Skip to content

feat!: new releasing system #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
raven-wing merged 1 commit into from
Jul 7, 2026
Merged

feat!: new releasing system #22

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 31 additions & 0 deletions .github/workflows/e2e.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
name: E2E

on:
workflow_call:

jobs:
e2e:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6

@coderabbitai coderabbitai Bot Jul 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

Disable credential persistence on checkout.

Same rationale as the other reusable workflows — this job also runs poetry install and npm install, both of which execute third-party code.

🔒 Proposed fix 
     - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- uses: actions/checkout@v6
- uses: actions/checkout@v6
with:
persist-credentials: false
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 10-10: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/e2e.yml at line 10, The checkout step in the e2e workflow
still persists Git credentials, which is unsafe before running third-party
install steps like poetry install and npm install. Update the actions/checkout
usage in the e2e workflow to disable credential persistence, matching the other
reusable workflows, so the job does not leave repo credentials available to
dependencies.

Source: Linters/SAST tools

- name: Set up Python 3.10
uses: actions/setup-python@v6
with:
python-version: "3.10"
- name: Install Poetry
run: pipx install poetry==2.0.1
- name: Install dependencies
run: poetry install
- name: Set up Node.js
uses: actions/setup-node@v6
with:
node-version: '22'
- name: Install Cypress
working-directory: tests/e2e_tests
run: npm install cypress
- name: Run e2e tests
run: |
poetry run flask --app "tests.e2e_tests.e2e_app:create_app(config_path='tests/e2e_tests/e2e_test_config.yml')" run --debug --host=localhost &
for i in $(seq 1 30); do curl -sf http://localhost:5000/health/liveness > /dev/null && break || sleep 1; done
curl -sf http://localhost:5000/health/liveness > /dev/null || { echo "Flask app failed to start"; exit 1; }
cd tests/e2e_tests && npx cypress run --spec "cypress/e2e/**/*"
20 changes: 20 additions & 0 deletions .github/workflows/lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
name: Lint

on:
workflow_call:

jobs:
lint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6

@coderabbitai coderabbitai Bot Jul 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

Disable credential persistence on checkout.

actions/checkout@v6 persists the GitHub token to the git config by default. Since poetry install runs third-party install/build code, a compromised dependency could read/misuse it.

🔒 Proposed fix 
     - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- uses: actions/checkout@v6
- uses: actions/checkout@v6
with:
persist-credentials: false
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 10-10: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/lint.yml at line 10, The checkout step currently uses
actions/checkout@v6 with default credential persistence, which leaves the GitHub
token available to later build steps. Update the checkout configuration in the
workflow to explicitly disable persisted credentials on the actions/checkout
step so the token is not written to git config before poetry install runs.

Source: Linters/SAST tools

- name: Set up Python 3.10
uses: actions/setup-python@v6
with:
python-version: "3.10"
- name: Install Poetry
run: pipx install poetry==2.0.1
- name: Install dependencies
run: poetry install
- name: Run linters
run: make lint-check
132 changes: 32 additions & 100 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,120 +1,41 @@
name: Semantic Release
name: Release

on:
push:
branches:
- main

concurrency:
group: ${{ github.workflow }}-${{ github.ref_name }}
cancel-in-progress: false

permissions:
contents: read

jobs:
lint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- name: Install Poetry
run: pip install poetry==2.0.1
- name: Set up Python 3.10
uses: actions/setup-python@v6
with:
python-version: "3.10"
cache: 'poetry'
- name: Install dependencies
run: poetry install
- name: Run linters
run: make lint-check
- name: Security audit
run: make audit

test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- name: Install Poetry
run: pip install poetry==2.0.1
- name: Set up Python 3.10
uses: actions/setup-python@v6
with:
python-version: "3.10"
cache: 'poetry'
- name: Install dependencies
run: poetry install
- name: Run tests with coverage
run: make coverage
tests:
uses: ./.github/workflows/tests.yml
permissions:
contents: read

release:
needs: [lint, test]
runs-on: ubuntu-latest
needs: tests
outputs:
released: ${{ steps.release.outputs.released }}
tag: ${{ steps.release.outputs.tag }}

release_created: ${{ steps.release.outputs.release_created }}
tag_name: ${{ steps.release.outputs.tag_name }}
permissions:
contents: write

pull-requests: write
steps:
- name: Generate bot app token
id: generate_token
uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf
- uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
id: app-token
with:
app-id: ${{ secrets.MY_RELEASER_ID }}
client-id: ${{ secrets.MY_RELEASER_ID }}
private-key: ${{ secrets.MY_RELEASER_PRIVATE_KEY }}

