mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Fable 5.1
351d73079a
The workflow runs pytest twice: in the dagger container (now one failure) and on the runner host, whose job synced the dev group only, so dspy and tree-sitter were missing there (25 failures). The one failure shared by both runs was the partial-clone extraction test: engine_trace.main sets GIT_NO_LAZY_FETCH in the process environment, the variable outlived its tests, and git 2.44 and newer refuse the lazy fetch with "lazy fetching disabled". The local git ignores the variable, so the leak was invisible here; the test module now restores the variable after each test (leak checked with a session-end probe: present before, absent after). Co-Authored-By: Claude Fable 5.1 <[email protected]>
94 lines
3.1 KiB
YAML
94 lines
3.1 KiB
YAML
name: CI
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
checks:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
# uv run re-syncs to the lockfile's default extras unless told not to; it removed the extras below before pytest.
|
|
UV_NO_SYNC: "1"
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- uses: astral-sh/setup-uv@v7
|
|
with:
|
|
enable-cache: true
|
|
- uses: actions/setup-python@v6
|
|
with:
|
|
python-version-file: .python-version
|
|
- run: uv sync --group dev --extra hunt --extra semantic
|
|
- run: uv run ruff format --check .
|
|
- run: uv run ruff check .
|
|
- run: uv run mypy src/openultrasast
|
|
- run: uv run pytest
|
|
- name: Detection gate (>=90% recall, <10% FP — hard, score-independent)
|
|
run: uv run python -m openultrasast.gate
|
|
- name: Split-sink map gate (stage 2 beats pattern-hit ranking)
|
|
run: uv run python -m openultrasast.map_gate
|
|
- name: Pair-efficiency gate (local vuln vs fix; GitHub honesty dashboard)
|
|
run: uv run python -m openultrasast.pair_gate
|
|
- run: uv run python -m compileall src tests
|
|
|
|
semantic:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- uses: astral-sh/setup-uv@v7
|
|
with:
|
|
enable-cache: true
|
|
- uses: actions/setup-python@v6
|
|
with:
|
|
python-version-file: .python-version
|
|
- run: uv sync --group dev --extra semantic
|
|
- run: uv run pytest -m semantic
|
|
|
|
dagger:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
env:
|
|
# Must match dagger-io (0.21.7) and dagger/_engine/_version.py CLI_VERSION
|
|
# so the engine image tag is deterministic. The dagger-for-github action
|
|
# runs `docker image inspect registry.dagger.io/engine:v${DAGGER_VERSION}`
|
|
# and skips its own (flaky) pull when the image is already in the local
|
|
# docker cache, so the pinned tag below MUST equal the action's version.
|
|
DAGGER_VERSION: 0.21.7
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- uses: astral-sh/setup-uv@v7
|
|
with:
|
|
enable-cache: true
|
|
- name: Pre-pull dagger engine image (retry transient registry timeouts)
|
|
timeout-minutes: 8
|
|
run: |
|
|
set -euo pipefail
|
|
image="registry.dagger.io/engine:v${DAGGER_VERSION}"
|
|
attempts=5
|
|
for i in $(seq 1 "${attempts}"); do
|
|
echo "::group::Pull attempt ${i}/${attempts}: ${image}"
|
|
if timeout 90 docker pull "${image}"; then
|
|
echo "Pulled ${image} on attempt ${i}"
|
|
docker image inspect "${image}" >/dev/null
|
|
echo "::endgroup::"
|
|
exit 0
|
|
fi
|
|
echo "Pull attempt ${i} failed."
|
|
echo "::endgroup::"
|
|
if [ "${i}" -lt "${attempts}" ]; then
|
|
echo "Retrying in 20s..."
|
|
sleep 20
|
|
fi
|
|
done
|
|
echo "All ${attempts} pull attempts failed for ${image}" >&2
|
|
exit 1
|
|
- uses: dagger/dagger-for-github@v7
|
|
with:
|
|
version: 0.21.7
|
|
verb: run
|
|
args: uv run python dagger/ci.py
|