Add GitHub Actions workflow for Python application - #89
Conversation
This workflow installs Python dependencies, runs linting with flake8, and executes tests with pytest.
📝 WalkthroughWalkthroughAdds a GitHub Actions workflow for Python 3.10 that runs on changes to ChangesPython CI workflow
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment Warning |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/python-app.yml:
- Around line 35-36: Update the flake8 command in the workflow so lint
violations produce a non-zero exit status by removing the --exit-zero option;
keep the existing complexity, line-length, count, and statistics settings
unchanged.
- Line 21: Update the actions/checkout@v4 step in the workflow to disable
credential persistence by setting persist-credentials to false, ensuring the
checkout token is not retained for subsequent dependency installation or pytest
steps.
- Around line 23-25: Update the Python setup step to use the maintained
actions/setup-python release, preferring v6 for this workflow unless its runner
environment supports the v7 runner-app requirement; keep the existing Python
3.10 configuration unchanged.
- Around line 37-39: Update the pytest job around the “Test with pytest” step to
provision an isolated PostgreSQL service on the port expected by tests/conft.py,
wait until it is ready, and set DATABASE_URL explicitly for the test command.
Ensure pytest runs against this configured database so store-backed tests are
exercised rather than skipped.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 673445c2-fe51-44de-abb8-351af46bcda4
📒 Files selected for processing (1)
.github/workflows/python-app.yml
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow file =="
if [ -f .github/workflows/python-app.yml ]; then
cat -n .github/workflows/python-app.yml
else
echo "missing .github/workflows/python-app.yml"
fi
echo
echo "== all workflow files =="
fd -a .yml$ .github/workflows >/tmp/workflows.txt 2>/dev/null || true
cat /tmp/workflows.txtRepository: genlayerlabs/unhardcoded
Length of output: 1770
🌐 Web query:
actions/checkout v4 persist-credentials default true README
💡 Result:
In actions/checkout v4, the persist-credentials input has a default value of true [1][2][3]. When set to true, the action configures the authentication token or SSH key into the local Git configuration, allowing your workflow scripts to run authenticated Git commands (such as git push or git pull) [1][4]. The action automatically removes these credentials during the post-job cleanup phase [1][5]. To prevent the action from adding these credentials to the Git config, you can explicitly set persist-credentials: false in your workflow step [1][4].
Citations:
- 1: https://github.com/actions/checkout/blob/v4/README.md
- 2: https://github.com/actions/checkout/blob/v4/action.yml
- 3: https://github.com/actions/checkout/blob/v4.1.1/action.yml
- 4: https://spacelift.io/blog/github-actions-checkout
- 5: https://github.com/marketplace/actions/checkout
Disable checkout credential persistence.
actions/checkout keeps the token available in local Git config by default, and this job then installs dependencies and runs pytest, so the runner-scoped GITHUB_TOKEN is unnecessarily exposed to the later steps.
Proposed fix
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v4 | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 21-21: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/python-app.yml at line 21, Update the actions/checkout@v4
step in the workflow to disable credential persistence by setting
persist-credentials to false, ensuring the checkout token is not retained for
subsequent dependency installation or pytest steps.
Source: Linters/SAST tools
| uses: actions/setup-python@v3 | ||
| with: | ||
| python-version: "3.10" |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | 💤 Low value
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
gh api repos/actions/setup-python/releases/latest --jq '.tag_name'Repository: genlayerlabs/unhardcoded
Length of output: 169
🌐 Web query:
actions/setup-python GitHub releases v7 readme actions setup python v6 v7 runner requirements
💡 Result:
The actions/setup-python GitHub action released version 7.0.0 on July 20, 2026 [1][2]. Key information regarding this release includes: Migration to ESM: The action internals were migrated to ECMAScript Modules (ESM) to ensure compatibility with the latest @actions/* packages [3][4]. Compatibility and Requirements: Like version 6, version 7 requires the runner to be on version v2.327.1 or later [3][4]. This requirement is necessary to support the upgraded action environment [5][6]. No Functional Changes: There are no changes to action inputs, outputs, or general behavior in v7 compared to v6 [3][4]. Notable Changes: The pip-install input was removed in this release [1][7]. Additionally, the release included dependency upgrades and various bug fixes, such as classifying stderr warning messages as warnings rather than errors in annotations [1]. Users should continue to explicitly set the python-version or python-version-file inputs in their workflows to ensure consistent behavior across different runners [3][4]. Existing workflows using v6 can generally be updated to v7 without changes to the workflow configuration, provided the runner version requirement is met [6][3].