- name: Checkout
uses: actions/checkout@v6
with:
token: ${{ steps.generate_token.outputs.token }}
fetch-depth: 0

- name: Install Poetry
run: pip install poetry==2.0.1

- name: Set up Python 3.10
uses: actions/setup-python@v6
with:
python-version: "3.10"
cache: 'poetry'

- name: Install dependencies
run: poetry install

- name: Semantic Version Release
- uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
id: release
uses: python-semantic-release/python-semantic-release@350c48fcb3ffcdfd2e0a235206bc2ecea6b69df0
with:
github_token: ${{ steps.generate_token.outputs.token }}
git_committer_name: "semantic-release"
git_committer_email: "semantic-release@users.noreply.github.com"
build: false
token: ${{ steps.app-token.outputs.token }}

- name: Build package
if: steps.release.outputs.released == 'true'
run: poetry build

- name: Upload to GitHub Release Assets
uses: python-semantic-release/publish-action@310a9983a0ae878b29f3aac778d7c77c1db27378
if: steps.release.outputs.released == 'true'
with:
github_token: ${{ steps.generate_token.outputs.token }}
tag: ${{ steps.release.outputs.tag }}

- name: Upload Distribution Artifacts
uses: actions/upload-artifact@v6
if: steps.release.outputs.released == 'true'
with:
name: distribution-artifacts
path: dist
if-no-files-found: error

deploy:
publish:
runs-on: ubuntu-latest
needs: release
if: ${{ needs.release.outputs.released == 'true' }}
if: ${{ needs.release.outputs.release_created == 'true' }}

environment:
name: pypi
Expand All @@ -125,13 +46,24 @@ jobs:
id-token: write

steps:
- name: Download Build Artifacts
uses: actions/download-artifact@v7
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ needs.release.outputs.tag_name }}

- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
name: distribution-artifacts
path: dist
python-version: "3.10"

- name: Install Poetry
run: pipx install poetry==2.0.1

- name: Install dependencies
run: poetry install

- name: Build package
run: make build

- name: Publish package to PyPI
- name: Publish to PyPI
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e
with:
packages-dir: dist
32 changes: 32 additions & 0 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
name: Test

on:
workflow_call:
inputs:
upload-coveralls:
description: 'Upload coverage to Coveralls'
required: false
default: false
type: boolean

jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6

@coderabbitai coderabbitai Bot Jul 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

Disable credential persistence on checkout.

Same rationale as the other reusable workflows: poetry install executes third-party code, so a persisted git credential is unnecessary exposure.

🔒 Proposed fix 
     - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- uses: actions/checkout@v6
- uses: actions/checkout@v6
with:
persist-credentials: false
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 16-16: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/test.yml at line 16, The checkout step is persisting git
credentials unnecessarily, which exposes them to later third-party steps like
poetry install. Update the actions/checkout usage in the workflow to disable
credential persistence by setting the checkout action’s credential persistence
option off, keeping the rest of the job flow unchanged.

