Development and Testing

Development and Testing

Setup

git clone https://github.com/ph7x-Systems/sardine-cms.git
cd sardine-cms
python -m venv .venv && source .venv/bin/activate
pip install --group dev
for pkg in packages/* apps/admin; do pip install -e "$pkg"; done

The gates (run before any PR)

ruff check . && ruff format --check .   # lint + formatting
mypy                                    # strict, whole repo
pytest                                  # full suite
bandit -q -r apps packages scripts -x '*/static/*,*/assets/*' -ll -ii
pip-audit --local --progress-spinner off

CI defines ten required checks: the local gates plus backend conformance, the example build, link checking, digest-pinned secret scanning, W3C markup validation, axe accessibility, dependency auditing and static security analysis. Managed CodeQL scans Actions, Python and bundled JavaScript in addition to the PR gates. main is fully protected — every change lands via PR with every check green, linear history and squash merges.

Test layout (tests/)

Suite	Covers
test_models, test_pages, test_media	content models, translation states, checksums
test_storage, test_factory	the storage conformance suite — parameterized over every engine
test_validation	every rule and the engine
test_builder, test_output_integrity, test_targets	determinism, URL tree, head contract, feeds, targets
test_parity, test_theme_conformance	the reference theme against its ground rules
test_cli, test_scaffold	the CLI flows end to end
test_admin_*	the admin: app factory, auth/CSRF/rate limiting, dashboard, articles, pages, demo export
test_docs	anti-drift: documentation is checked against the code

Conventions: tests exercise real flows (no mocked internals); the PostgreSQL leg runs when SARDINE_POSTGRES_URL is set and is visibly skipped otherwise; documented facts get anti-drift checks in test_docs.py.

Contributing

See CONTRIBUTING.md. Short version: everything in English; small PRs with tests; documentation (repo docs and this wiki) updated in the same change when commands, config or models change; reversible decisions recorded as ADRs.

Branching

The repository is deliberately trunk-based (ADR-0033): one protected main, short-lived feat//fix//docs/ branches, squash-only merges (merge commits and rebase-merge are disabled), branches deleted on merge, releases as protected v* tags. There is no develop branch; release/N.x maintenance branches are cut from a tag only when a released version first needs an isolated patch.