ci: add GitHub Actions workflow that runs the unittest suite (closes #13)#14
Closed
timon0305 wants to merge 2 commits intocppalliance:masterfrom
Closed
ci: add GitHub Actions workflow that runs the unittest suite (closes #13)#14timon0305 wants to merge 2 commits intocppalliance:masterfrom
timon0305 wants to merge 2 commits intocppalliance:masterfrom
Conversation
…ppalliance#13) There was no CI on this repository — 137 unit tests in tests/ were only ever run when a developer remembered to run them locally. A regression that broke CLI parity, exclusion rules, exporter output, alias inference, or search filtering could land on master with no gate. New workflow `.github/workflows/tests.yml`: - Triggers on every push to master and every pull request. - Single ubuntu-latest runner, Python 3.12. - Installs only what the tests need (flask, fpdf2). pywebview from requirements.txt is the desktop-launcher dep and pulls GTK / Qt system packages — out of scope for the unittest suite, so it is deliberately omitted from the CI install. The unittest suite imports neither. - Runs `python -m unittest discover tests -v`. Local sanity-check with the same command on Python 3.12: 137/137 OK.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
📝 WalkthroughWalkthroughAdds a GitHub Actions workflow ChangesCI: Add tests workflow
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/tests.yml (1)
26-27: ⚡ Quick winUse compatible release constraints instead of floating lower bounds in CI.
Line 27 uses
>=constraints onflaskandfpdf2, which can cause unpredictable CI failures when upstream releases include breaking changes. Use compatible release constraints (~=) to pin major and minor versions while allowing patch updates.♻️ Suggested change
- python -m pip install 'flask>=3.0' 'fpdf2>=2.7' + python -m pip install 'flask~=3.0.0' 'fpdf2~=2.7.0'🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/tests.yml around lines 26 - 27, The CI uses floating lower-bound pip constraints in the pip install step ("python -m pip install 'flask>=3.0' 'fpdf2>=2.7'"), which can introduce breaking upstream changes; update that pip install invocation to use compatible release operators (~=) for the packages (e.g., replace "flask>=3.0" and "fpdf2>=2.7" with "flask~=3.0" and "fpdf2~=2.7") so CI allows patch releases but prevents accidental major/minor upgrades.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/tests.yml:
- Around line 14-17: The workflow uses floating tags for actions
(actions/checkout@v4 and actions/setup-python@v5); replace those tags with their
corresponding immutable commit SHAs by updating the uses fields for
actions/checkout and actions/setup-python to the current verified commit SHA
strings (rather than `@v4/`@v5), ensuring the checkout and setup-python steps
reference the exact commit SHAs to pin the actions.
---
Nitpick comments:
In @.github/workflows/tests.yml:
- Around line 26-27: The CI uses floating lower-bound pip constraints in the pip
install step ("python -m pip install 'flask>=3.0' 'fpdf2>=2.7'"), which can
introduce breaking upstream changes; update that pip install invocation to use
compatible release operators (~=) for the packages (e.g., replace "flask>=3.0"
and "fpdf2>=2.7" with "flask~=3.0" and "fpdf2~=2.7") so CI allows patch releases
but prevents accidental major/minor upgrades.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: aa24d2b5-c034-4a8e-85a7-446a6c9a47d6
📒 Files selected for processing (1)
.github/workflows/tests.yml
…palliance#14) Replace @v4 / @v5 tag refs with the matching commit SHAs on actions/checkout and actions/setup-python. Tags are mutable — a compromised maintainer can repoint them, silently swapping the code that runs in our CI runner. SHAs are immutable and remove that class of supply-chain risk. Verified each SHA against the live tag on github.com: gh api repos/actions/checkout/git/ref/tags/v4 \ --jq '.object.sha' # 34e114876b0b11c390a56381ad16ebd13914f8d5 gh api repos/actions/setup-python/git/ref/tags/v5 \ --jq '.object.sha' # a26af69be951a213d495a4c3e4e4022e16d87065 The trailing `# v4` / `# v5` comments preserve the major-version intent so future bumps stay deliberate. The leading comment block documents the bump procedure for the next person.
