feat: add REST API server and Knowledge Workbench web UI #75
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: ["main"] | |
| pull_request: | |
| # Least-privilege token: this workflow only reads the repo. Arbitrary | |
| # dependency build code runs during install, so never expose a writable | |
| # token to it (see the supply-chain notes in pyproject.toml). | |
| permissions: | |
| contents: read | |
| # Cancel superseded runs on the same ref (rapid PR pushes) instead of | |
| # letting them pile up and post stale statuses. | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| check: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
| with: | |
| persist-credentials: false | |
| - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 | |
| with: | |
| version: "0.10.2" | |
| enable-cache: true | |
| # `uv sync --locked` installs the exact uv.lock resolution (direct AND | |
| # transitive deps) and fails if the lock is stale — a bare `pip install` | |
| # would ignore the lockfile and let transitive versions float, defeating | |
| # the repo's exact-pin supply-chain policy. Run `uv lock` and commit the | |
| # lockfile whenever pyproject dependencies change. | |
| # | |
| # `--extra api` is required: the REST tests (tests/test_api*.py) import | |
| # fastapi/uvicorn, which live in the `api` extra — without it pytest fails | |
| # at collection with ModuleNotFoundError: fastapi. | |
| - name: Install (locked) | |
| run: uv sync --locked --extra dev --extra api --python 3.12 | |
| # --no-sync: don't let `uv run` re-sync without the dev extra and | |
| # uninstall the tools it is about to run. | |
| - name: Ruff lint | |
| run: uv run --no-sync ruff check . | |
| - name: Ruff format check | |
| run: uv run --no-sync ruff format --check . | |
| - name: Mypy | |
| run: uv run --no-sync mypy openkb | |
| - name: Pytest | |
| run: uv run --no-sync pytest | |
| # Build the Workbench SPA so a broken frontend (vite/config error, stale | |
| # package-lock, JS error) is caught here at PR time rather than only in | |
| # publish.yml after a release tag is pushed. Mirrors the release build step. | |
| web: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: "20" | |
| - name: Build Workbench web bundle | |
| working-directory: frontend | |
| run: | | |
| npm ci | |
| npm run build |