configcrypt/.github/workflows/test.yml at main · transcentlin/configcrypt · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
name: Tests

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]

jobs:
  test:
    name: Test on Windows - Python ${{ matrix.python-version }}
    runs-on: windows-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ['3.10', '3.11', '3.12']  # 减少到 3 个版本

    steps:
    - uses: actions/checkout@v4

    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@v5
      with:
        python-version: ${{ matrix.python-version }}
        cache: 'pip'

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -e ".[dev]"

    - name: Verify keyring backend availability
      run: |
        python -c "import keyring; print(f'Keyring backend: {keyring.get_keyring()}')"
      continue-on-error: true

    - name: Lint with flake8
      run: |
        flake8 src/configcrypt --count --select=E9,F63,F7,F82 --show-source --statistics
        flake8 src/configcrypt --count --exit-zero --max-complexity=10 --max-line-length=100 --statistics

    - name: Check code formatting with black
      run: |
        black --check src/configcrypt tests

    - name: Type check with mypy
      run: |
        mypy src/configcrypt --ignore-missing-imports
      continue-on-error: true

    - name: Run unit tests
      run: |
        pytest tests/unit -v --cov=configcrypt --cov-report=xml --cov-report=term-missing -x
      timeout-minutes: 20

    - name: Run CLI tests
      run: |
        pytest tests/cli -v --tb=short -x
      timeout-minutes: 10

    - name: Run GUI tests
      run: |
        pytest tests/gui -v --tb=short -x
      timeout-minutes: 15
      continue-on-error: true  # GUI 测试允许失败

    - name: Upload coverage to Codecov
      if: matrix.python-version == '3.11'
      uses: codecov/codecov-action@v5
      with:
        files: ./coverage.xml
        fail_ci_if_error: false
        token: ${{ secrets.CODECOV_TOKEN }}
      continue-on-error: true

  property-tests:
    name: Property-Based Tests on Windows
    runs-on: windows-latest

    steps:
    - uses: actions/checkout@v4

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.11'
        cache: 'pip'

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -e ".[dev]"

    - name: Run property-based tests with hypothesis
      run: |
        pytest tests/unit -v -m property --hypothesis-show-statistics --hypothesis-profile=ci -x
      timeout-minutes: 30
      env:
        HYPOTHESIS_PROFILE: ci

  integration-tests:
    name: Integration Tests on Windows
    runs-on: windows-latest
    needs: test

    steps:
    - uses: actions/checkout@v4

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.11'
        cache: 'pip'

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -e ".[dev]"

    - name: Run integration tests
      run: |
        pytest tests/ -v -m integration --tb=short -x
      timeout-minutes: 15

  security-audit:
    name: Security Audit
    runs-on: windows-latest

    steps:
    - uses: actions/checkout@v4

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.11'
        cache: 'pip'

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install safety bandit

    - name: Run safety check (dependencies)
      run: |
        safety check --json || true
      continue-on-error: true

    - name: Run bandit (code security)
      run: |
        bandit -r src/configcrypt -f json -o bandit-report.json || true
        cat bandit-report.json
      continue-on-error: true

    - name: Upload security reports
      if: always()
      uses: actions/upload-artifact@v4
      with:
        name: security-reports
        path: bandit-report.json
      continue-on-error: true