4 tasks
Collaborator
Author
|
Superseded by #19 — moved in-repo (cppalliance/ci/run-tests-13 instead of fork) so CI actually runs. New PR also expands the gate to multi-OS / multi-Python / mypy / gitleaks. |
wpak-ai
pushed a commit
that referenced
this pull request
May 8, 2026
…loses #13) (#19) * ci: add GitHub Actions workflow that runs the unittest suite (closes #13) There was no CI on this repository — 137 unit tests in tests/ were only ever run when a developer remembered to run them locally. A regression that broke CLI parity, exclusion rules, exporter output, alias inference, or search filtering could land on master with no gate. New workflow `.github/workflows/tests.yml`: - Triggers on every push to master and every pull request. - Single ubuntu-latest runner, Python 3.12. - Installs only what the tests need (flask, fpdf2). pywebview from requirements.txt is the desktop-launcher dep and pulls GTK / Qt system packages — out of scope for the unittest suite, so it is deliberately omitted from the CI install. The unittest suite imports neither. - Runs `python -m unittest discover tests -v`. Local sanity-check with the same command on Python 3.12: 137/137 OK. * ci: pin action versions to immutable commit SHAs (CodeRabbit on PR #14) Replace @v4 / @v5 tag refs with the matching commit SHAs on actions/checkout and actions/setup-python. Tags are mutable — a compromised maintainer can repoint them, silently swapping the code that runs in our CI runner. SHAs are immutable and remove that class of supply-chain risk. Verified each SHA against the live tag on github.com: gh api repos/actions/checkout/git/ref/tags/v4 \ --jq '.object.sha' # 34e114876b0b11c390a56381ad16ebd13914f8d5 gh api repos/actions/setup-python/git/ref/tags/v5 \ --jq '.object.sha' # a26af69be951a213d495a4c3e4e4022e16d87065 The trailing `# v4` / `# v5` comments preserve the major-version intent so future bumps stay deliberate. The leading comment block documents the bump procedure for the next person. * ci: expand to multi-OS + multi-Python matrix, add mypy + gitleaks (closes #13) The previous shape was a single ubuntu-latest / Python 3.12 unittest job. Expanded to match the broader gate quality the team adopted on the-claw: - unittest: 3 OSes × 3 Pythons = 9 cells (3.11 / 3.12 / 3.13 across ubuntu-latest, macos-latest, windows-latest). Catches Python version drift and the rare path / line-ending issue single-OS hides. fail-fast false so cells run independently. - typecheck: mypy on Python 3.12. Codebase already has 70+ typed functions across 30 .py files, so mypy actually does work. Lenient config (--ignore-missing-imports, --no-strict-optional) + continue-on-error step until the surface is clean. - secret-scan: gitleaks 8.21.2 with checksum verification (mirrors the-claw's setup verbatim). No project-specific .gitleaks.toml; uses defaults for standard credential patterns. Concurrency block added so a new push to the same ref cancels the in-flight run, reducing CI minutes. Action SHAs unchanged from the previous workflow (already pinned). * ci: explicit least-privilege GITHUB_TOKEN permissions (CodeRabbit on PR #19) Adds workflow-level `permissions: contents: read` so a compromised action step in any matrix cell can't write back to the repo. None of the jobs (unittest, typecheck, secret-scan) need write access — no commits, PR comments, or release publishes. Read-only is enough. * fix: remove other OS other than ubuntu --------- Co-authored-by: Monkey Dev <headit74@hotmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
No CI. 137 existing unit tests only run when a developer remembers to run them locally — regressions can land on
masterungated.Change
Add
.github/workflows/tests.yml. Triggers on every push tomasterand every pull request. Single Ubuntu runner, Python 3.12. Installsflask+fpdf2(omitspywebview— desktop-launcher dep, not exercised by the test suite, pulls GTK/Qt system packages). Runspython -m unittest discover tests -v.Test plan
Tests / Unit testscheck that must pass before merge.Closes #13.
Summary by CodeRabbit