Citations:
- 1: https://github.com/actions/setup-python/releases/tag/v7.0.0
- 2: https://github.com/actions/setup-python/releases
- 3: https://github.com/actions/setup-python
- 4: https://gitea.rs.h3.ink/actions/setup-python/src/tag/v7.0.0/README.md
- 5: https://github.com/actions/setup-python?tab=readme-ov-file
- 6: https://git.homeinfra.org/actions/setup-python/src/tag/v7/README.md
- 7: actions/setup-python@v6...v7
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Workflow uses:"
rg -n "uses: actions/setup-python@" .github/workflows/python-app.yml || true
echo
echo "GitHub actionlint availability:"
command -v actionlint || true
echo
echo "workflow file context:"
cat -n .github/workflows/python-app.yml | sed -n '1,80p'Repository: genlayerlabs/unhardcoded
Length of output: 1752
🌐 Web query:
GitHub docs ubuntu-latest runner default runner version 2.327.1
💡 Result:
The runner software version 2.327.1 is not the image version for the "ubuntu-latest" GitHub-hosted runner, but rather the version of the GitHub Actions runner application itself [1]. The GitHub Actions runner application (often referred to as the "runner version") is the agent that executes the workflow jobs [1]. As of July 2026, version 2.327.1 is a specific release of this application [1]. In contrast, the "ubuntu-latest" label refers to the underlying operating system image provided by GitHub [2]. As of July 29, 2026, the "ubuntu-latest" label points to the Ubuntu 24.04 LTS image [2]. These OS images are frequently updated with new software versions and maintain their own unique image versioning schemes, such as 20260726.254.1 for the Ubuntu 24.04 image [3]. Key Distinctions: - Runner Version (e.g., 2.327.1): Refers to the version of the software agent that runs your jobs [1]. - Image Version (e.g., 20260726.254.1): Refers to the specific build of the OS environment (including pre-installed tools and runtimes) currently in use [3]. - Workflow Label (e.g., ubuntu-latest): The alias used in your YAML configuration to request a specific type of environment [2].
Citations:
- 1: https://github.com/actions/runner/releases/tag/v2.327.1
- 2: https://docs.github.com/en/actions/reference/runners/github-hosted-runners
- 3: https://github.com/actions/runner-images/releases/tag/ubuntu24%2F20260726.254
Upgrade actions/setup-python from v3.
actions/setup-python@v3 is obsolete on GitHub-hosted runners. The maintained current release is v7.0.0; for this workflow, use actions/setup-python@v6 unless your runner environment supports the v7 runner app requirement.
Proposed fix
- uses: actions/setup-python@v3
+ uses: actions/setup-python@v6📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: actions/setup-python@v3 | |
| with: | |
| python-version: "3.10" | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.10" |
🧰 Tools
🪛 actionlint (1.7.12)
[error] 23-23: the runner of "actions/setup-python@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/python-app.yml around lines 23 - 25, Update the Python
setup step to use the maintained actions/setup-python release, preferring v6 for
this workflow unless its runner environment supports the v7 runner-app
requirement; keep the existing Python 3.10 configuration unchanged.
Source: Linters/SAST tools
| # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide | ||
| flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Make the full lint check fail on violations.
--exit-zero converts all complexity and line-length findings into warnings, so CI can pass despite lint failures. Remove it, or move this reporting-only check into a separate explicitly non-blocking step.
Proposed fix
- flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
+ flake8 . --count --max-complexity=10 --max-line-length=127 --statistics📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide | |
| flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics | |
| # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide | |
| flake8 . --count --max-complexity=10 --max-line-length=127 --statistics |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/python-app.yml around lines 35 - 36, Update the flake8
command in the workflow so lint violations produce a non-zero exit status by
removing the --exit-zero option; keep the existing complexity, line-length,
count, and statistics settings unchanged.
| - name: Test with pytest | ||
| run: | | ||
| pytest |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Provision PostgreSQL before running pytest.
tests/conftest.py:1-71 points store-backed tests at localhost:55432 and skips them when PostgreSQL is unavailable. Because this job defines no database service, CI can pass without exercising those tests. Add an isolated PostgreSQL service and set DATABASE_URL explicitly.
Example configuration
jobs:
build:
+ services:
+ postgres:
+ image: postgres:16
+ env:
+ POSTGRES_PASSWORD: test
+ POSTGRES_DB: hoststore
+ ports:
+ - 55432:5432
+ options: >-
+ --health-cmd pg_isready
+ --health-interval 10s
+ --health-timeout 5s
+ --health-retries 5
+
steps:
...
- name: Test with pytest
+ env:
+ DATABASE_URL: postgresql://postgres:test@localhost:55432/hoststore
run: |
pytest📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Test with pytest | |
| run: | | |
| pytest | |
| jobs: | |
| build: | |
| services: | |
| postgres: | |
| image: postgres:16 | |
| env: | |
| POSTGRES_PASSWORD: test | |
| POSTGRES_DB: hoststore | |
| ports: | |
| - 55432:5432 | |
| options: >- | |
| --health-cmd pg_isready | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| steps: | |
| - name: Test with pytest | |
| env: | |
| DATABASE_URL: postgresql://postgres:test@localhost:55432/hoststore | |
| run: | | |
| pytest |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/python-app.yml around lines 37 - 39, Update the pytest job
around the “Test with pytest” step to provision an isolated PostgreSQL service
on the port expected by tests/conft.py, wait until it is ready, and set
DATABASE_URL explicitly for the test command. Ensure pytest runs against this
configured database so store-backed tests are exercised rather than skipped.
1 participant
This workflow installs Python dependencies, runs linting with flake8, and executes tests with pytest.
Summary by CodeRabbit