Corrige ordenação de imports acusada pelo lint #79
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [ main, develop ] | |
| tags: [ 'v*' ] | |
| pull_request: | |
| branches: [ main, develop ] | |
| jobs: | |
| test: | |
| name: Test Python ${{ matrix.python-version }} on ${{ matrix.os }} | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, windows-latest, macos-latest] | |
| python-version: ['3.10', '3.11', '3.12'] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e ".[dev]" | |
| # Nao tolerar exit code 5 ("no tests collected"). Uma suite que nao coleta | |
| # nada — por erro de import numa dependencia, por exemplo — passaria como | |
| # verde e esconderia a quebra. Ja aconteceu no synesis-lsp (jsonschema | |
| # desatualizado abortava a coleta inteira). Se algum dia houver um alvo | |
| # legitimamente sem testes, trate o caso nele, nao globalmente aqui. | |
| - name: Run tests | |
| run: | | |
| pytest --cov=synesis --cov-report=xml --cov-report=term | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 | |
| if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.10' | |
| with: | |
| files: ./coverage.xml | |
| flags: unittests | |
| name: codecov-umbrella | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| fail_ci_if_error: false | |
| lint: | |
| name: Lint and Type Check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: '3.10' | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e ".[dev]" | |
| - name: Run Ruff (linter) | |
| run: | | |
| ruff check synesis/ | |
| # MyPy is non-blocking against a measured legacy baseline (257 errors as of | |
| # 2026-08-04; was 229 on 2026-07-13). Ruff above stays blocking. This mirrors the | |
| # Golden Standard guidance for pre-existing debt: block on new code, track | |
| # the backlog with a visible number instead of silently masking it, and | |
| # burn it down in future cycles rather than in an unrelated PR. | |
| - name: Run MyPy (type checker) — informational, non-blocking on legacy debt | |
| continue-on-error: true | |
| run: | | |
| mypy synesis/ --ignore-missing-imports | tee mypy-report.txt | |
| echo "MyPy error count (legacy baseline): $(grep -c ': error:' mypy-report.txt || echo 0)" | |
| security: | |
| name: Security (dependencies and secrets) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| # 3.11+ e obrigatorio AQUI: o passo abaixo le o pyproject.toml com | |
| # `tomllib`, que so entrou na stdlib no 3.11. Com 3.10 o script morria | |
| # em ModuleNotFoundError ANTES de auditar — o job falhava vermelho sem | |
| # nunca ter executado o pip-audit, simulando vulnerabilidade onde nao | |
| # havia. Isto e a versao do RUNNER, nao o piso suportado pelo pacote: | |
| # `requires-python = ">=3.10"` continua valendo e a matriz de testes | |
| # segue cobrindo 3.10. | |
| python-version: '3.11' | |
| - name: Audit dependencies (pip-audit) | |
| run: | | |
| python -m pip install --upgrade pip pip-audit | |
| # Audita SOMENTE as dependencias de runtime que o pacote distribui. | |
| # Nao instalamos o proprio synesis nem os extras [dev]: assim a auditoria | |
| # e deterministica e nao falha por CVE em ferramenta de build (twine, | |
| # etc.) ou por pacote-irmao presente num dev install. Sem --strict: deps | |
| # ausentes do PyPI sao puladas, nao tratadas como erro. | |
| python -c "import tomllib,pathlib; pathlib.Path('runtime-requirements.txt').write_text(chr(10).join(tomllib.load(open('pyproject.toml','rb'))['project']['dependencies']))" | |
| cat runtime-requirements.txt | |
| pip-audit -r runtime-requirements.txt --desc | |
| - name: Scan for secrets (Gitleaks) | |
| # Runs the gitleaks CLI directly instead of gitleaks/gitleaks-action: | |
| # the action requires a license for organization repos on some plans and | |
| # is being migrated off the deprecated Node 20 runtime. The CLI has no | |
| # such requirement and is pinned by release tag below. | |
| run: | | |
| curl -sSL https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz | tar -xz gitleaks | |
| ./gitleaks git --redact -v | |
| build: | |
| name: Build Distribution | |
| runs-on: ubuntu-latest | |
| needs: [test, lint] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: '3.10' | |
| - name: Install build tools | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install build twine | |
| - name: Build package | |
| run: | | |
| python -m build | |
| - name: Check distribution | |
| run: | | |
| twine check dist/* | |
| - name: Upload artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: dist | |
| path: dist/ | |
| integration: | |
| name: Integration Tests | |
| runs-on: ubuntu-latest | |
| needs: test | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: '3.10' | |
| - name: Install synesis | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e . | |
| - name: Test CLI commands | |
| run: | | |
| synesis --help | |
| synesis --version | |
| - name: Test compilation (smoke) | |
| run: | | |
| synesis compile tests/fixtures/Basic/project.synp --json output.json | |
| test -f output.json | |
| echo "✓ JSON export successful" | |
| shell: bash | |
| publish: | |
| name: Publish to PyPI | |
| runs-on: ubuntu-latest | |
| needs: [test, lint, build] | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| environment: pypi | |
| permissions: | |
| id-token: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: '3.10' | |
| - name: Install build tools | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install build | |
| - name: Build package | |
| run: python -m build | |
| - name: Publish to PyPI | |
| uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # release/v1 |