Bump codecov/codecov-action from 4.6.0 to 7.0.0 #48

Workflow file for this run

	name: CI

	on:
	push:
	branches: [ main, develop ]
	pull_request:
	branches: [ main, develop ]

	jobs:
	test:
	name: Test Python ${{ matrix.python-version }} on ${{ matrix.os }}
	runs-on: ${{ matrix.os }}
	strategy:
	fail-fast: false
	matrix:
	os: [ubuntu-latest, windows-latest, macos-latest]
	python-version: ['3.10', '3.11', '3.12']

	steps:
	- name: Checkout code
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

	- name: Set up Python ${{ matrix.python-version }}
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
	with:
	python-version: ${{ matrix.python-version }}

	- name: Install dependencies
	run: \|
	python -m pip install --upgrade pip
	pip install -e ".[dev]"

	- name: Run tests
	run: \|
	python -c "import sys, pytest; code = pytest.main(['--cov=synesis','--cov-report=xml','--cov-report=term']); sys.exit(0 if code == 5 else code)"

	- name: Upload coverage to Codecov
	uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
	if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.10'
	with:
	files: ./coverage.xml
	flags: unittests
	name: codecov-umbrella
	token: ${{ secrets.CODECOV_TOKEN }}
	fail_ci_if_error: false

	lint:
	name: Lint and Type Check
	runs-on: ubuntu-latest

	steps:
	- name: Checkout code
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

	- name: Set up Python
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
	with:
	python-version: '3.10'

	- name: Install dependencies
	run: \|
	python -m pip install --upgrade pip
	pip install -e ".[dev]"

	- name: Run Ruff (linter)
	run: \|
	ruff check synesis/

	# MyPy is non-blocking against a measured legacy baseline (229 errors as of
	# 2026-07-13, see CHANGELOG). Ruff above stays blocking. This mirrors the
	# Golden Standard guidance for pre-existing debt: block on new code, track
	# the backlog with a visible number instead of silently masking it, and
	# burn it down in future cycles rather than in an unrelated PR.
	- name: Run MyPy (type checker) — informational, non-blocking on legacy debt
	continue-on-error: true
	run: \|
	mypy synesis/ --ignore-missing-imports \| tee mypy-report.txt
	echo "MyPy error count (legacy baseline): $(grep -c ': error:' mypy-report.txt \|\| echo 0)"

	security:
	name: Security (dependencies and secrets)
	runs-on: ubuntu-latest

	steps:
	- name: Checkout code
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
	with:
	fetch-depth: 0

	- name: Set up Python
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
	with:
	python-version: '3.10'

	- name: Audit dependencies (pip-audit)
	run: \|
	python -m pip install --upgrade pip pip-audit
	# Audita SOMENTE as dependencias de runtime que o pacote distribui.
	# Nao instalamos o proprio synesis nem os extras [dev]: assim a auditoria
	# e deterministica e nao falha por CVE em ferramenta de build (twine,
	# etc.) ou por pacote-irmao presente num dev install. Sem --strict: deps
	# ausentes do PyPI sao puladas, nao tratadas como erro.
	python -c "import tomllib,pathlib; pathlib.Path('runtime-requirements.txt').write_text(chr(10).join(tomllib.load(open('pyproject.toml','rb'))['project']['dependencies']))"
	cat runtime-requirements.txt
	pip-audit -r runtime-requirements.txt --desc

	- name: Scan for secrets (Gitleaks)
	# Runs the gitleaks CLI directly instead of gitleaks/gitleaks-action:
	# the action requires a license for organization repos on some plans and
	# is being migrated off the deprecated Node 20 runtime. The CLI has no
	# such requirement and is pinned by release tag below.
	run: \|
	curl -sSL https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz \| tar -xz gitleaks
	./gitleaks git --redact -v

	build:
	name: Build Distribution
	runs-on: ubuntu-latest
	needs: [test, lint]

	steps:
	- name: Checkout code
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

	- name: Set up Python
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
	with:
	python-version: '3.10'

	- name: Install build tools
	run: \|
	python -m pip install --upgrade pip
	pip install build twine

	- name: Build package
	run: \|
	python -m build

	- name: Check distribution
	run: \|
	twine check dist/*

	- name: Upload artifacts
	uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
	with:
	name: dist
	path: dist/

	integration:
	name: Integration Tests
	runs-on: ubuntu-latest
	needs: test

	steps:
	- name: Checkout code
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

	- name: Set up Python
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
	with:
	python-version: '3.10'

	- name: Install synesis
	run: \|
	python -m pip install --upgrade pip
	pip install -e .

	- name: Test CLI commands
	run: \|
	synesis --help
	synesis --version

	- name: Test compilation (smoke)
	run: \|
	synesis compile tests/fixtures/Basic/project.synp --json output.json
	test -f output.json
	echo "✓ JSON export successful"
	shell: bash

	publish:
	name: Publish to PyPI
	runs-on: ubuntu-latest
	needs: [test, lint, build]
	if: startsWith(github.ref, 'refs/tags/v')
	environment: pypi
	permissions:
	id-token: write

	steps:
	- name: Checkout code
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

	- name: Set up Python
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
	with:
	python-version: '3.10'

	- name: Install build tools
	run: \|
	python -m pip install --upgrade pip
	pip install build

	- name: Build package
	run: python -m build

	- name: Publish to PyPI
	uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1

Navigation Menu

Uh oh!

Bump codecov/codecov-action from 4.6.0 to 7.0.0 #48

Workflow file

Bump codecov/codecov-action from 4.6.0 to 7.0.0 #48

Uh oh!

Workflow file for this run