| services: | |
| postgres: | |
| image: postgres:16-alpine | |
| env: | |
| POSTGRES_USER: sentinel | |
| POSTGRES_PASSWORD: sentinel | |
| POSTGRES_DB: sentinel_test | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd="pg_isready -U sentinel" | |
| --health-interval=5s | |
| --health-timeout=5s | |
| --health-retries=5 | |
| env: | |
| TEST_DATABASE_URL: postgresql+asyncpg://sentinel:sentinel@localhost:5432/sentinel_test | |
| SECRET_KEY: ci-test-secret-key-not-for-production-use-0000 | |
| ENVIRONMENT: testing | |
| CELERY_TASK_ALWAYS_EAGER: "true" | |
| RATE_LIMIT_ENABLED: "false" | |
| BACKEND_CORS_ORIGINS: '["http://localhost:3000"]' | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| cache: pip | |
| - run: pip install -r requirements-dev.txt | |
| - run: pytest -v --junitxml=test-results/junit.xml | |
| - name: Upload test results | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: test-results | |
| path: test-results/junit.xml | |
| - name: Upload coverage report | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: coverage-report | |
| path: htmlcov/ | |
| docker: | |
| name: Docker build validation | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Build image | |
| run: docker build -t sentinel:ci . | tee docker-build.log | |
| - name: Validate docker-compose config | |
| run: | | |
| cp .env.example .env | |
| docker compose config | |
| - name: Upload build log | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: docker-build-log | |
| path: docker-build.log | |
| security: | |
| name: Security checks | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| cache: pip | |
| - run: pip install -r requirements-dev.txt | |
| - name: Dependency vulnerability scan (pip-audit) | |
| run: pip-audit -r requirements.txt -r requirements-dev.txt | |
| - name: Secret detection (detect-secrets) | |
| run: | | |
| cp .secrets.baseline /tmp/before.json | |
| detect-secrets scan --baseline .secrets.baseline | |
| jq 'del(.generated_at)' /tmp/before.json > /tmp/before-clean.json | |
| jq 'del(.generated_at)' .secrets.baseline > /tmp/after-clean.json | |
| diff /tmp/before-clean.json /tmp/after-clean.json |