OpenCodeBestFriend/.github/workflows/ci.yml at main · kuker24/OpenCodeBestFriend · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
name: ci

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13"]
    env:
      OPENCODE_DISABLE_CLAUDE_CODE: "1"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ matrix.python-version }}
      - name: Shell syntax
        run: |
          bash -n install.sh uninstall.sh restore.sh opencode-bf bin/opencode-chromium-cdp \
            scripts/make-release-artifacts.sh scripts/verify-release-artifacts.sh
      - name: Compileall
        run: python3 -m compileall -q lib tests
      - name: Unit and installer tests
        run: python3 -m unittest discover -s tests -v
      - name: Product isolation scan
        run: python3 tests/test_isolation.py

  shellcheck:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install shellcheck
        run: sudo apt-get update -qq && sudo apt-get install -y -qq shellcheck
      - name: Shellcheck
        run: |
          shellcheck -x install.sh uninstall.sh restore.sh opencode-bf bin/opencode-chromium-cdp \
            scripts/make-release-artifacts.sh scripts/verify-release-artifacts.sh

  gitleaks:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - name: gitleaks
        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  semgrep:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      - name: semgrep
        run: |
          python3 -m pip install --quiet semgrep
          semgrep --config .semgrep.yml --error lib tests

  ocr-integration:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      - name: Install OCR stack
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq poppler-utils tesseract-ocr tesseract-ocr-eng tesseract-ocr-ind
          python3 -m pip install --quiet Pillow pypdf
      - name: Real OCR integration
        env:
          SMARTDOC_OCR_INTEGRATION: "1"
        run: |
          python3 -m unittest tests.test_smartdoc_ocr_integration -v
          python3 -m lib.cli smartdoc doctor --json

  browser-smoke:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "24"
      - name: Install pinned Chromium snapshot
        id: chromium
        uses: browser-actions/setup-chrome@48ad923757ca74d66703209fe939badbdf80f2f4 # v2.2.0
        with:
          chrome-version: "1692935"
          install-dependencies: true
      - name: ScrollCraft browser lifecycle and interaction smoke
        env:
          OPENCODE_CHROMIUM_BIN: ${{ steps.chromium.outputs.chrome-path }}
          OPENCODE_CHROMIUM_NO_SANDBOX: "1"
        run: node tests/scroll_craft_browser_smoke.mjs

  release-artifact:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      - name: Build release artifacts from explicit HEAD
        run: |
          ./scripts/make-release-artifacts.sh --sha "$(git rev-parse HEAD)" --allow-untagged
      - name: Verify release artifacts
        run: |
          ./scripts/verify-release-artifacts.sh dist "$(git rev-parse HEAD)"
      - name: Reproducible second build
        run: |
          first="$(sha256sum dist/SHA256SUMS)"
          ./scripts/make-release-artifacts.sh --sha "$(git rev-parse HEAD)" --allow-untagged
          second="$(sha256sum dist/SHA256SUMS)"
          test "$first" = "$second"
          (cd dist && sha256sum -c SHA256SUMS)
      - name: Extract smoke
        run: |
          VER="$(tr -d '[:space:]' < VERSION)"
          python3 -m lib.release smoke-extract dist --dest "$RUNNER_TEMP/ocbf-extract" --version "$VER"
          python3 -m compileall -q "$RUNNER_TEMP/ocbf-extract/OpenCodeBestFriend-v${VER}/lib"