mirror of
https://github.com/trailofbits/algo.git
synced 2026-09-30 13:35:00 +02:00
ci: modernize tooling with prek, ty, and security scanning (#14956)
* ci: modernize tooling with prek, ty, and security scanning Migrate from pre-commit to prek (Rust-native, faster hooks) and add comprehensive CI improvements for code quality and security. Changes: - Replace pre-commit with prek for git hooks - Add ty type checker (Rust-based, replaces mypy) - Expand ruff rules: security (S), simplify (SIM), commented code (ERA) - Add pip-audit workflow for Python dependency CVE scanning - Add actionlint and zizmor for GitHub Actions linting/security - Add ruff format check to CI - Enable stricter ansible-lint rules (no-changed-when, risky-file-permissions) - Remove obsolete Claude workflow files - Apply ruff formatting fixes to test files Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(ci): resolve actionlint install and ty type errors - Use actionlint's official install script instead of broken URL pattern - Exclude test mock modules from ty type checking - Run workflows on push only for main/master to avoid duplicate PR runs Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(ci): use glob pattern for actionlint, exclude all tests from ty - actionlint requires *.yml glob, not directory path - Exclude all tests from ty type checking (test code has looser typing) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(ci): quote shell variables to fix shellcheck warnings Fix SC2046/SC2086 warnings in workflow scripts: - Quote $(uname -r) in apt-get install - Quote $(pwd) in docker volume mount - Quote $existing in gh issue comment Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(ci): move key-order[task] to warn_list Too many existing violations in the codebase to enable as error. Move to warn_list for gradual fixes over time. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Dan Guido
co-authored by
Claude Opus 4.5
Claude Opus 4.5
parent
4d462eed57
commit
21e21747ea
@@ -1,66 +0,0 @@
|
||||
---
|
||||
name: Claude Code Review
|
||||
|
||||
'on':
|
||||
pull_request:
|
||||
types: [opened, synchronize]
|
||||
# Optional: Only run on specific file changes
|
||||
# paths:
|
||||
# - "src/**/*.ts"
|
||||
# - "src/**/*.tsx"
|
||||
# - "src/**/*.js"
|
||||
# - "src/**/*.jsx"
|
||||
|
||||
jobs:
|
||||
claude-review:
|
||||
# Optional: Filter by PR author
|
||||
# if: |
|
||||
# github.event.pull_request.user.login == 'external-contributor' ||
|
||||
# github.event.pull_request.user.login == 'new-developer' ||
|
||||
# github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
|
||||
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
pull-requests: read
|
||||
issues: read
|
||||
id-token: write
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v6.0.2
|
||||
with:
|
||||
fetch-depth: 1
|
||||
|
||||
- name: Run Claude Code Review
|
||||
id: claude-review
|
||||
uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
|
||||
use_sticky_comment: true
|
||||
prompt: |
|
||||
REPO: ${{ github.repository }}
|
||||
PR NUMBER: ${{ github.event.pull_request.number }}
|
||||
|
||||
IMPORTANT: Before posting your review, minimize any previous review comments from yourself to avoid cluttering the PR:
|
||||
1. List existing comments: gh api repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments
|
||||
2. Find comments from "github-actions[bot]" that contain "Code Review" or review-related content in the body
|
||||
3. For each such comment, minimize it as OUTDATED using:
|
||||
gh api graphql -f query='mutation($id: ID!) { minimizeComment(input: {subjectId: $id, classifier: OUTDATED}) { minimizedComment { isMinimized } } }' -f id="<node_id>"
|
||||
|
||||
Then review this pull request and provide feedback on:
|
||||
- Code quality and best practices
|
||||
- Potential bugs or issues
|
||||
- Performance considerations
|
||||
- Security concerns
|
||||
- Test coverage
|
||||
|
||||
Use the repository's CLAUDE.md for guidance on style and conventions. Be constructive and helpful in your feedback.
|
||||
|
||||
Use `gh pr comment` with your Bash tool to leave your review as a comment on the PR.
|
||||
|
||||
# See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
|
||||
# or https://docs.claude.com/en/docs/claude-code/cli-reference for available options
|
||||
# Note: gh api is needed for minimizing old comments (workaround for broken use_sticky_comment)
|
||||
# See: https://github.com/anthropics/claude-code-action/issues/419
|
||||
claude_args: '--allowed-tools "Bash(gh issue view:*),Bash(gh search:*),Bash(gh issue list:*),Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*),Bash(gh api:*),Bash(ansible-playbook * --syntax-check),Bash(ansible-lint *),Bash(ruff check *),Bash(yamllint *),Bash(shellcheck *),Bash(python -m pytest *)"'
|
||||
@@ -1,49 +0,0 @@
|
||||
---
|
||||
name: Claude Code
|
||||
|
||||
'on':
|
||||
issue_comment:
|
||||
types: [created]
|
||||
pull_request_review_comment:
|
||||
types: [created]
|
||||
issues:
|
||||
types: [opened, assigned]
|
||||
pull_request_review:
|
||||
types: [submitted]
|
||||
|
||||
jobs:
|
||||
claude:
|
||||
if: |
|
||||
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
|
||||
(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
|
||||
(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
|
||||
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
pull-requests: read
|
||||
issues: read
|
||||
id-token: write
|
||||
actions: read # Required for Claude to read CI results on PRs
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v6.0.2
|
||||
with:
|
||||
fetch-depth: 1
|
||||
|
||||
- name: Run Claude Code
|
||||
id: claude
|
||||
uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
|
||||
|
||||
# This is an optional setting that allows Claude to read CI results on PRs
|
||||
additional_permissions: |
|
||||
actions: read
|
||||
|
||||
# Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it.
