From 09be9c9e6523cee6e8f8bcdbbf65ea7cbf386c33 Mon Sep 17 00:00:00 2001 From: S4NKALP Date: Wed, 29 Oct 2025 12:07:07 +0545 Subject: [PATCH] chore: add CI, pre-commit, dependabot, and codeql workflows for automated code quality and security checks --- .github/dependabot.yml | 19 +++++++++ .github/workflows/ci.yml | 47 +++++++++++++++++++++ .github/workflows/codeql.yml | 34 +++++++++++++++ .github/workflows/dependabot-auto-merge.yml | 42 ++++++++++++++++++ .github/workflows/pre-commit.yml | 30 +++++++++++++ .pre-commit-config.yaml | 21 +++++++++ 6 files changed, 193 insertions(+) create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/ci.yml create mode 100644 .github/workflows/codeql.yml create mode 100644 .github/workflows/dependabot-auto-merge.yml create mode 100644 .github/workflows/pre-commit.yml create mode 100644 .pre-commit-config.yaml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..7bbac87 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,19 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + labels: + - "dependencies" + - "github-actions" + + - package-ecosystem: "pip" + directory: "/" + schedule: + interval: "weekly" + labels: + - "dependencies" + - "python" + open-pull-requests-limit: 10 + diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..f8db5a5 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,47 @@ +name: CI + +on: + push: + branches: [ main, develop ] + pull_request: + branches: [ main, develop ] + +jobs: + lint-and-test: + name: Lint and Test + runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + python-version: ["3.13"] + + steps: + - uses: actions/checkout@v4 + + - name: Set up Python ${{ matrix.python-version }} + uses: actions/setup-python@v5 + with: + python-version: ${{ matrix.python-version }} + + - name: Install dependencies + run: | + python -m pip install --upgrade pip + pip install ruff + pip install -e . + + - name: Lint with Ruff + run: | + ruff check src/ + + - name: Check formatting with Ruff + run: | + ruff format --check src/ + + - name: Test CLI import + run: | + python -c "from src.generator import main; print('Import successful')" + + - name: Test console script entry point + run: | + djinit --help + diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..8ad65b3 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,34 @@ +name: CodeQL Analysis + +on: + push: + branches: [ main, develop ] + pull_request: + branches: [ main ] + schedule: + - cron: '0 0 * * 1' # Weekly on Monday + +jobs: + analyze: + name: CodeQL Security Analysis + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: python + + - name: Autobuild + uses: github/codeql-action/autobuild@v3 + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml new file mode 100644 index 0000000..34c6446 --- /dev/null +++ b/.github/workflows/dependabot-auto-merge.yml @@ -0,0 +1,42 @@ +name: Dependabot Auto-Approve and Auto-Merge + +on: + pull_request_target: + types: [opened, reopened, synchronize] + +permissions: + contents: write + pull-requests: write + +jobs: + dependabot: + if: github.actor == 'dependabot[bot]' + runs-on: ubuntu-latest + steps: + - name: Dependabot metadata + id: metadata + uses: dependabot/fetch-metadata@v2 + + - name: Approve PR + if: | + steps.metadata.outputs.update-type == 'version-update:semver-minor' || + steps.metadata.outputs.update-type == 'version-update:semver-patch' + uses: actions/github-script@v7 + with: + script: | + await github.pulls.createReview({ + owner: context.repo.owner, + repo: context.repo.repo, + pull_number: context.payload.pull_request.number, + event: 'APPROVE' + }) + + - name: Enable auto-merge (squash) + if: | + steps.metadata.outputs.update-type == 'version-update:semver-minor' || + steps.metadata.outputs.update-type == 'version-update:semver-patch' + uses: peter-evans/enable-pull-request-automerge@v3 + with: + token: ${{ secrets.GITHUB_TOKEN }} + merge-method: squash + diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml new file mode 100644 index 0000000..b218c82 --- /dev/null +++ b/.github/workflows/pre-commit.yml @@ -0,0 +1,30 @@ + +name: Pre-commit + +on: + pull_request: + push: + branches: [ main, develop ] + +jobs: + pre-commit: + name: Run Pre-commit Hooks + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v4 + + - name: Set up Python + uses: actions/setup-python@v5 + with: + python-version: "3.13" + + - name: Install pre-commit + run: | + python -m pip install --upgrade pip + pip install pre-commit + + - name: Run pre-commit + run: | + pre-commit run --all-files + diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 0000000..059217a --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,21 @@ +# Pre-commit hooks for djinit + +default_language_version: + python: python3.13 + +repos: + - repo: https://github.com/astral-sh/ruff-pre-commit + rev: v0.1.4 + hooks: + - id: ruff + args: [--fix, --exit-non-zero-on-fix] + - id: ruff-format + + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v4.5.0 + hooks: + - id: trailing-whitespace + - id: end-of-file-fixer + - id: check-yaml + - id: check-added-large-files +