fix(security): avoid SKY-D212 RegExp literal false positives #1708
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Tests + Coverage | |
| on: | |
| push: | |
| branches: [main, master] | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| test_matrix: | |
| name: test-matrix (${{ matrix.install_target }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| install_target: | |
| - "." | |
| - ".[llm]" | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 | |
| with: | |
| go-version: "1.22" | |
| - uses: astral-sh/setup-uv@e4db8464a088ece1b920f60402e813ea4de65b8f # v4 | |
| - name: Build repo Go engine | |
| run: | | |
| mkdir -p /tmp/skylos-go-build /tmp/skylos-go-gopath | |
| cd skylos/engines/go | |
| GOCACHE=/tmp/skylos-go-build GOPATH=/tmp/skylos-go-gopath go build -o skylos-go ./cmd/skylos-go | |
| - name: Create venv + install deps | |
| run: | | |
| uv venv | |
| uv pip install -e "${{ matrix.install_target }}" | |
| uv pip install pytest pytest-cov | |
| - name: Run tests with coverage | |
| run: | | |
| uv run pytest -q --cov=skylos --cov-report=term-missing --cov-report=xml | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| files: ./coverage.xml | |
| fail_ci_if_error: false | |
| flags: ${{ matrix.install_target == '.[llm]' && 'llm-extra' || 'default-install' }} | |
| docker_smoke: | |
| name: docker-smoke (Python ${{ matrix.python-version }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.11", "3.14"] | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| persist-credentials: false | |
| - name: Build image | |
| run: docker build --build-arg "PYTHON_VERSION=${{ matrix.python-version }}" -t skylos:test . | |
| - name: Check CLI version | |
| run: docker run --rm skylos:test --version | |
| - name: Check Python runtime | |
| shell: bash | |
| run: | | |
| actual="$(docker run --rm --entrypoint python skylos:test -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")')" | |
| test "$actual" = "${{ matrix.python-version }}" | |
| - name: Run fixture scan | |
| run: | | |
| docker run --rm \ | |
| -v "$PWD/benchmarks/quality/fixtures/argument_overload:/work" \ | |
| -w /work \ | |
| skylos:test \ | |
| . --json --no-provenance > /tmp/skylos-docker-smoke.json | |
| grep -q '"unused_functions"' /tmp/skylos-docker-smoke.json | |
| - name: Scan current Python syntax | |
| if: matrix.python-version == '3.14' | |
| run: | | |
| mkdir -p /tmp/skylos-python-syntax | |
| printf 'type CacheEntry[T = str] = dict[str, T]\n\ndef stale_helper():\n return CacheEntry()\n' > /tmp/skylos-python-syntax/example.py | |
| docker run --rm \ | |
| -v "/tmp/skylos-python-syntax:/work" \ | |
| -w /work \ | |
| skylos:test \ | |
| . --json --no-provenance > /tmp/skylos-python-syntax.json | |
| grep -q '"stale_helper"' /tmp/skylos-python-syntax.json | |
| test: | |
| name: test | |
| runs-on: ubuntu-latest | |
| needs: [test_matrix, docker_smoke] | |
| if: ${{ always() }} | |
| steps: | |
| - name: Require matrix success | |
| run: | | |
| if [ "${{ needs.test_matrix.result }}" != "success" ] || [ "${{ needs.docker_smoke.result }}" != "success" ]; then | |
| echo "test_matrix result: ${{ needs.test_matrix.result }}" | |
| echo "docker_smoke result: ${{ needs.docker_smoke.result }}" | |
| exit 1 | |
| fi |