|
||||
# prompt: 'Update the pull request description to include a summary of changes.'
|
||||
|
||||
# Add allowed tools for Algo project
|
||||
# See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
|
||||
claude_args: '--allowed-tools "Bash(gh issue view:*),Bash(gh search:*),Bash(gh issue list:*),Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*),Bash(ansible-playbook * --syntax-check),Bash(ansible-lint *),Bash(ruff check *),Bash(yamllint *),Bash(shellcheck *),Bash(python -m pytest *)"'
|
||||
@@ -46,7 +46,7 @@ jobs:
|
||||
dnsmasq \
|
||||
qrencode \
|
||||
openssl \
|
||||
linux-headers-$(uname -r) \
|
||||
"linux-headers-$(uname -r)" \
|
||||
libxml2-utils \
|
||||
dnsutils
|
||||
|
||||
@@ -296,6 +296,6 @@ jobs:
|
||||
EOF
|
||||
|
||||
# Test that config is readable
|
||||
docker run --rm --entrypoint cat -v $(pwd)/test-data:/data algo:ci-test /data/config.cfg
|
||||
docker run --rm --entrypoint cat -v "$(pwd)/test-data:/data" algo:ci-test /data/config.cfg
|
||||
|
||||
echo "✓ Docker image built and basic tests passed"
|
||||
|
||||
@@ -1,7 +1,10 @@
|
||||
---
|
||||
name: Lint
|
||||
|
||||
'on': [push, pull_request]
|
||||
'on':
|
||||
push:
|
||||
branches: [main, master]
|
||||
pull_request:
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
@@ -59,11 +62,32 @@ jobs:
|
||||
- name: Setup Algo environment
|
||||
uses: ./.github/actions/setup-algo
|
||||
|
||||
- name: Run ruff
|
||||
- name: Run ruff check
|
||||
run: |
|
||||
# Fast Python linter
|
||||
uv run --with ruff ruff check .
|
||||
|
||||
- name: Run ruff format check
|
||||
run: |
|
||||
# Verify consistent Python formatting
|
||||
uv run --with ruff ruff format --check .
|
||||
|
||||
python-types:
|
||||
name: Python type checking
|
||||
runs-on: ubuntu-22.04
|
||||
steps:
|
||||
- uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v5.0.1
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Setup Algo environment
|
||||
uses: ./.github/actions/setup-algo
|
||||
|
||||
- name: Run ty check
|
||||
run: |
|
||||
# Type checking with ty
|
||||
uv run --with ty ty check
|
||||
|
||||
shellcheck:
|
||||
name: Shell script linting
|
||||
runs-on: ubuntu-22.04
|
||||
@@ -125,3 +149,36 @@ jobs:
|
||||
Write-Host '✓ PSScriptAnalyzer check passed'
|
||||
}
|
||||
"
|
||||
|
||||
actionlint:
|
||||
name: GitHub Actions linting
|
||||
runs-on: ubuntu-22.04
|
||||
steps:
|
||||
- uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v5.0.1
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Install actionlint
|
||||
run: |
|
||||
bash <(curl -sL https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
|
||||
sudo mv actionlint /usr/local/bin/
|
||||
|
||||
- name: Run actionlint
|
||||
run: |
|
||||
actionlint .github/workflows/*.yml
|
||||
|
||||
zizmor:
|
||||
name: GitHub Actions security audit
|
||||
runs-on: ubuntu-22.04
|
||||
steps:
|
||||
- uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v5.0.1
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Install zizmor
|
||||
run: |
|
||||
pip install zizmor
|
||||
|
||||
- name: Run zizmor
|
||||
run: |
|
||||
zizmor .github/workflows/
|
||||
|
||||
@@ -0,0 +1,25 @@
|
||||
---
|
||||
name: Security
|
||||
|
||||
'on':
|
||||
push:
|
||||
branches: [main, master]
|
||||
pull_request:
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
pip-audit:
|
||||
name: Python dependency audit
|
||||
runs-on: ubuntu-22.04
|
||||
steps:
|
||||
- uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v5.0.1
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Setup Algo environment
|
||||
uses: ./.github/actions/setup-algo
|
||||
|
||||
- name: Run pip-audit
|
||||
run: uv run --with pip-audit pip-audit
|
||||
@@ -53,7 +53,7 @@ jobs:
|
||||
--label "test-effectiveness,maintenance"
|
||||
else
|
||||
# Update existing issue
|
||||
gh issue comment $existing --body-file .metrics/test-effectiveness-report.md
|
||||
gh issue comment "$existing" --body-file .metrics/test-effectiveness-report.md
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
Reference in New Issue
Block a user