Source: Linters/SAST tools

- name: Set up Python 3.10
uses: actions/setup-python@v6
with:
python-version: "3.10"
- name: Install Poetry
run: pipx install poetry==2.0.1
- name: Install dependencies
run: poetry install
- name: Run tests with coverage
run: make coverage
- name: Coveralls
if: ${{ inputs.upload-coveralls }}
uses: coverallsapp/github-action@v2
with:
path-to-lcov: "./coverage.lcov"
github-token: ${{ secrets.GITHUB_TOKEN }}
67 changes: 7 additions & 60 deletions .github/workflows/tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
name: Testing pipeline

on:
workflow_call:
pull_request:
branches:
- main
Expand Down Expand Up @@ -29,67 +30,13 @@ permissions:

jobs:
lint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- name: Install Poetry
run: pip install poetry==2.0.1
- name: Set up Python 3.10
uses: actions/setup-python@v6
with:
python-version: "3.10"
cache: 'poetry'
- name: Install dependencies
run: poetry install
- name: Run linters
run: make lint-check
- name: Security audit
run: make audit
uses: ./.github/workflows/lint.yml

test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- name: Install Poetry
run: pip install poetry==2.0.1
- name: Set up Python 3.10
uses: actions/setup-python@v6
with:
python-version: "3.10"
cache: 'poetry'
- name: Install dependencies
run: poetry install
- name: Run tests with coverage
run: make coverage
- name: Coveralls
uses: coverallsapp/github-action@v2
with:
path-to-lcov: "./coverage.lcov"
github-token: ${{ secrets.GITHUB_TOKEN }}
uses: ./.github/workflows/test.yml
with:
upload-coveralls: true
secrets: inherit
Comment on lines 35 to +39

@coderabbitai coderabbitai Bot Jul 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Drop unnecessary secrets: inherit on the test job.

test.yml only uses secrets.GITHUB_TOKEN, which is automatically granted to called workflows without secrets: inherit. As-is, this exposes every repo/org/environment secret to test.yml unnecessarily, violating least privilege.

🔒 Proposed fix 
   test:
     uses: ./.github/workflows/test.yml
     with:
       upload-coveralls: true
-    secrets: inherit
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- name: Install Poetry
run: pip install poetry==2.0.1
- name: Set up Python 3.10
uses: actions/setup-python@v6
with:
python-version: "3.10"
cache: 'poetry'
- name: Install dependencies
run: poetry install
- name: Run tests with coverage
run: make coverage
- name: Coveralls
uses: coverallsapp/github-action@v2
with:
path-to-lcov: "./coverage.lcov"
github-token: ${{ secrets.GITHUB_TOKEN }}
uses: ./.github/workflows/test.yml
with:
upload-coveralls: true
secrets: inherit
test:
uses: ./.github/workflows/test.yml
with:
upload-coveralls: true
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 36-36: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow

(secrets-inherit)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/tests.yml around lines 35 - 39, Remove the unnecessary
secrets inheritance from the test job in the tests workflow. The reusable
workflow invocation for test should rely on the automatically provided
GITHUB_TOKEN instead of passing all secrets through secrets: inherit; update the
test job configuration accordingly and keep the existing uses and with settings
unchanged.

Source: Linters/SAST tools


e2e:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- name: Install Poetry
run: pip install poetry==2.0.1
- name: Set up Python 3.10
uses: actions/setup-python@v6
with:
python-version: "3.10"
cache: 'poetry'
- name: Install dependencies
run: poetry install
- name: Set up Node.js
uses: actions/setup-node@v6
with:
node-version: '22'
- name: Install Cypress
working-directory: tests/e2e_tests
run: npm install cypress
- name: Run e2e tests
run: |
poetry run flask --app "tests.e2e_tests.e2e_app:create_app(config_path='tests/e2e_tests/e2e_test_config.yml')" run --debug --host=localhost &
for i in $(seq 1 30); do curl -sf http://localhost:5000/health/liveness > /dev/null && break || sleep 1; done
curl -sf http://localhost:5000/health/liveness > /dev/null || { echo "Flask app failed to start"; exit 1; }
cd tests/e2e_tests && npx cypress run --spec "cypress/e2e/**/*"
uses: ./.github/workflows/e2e.yml
3 changes: 3 additions & 0 deletions .release-please-manifest.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
{
".": "1.0.0"
}
3 changes: 0 additions & 3 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,8 +22,5 @@ coverage:
html-cov: coverage
poetry run coverage html

audit:
poetry run pip-audit || true

build:
poetry build
Loading