release: sync public v0.8.8

Author: Paul Kyle

.github/workflows/ci.yml

@@ -1,30 +1,27 @@
-# CI pipeline for Palinode — runs on every push and pull_request to any branch.
-#
-# Jobs:
-#   1. unit-tests     — fast feedback on core logic (no external services)
-#   2. integration    — tests/integration/ (may need Ollama; continue-on-error)
-#   3. security-scan  — bandit (code) + pip-audit (dependencies)
-
 name: CI
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 on:
   push:
   pull_request:
 
 jobs:
-  # ---------------------------------------------------------------------------
-  # Unit tests — should never need network access or Ollama.
-  # All embeddings / LLM calls are mocked in the test suite.
-  # ---------------------------------------------------------------------------
   unit-tests:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     strategy:
       matrix:
-        python-version: ["3.11", "3.12"]
+        python-version: ["3.11", "3.12", "3.13"]
 
     steps:
       - uses: actions/checkout@v4
@@ -40,9 +37,7 @@ jobs:
           python -m pip install --upgrade pip
           pip install -e ".[dev]"
 
-      - name: Assert palinode resolves to the checked-out tree
-        # Regression guard for editable installs: palinode.__file__ must
-        # resolve under GITHUB_WORKSPACE, not some other site-packages path.
+      - name: Assert package resolves to the checked-out tree
         run: |
           RESOLVED=$(python -c "import palinode; print(palinode.__file__)")
           echo "palinode.__file__ = $RESOLVED"
@@ -52,22 +47,15 @@ jobs:
             exit 1
           fi
 
-      - name: Run unit tests (excluding integration)
+      - name: Smoke console entry points
+        run: python -m pytest tests/test_console_entry_points.py -q
+
+      - name: Run unit tests
         run: python -m pytest tests/ -x -q --ignore=tests/integration --ignore=tests/live
 
-  # ---------------------------------------------------------------------------
-  # Integration tests — run against tests/integration/.
-  #
-  # These tests do not require Ollama directly (embeddings are stubbed), but
-  # they do spin up FastAPI in-process and exercise the full save/search loop
-  # against a real SQLite database in a temp directory.
-  #
-  # continue-on-error: true — any test tagged @pytest.mark.slow that needs
-  # a live Ollama instance will fail here; that is expected in CI.
-  # Run the full suite locally against a host with Ollama for full coverage.
-  # ---------------------------------------------------------------------------
   integration-tests:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
 
     env:
       PALINODE_DIR: /tmp/palinode-ci-test
@@ -87,19 +75,12 @@ jobs:
           pip install -e ".[dev]"
 
       - name: Run integration tests
-        # Integration tests that need Ollama will be skipped in CI;
-        # run locally against a host with Ollama for full Ollama-backed coverage.
         run: python -m pytest tests/integration/ -x -q
         continue-on-error: true
 
-  # ---------------------------------------------------------------------------
-  # Security scans — informational (continue-on-error: true on pip-audit).
-  #
-  # bandit:    static analysis for common Python security issues
-  # pip-audit: checks installed packages against known vulnerability databases
-  # ---------------------------------------------------------------------------
   security-scan:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
 
     steps:
       - uses: actions/checkout@v4
@@ -116,11 +97,9 @@ jobs:
           pip install -e ".[dev]"
           pip install bandit pip-audit
 
-      - name: Run bandit (static security analysis)
-        # -r: recursive, -ll: medium+ severity, -q: quiet output
+      - name: Run bandit
         run: bandit -r palinode/ -ll -q
 
-      - name: Run pip-audit (dependency vulnerability check)
-        # continue-on-error: known-vulnerability lists drift; treat as informational
+      - name: Run pip-audit
         run: pip-audit
         continue-on-error: true