mirror of
https://github.com/NicolasBohn/NexQuant.git
synced 2026-07-27 23:47:46 +00:00
TPTBusiness
d8ab86d6cf
Path injection (#22, #28, #29, #30): - Switch from Path.relative_to() to os.path.realpath() + str.startswith() in all four path-validation sites across finetune and rl UI data_loader.py and finetune app.py. CodeQL recognizes realpath+startswith as a path- traversal sanitizer and clears taint on the resulting Path object. - Also simplify finetune/app.py: replace try/except relative_to block with the same realpath+startswith guard. Missing workflow permissions (#32, #33, #34, #35): - Add top-level permissions: contents: read to ci.yml, docs.yml, lint.yml, and security.yml. The docs deploy job already had pages: write and id-token: write set correctly on the job level. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
85 lines
2.3 KiB
YAML
85 lines
2.3 KiB
YAML
name: Code Quality
|
|
|
|
on:
|
|
push:
|
|
branches: [ main, develop ]
|
|
pull_request:
|
|
branches: [ main ]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
lint:
|
|
name: Lint & Format
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.10"
|
|
|
|
- name: Cache pip dependencies
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: ~/.cache/pip
|
|
key: ${{ runner.os }}-pip-lint-${{ hashFiles('**/pyproject.toml') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-pip-lint-
|
|
|
|
- name: Install lint dependencies
|
|
run: |
|
|
python -m pip install --upgrade pip
|
|
pip install ruff mypy
|
|
|
|
- name: Run Ruff (linter)
|
|
run: |
|
|
echo "=== Running Ruff Linter ==="
|
|
ruff check . --statistics || {
|
|
echo "::error::Ruff linter found issues. Run: ruff check . --fix"
|
|
exit 1
|
|
}
|
|
|
|
- name: Run Ruff (formatter)
|
|
run: |
|
|
echo "=== Running Ruff Formatter ==="
|
|
ruff format --check . || {
|
|
echo "::error::Ruff formatter found issues. Run: ruff format ."
|
|
exit 1
|
|
}
|
|
|
|
- name: Run MyPy (type checker)
|
|
run: |
|
|
echo "=== Running MyPy Type Checker ==="
|
|
mypy rdagent/ \
|
|
--ignore-missing-imports \
|
|
--no-strict-optional \
|
|
--follow-imports=skip \
|
|
--warn-return-any || {
|
|
echo "::warning::MyPy found type issues (non-blocking)"
|
|
# Non-blocking: MyPy warnings don't fail the build
|
|
exit 0
|
|
}
|
|
|
|
- name: Check for trailing whitespace
|
|
run: |
|
|
echo "=== Checking for trailing whitespace ==="
|
|
if grep -rIn '[[:space:]]$' --include='*.py' --include='*.md' --include='*.rst' . | grep -v '.git'; then
|
|
echo "::error::Found trailing whitespace. Please remove it."
|
|
exit 1
|
|
fi
|
|
echo "✓ No trailing whitespace found"
|
|
|
|
- name: Check for merge conflicts
|
|
run: |
|
|
echo "=== Checking for merge conflict markers ==="
|
|
if grep -rn '<<<<<<< HEAD\|=======\|>>>>>>>' --include='*.py' --include='*.md' . | grep -v '.git'; then
|
|
echo "::error::Found merge conflict markers. Please resolve them."
|
|
exit 1
|
|
fi
|
|
echo "✓ No merge conflict markers found"
|