Skip to content
CI

feat(approvals): redesign approval workflow (publish tab, client portal, on_hold) #433

Sign in to view logs

feat(approvals): redesign approval workflow (publish tab, client portal, on_hold)

feat(approvals): redesign approval workflow (publish tab, client portal, on_hold) #433

Workflow file for this run

.github/workflows/ci.yml at 83406f2
name: CI
on:
push:
branches: [main]
pull_request:
branches: [main]
# Principle of least privilege: default to read-only for every job.
# Individual jobs can opt into more permissions if needed.
permissions:
contents: read
# Cancel in-progress runs when a new commit is pushed to the same branch/PR.
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
lint:
name: Lint (ruff)
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- name: Checkout
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
persist-credentials: false
- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: "3.12"
cache: "pip"
- name: Install ruff
run: pip install "ruff==0.15.9"
- name: ruff check
run: ruff check .
- name: ruff format --check
run: ruff format --check .
typecheck:
name: Type check (mypy)
runs-on: ubuntu-latest
timeout-minutes: 10
env:
# mypy loads Django settings during type inference; it never hits a DB.
SECRET_KEY: test-secret-key-not-for-production
steps:
- name: Checkout
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
persist-credentials: false
- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: "3.12"
cache: "pip"
- name: Install dependencies
run: pip install -r requirements.txt
- name: mypy
run: mypy apps/ config/ providers/ tests/ --ignore-missing-imports
test:
name: Test (pytest)
runs-on: ubuntu-latest
timeout-minutes: 15
services:
postgres:
# Pulled via AWS's public mirror of Docker Hub official images —
# avoids anonymous Docker Hub pulls, whose timeouts/rate limits
# broke main CI on 2026-06-10 (run 27262568530).
image: public.ecr.aws/docker/library/postgres:16-alpine
env:
POSTGRES_DB: brightbean_test
POSTGRES_USER: postgres
POSTGRES_PASSWORD: postgres
ports:
- 5432:5432
options: >-
--health-cmd pg_isready
--health-interval 10s
--health-timeout 5s
--health-retries 5
env:
DJANGO_SETTINGS_MODULE: config.settings.test
SECRET_KEY: test-secret-key-not-for-production
DATABASE_URL: postgres://postgres:postgres@localhost:5432/brightbean_test
DB_HOST: localhost
DB_USER: postgres
DB_PASSWORD: postgres
steps:
- name: Checkout
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
persist-credentials: false
- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: "3.12"
cache: "pip"
- name: Install dependencies
run: pip install -r requirements.txt
- name: pytest
run: pytest --cov=apps --cov-report=term-missing
build:
name: Docker build
runs-on: ubuntu-latest
timeout-minutes: 15
needs: [lint, typecheck, test]
steps:
- name: Checkout
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
persist-credentials: false
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
- name: Build image
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
with:
context: .
push: false
tags: brightbean:latest
cache-from: type=gha
cache-to: type=gha,mode=max
secrets-scan:
name: Secret scan (gitleaks)
runs-on: ubuntu-latest
timeout-minutes: 5
# We invoke the gitleaks binary directly rather than using
# gitleaks/gitleaks-action, because that action now requires a paid
# license for GitHub organizations. The binary itself remains free
# and open source under the MIT license.
env:
GITLEAKS_VERSION: "8.24.3"
steps:
- name: Checkout
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
fetch-depth: 0
persist-credentials: false
- name: Install gitleaks
run: |
curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
| tar -xz -C /tmp gitleaks
sudo mv /tmp/gitleaks /usr/local/bin/gitleaks
gitleaks version
- name: Run gitleaks
run: gitleaks detect --source . --redact --verbose --no-banner