MultiLLM-Proxy/.github/workflows/ci.yml at main · ALikesToCode/MultiLLM-Proxy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
name: ci

on:
  pull_request:
  push:
    branches:
      - main
      - review/**

permissions:
  contents: read

jobs:
  python:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.11"
      - name: Install Python dependencies
        run: python -m pip install --disable-pip-version-check --require-hashes -r requirements-ci.lock
      - name: Static secret scan
        run: python scripts/check_static_secrets.py
      - name: Ruff fatal checks
        run: ruff check . --select E9,F63,F7,F82
      - name: Type import checks
        run: >
          mypy --ignore-missing-imports --follow-imports=skip
          --disable-error-code import-untyped
          --disable-error-code var-annotated
          --disable-error-code arg-type
          --disable-error-code assignment
          --disable-error-code operator
          app.py routes services providers streaming
      - name: Bandit security scan
        run: >
          bandit -q -c .bandit
          -r app.py config.py error_handlers.py route_helpers.py routes services providers streaming
      - name: Dependency audit
        run: pip-audit -r requirements.lock
      - name: Python tests
        run: python -m pytest -q

  node:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.11"
      - name: Install Python dependencies
        run: python -m pip install --disable-pip-version-check --require-hashes -r requirements-ci.lock
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "22"
          cache: npm
      - name: Install Node dependencies
        run: npm ci
      - name: Node audit
        run: npm audit --audit-level=high
      - name: Frontend build contracts
        run: node --test tests/test_frontend_build.mjs
      - name: Worker tests
        env:
          PYTHON: python
        run: npm run test:worker
      - name: D1 migration checks
        run: npm run cf:migrations:check
      - name: Deploy pipeline tests
        run: npm run test:deploy
      - name: Free pool Worker contracts
        run: node --test tests/test_free_routes_worker.mjs
      - name: Client header contracts
        run: node --test tests/test_client_headers_worker.mjs

  integration:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.11"
      - name: Install Python dependencies
        run: python -m pip install --disable-pip-version-check --require-hashes -r requirements-ci.lock
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "22"
          cache: npm
      - name: Install Node dependencies
        run: npm ci
      - name: Python accounts and routes through the Worker and a real D1
        env:
          PYTHON: python
        run: npm run test:integration

  cloudflare-build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "24"
      - name: Install deployment package manager
        run: npm install --global "$(node -p "require('./package.json').packageManager")"
      - name: Install deployment dependencies
        run: pnpm install --frozen-lockfile
      - name: Build frontend assets
        run: pnpm run build
      - name: Check committed frontend assets
        run: git diff --exit-code -- static/css/style.css
      - name: Frontend build contracts
        run: node --test tests/test_frontend_build.mjs
      - name: Check release configuration
        run: node scripts/key_data_preflight.mjs --check
      # Bundle-only checks cannot attest remote deployment prerequisites. The
      # normal Wrangler build command enforces those before a real upload.
      - name: Validate Knowledge Worker bundle
        env:
          WRANGLER_SEND_METRICS: "false"
        run: node scripts/check_worker_bundle.mjs --config wrangler.knowledge.jsonc --outdir /tmp/knowledge-worker
      - name: Validate main Worker bundle
        env:
          WRANGLER_SEND_METRICS: "false"
        run: node scripts/check_worker_bundle.mjs --config wrangler.jsonc --outdir /tmp/main-worker