Skip to content

Add GitHub Actions workflow for Python application #89

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Mimi1782 wants to merge 1 commit into
base: main
Choose a base branch
from
+39 −0
Open

Add GitHub Actions workflow for Python application #89

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 39 additions & 0 deletions .github/workflows/python-app.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
# This workflow will install Python dependencies, run tests and lint with a single version of Python
# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python

name: Python application

on:
push:
branches: [ "main" ]
pull_request:
branches: [ "main" ]

permissions:
contents: read

jobs:
build:

runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v4

@coderabbitai coderabbitai Bot Jul 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow file =="
if [ -f .github/workflows/python-app.yml ]; then
  cat -n .github/workflows/python-app.yml
else
  echo "missing .github/workflows/python-app.yml"
fi

echo
echo "== all workflow files =="
fd -a .yml$ .github/workflows >/tmp/workflows.txt 2>/dev/null || true
cat /tmp/workflows.txt

Repository: genlayerlabs/unhardcoded

Length of output: 1770

🌐 Web query:

actions/checkout v4 persist-credentials default true README

💡 Result:

In actions/checkout v4, the persist-credentials input has a default value of true [1][2][3]. When set to true, the action configures the authentication token or SSH key into the local Git configuration, allowing your workflow scripts to run authenticated Git commands (such as git push or git pull) [1][4]. The action automatically removes these credentials during the post-job cleanup phase [1][5]. To prevent the action from adding these credentials to the Git config, you can explicitly set persist-credentials: false in your workflow step [1][4].

Citations:

Disable checkout credential persistence.

actions/checkout keeps the token available in local Git config by default, and this job then installs dependencies and runs pytest, so the runner-scoped GITHUB_TOKEN is unnecessarily exposed to the later steps.

Proposed fix 
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- uses: actions/checkout@v4
- uses: actions/checkout@v4
with:
persist-credentials: false
🧰 Tools
🪛 zizmor (1.28.0)

[warning] 21-21: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/python-app.yml at line 21, Update the actions/checkout@v4
step in the workflow to disable credential persistence by setting
persist-credentials to false, ensuring the checkout token is not retained for
subsequent dependency installation or pytest steps.

Source: Linters/SAST tools

- name: Set up Python 3.10
uses: actions/setup-python@v3
with:
python-version: "3.10"
Comment on lines +23 to +25

@coderabbitai coderabbitai Bot Jul 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | 💤 Low value

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
gh api repos/actions/setup-python/releases/latest --jq '.tag_name'

Repository: genlayerlabs/unhardcoded

Length of output: 169

🌐 Web query:

actions/setup-python GitHub releases v7 readme actions setup python v6 v7 runner requirements

💡 Result:

The actions/setup-python GitHub action released version 7.0.0 on July 20, 2026 [1][2]. Key information regarding this release includes: Migration to ESM: The action internals were migrated to ECMAScript Modules (ESM) to ensure compatibility with the latest @actions/* packages [3][4]. Compatibility and Requirements: Like version 6, version 7 requires the runner to be on version v2.327.1 or later [3][4]. This requirement is necessary to support the upgraded action environment [5][6]. No Functional Changes: There are no changes to action inputs, outputs, or general behavior in v7 compared to v6 [3][4]. Notable Changes: The pip-install input was removed in this release [1][7]. Additionally, the release included dependency upgrades and various bug fixes, such as classifying stderr warning messages as warnings rather than errors in annotations [1]. Users should continue to explicitly set the python-version or python-version-file inputs in their workflows to ensure consistent behavior across different runners [3][4]. Existing workflows using v6 can generally be updated to v7 without changes to the workflow configuration, provided the runner version requirement is met [6][3].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Workflow uses:"
rg -n "uses: actions/setup-python@" .github/workflows/python-app.yml || true

echo
echo "GitHub actionlint availability:"
command -v actionlint || true

echo
echo "workflow file context:"
cat -n .github/workflows/python-app.yml | sed -n '1,80p'

Repository: genlayerlabs/unhardcoded

Length of output: 1752

🌐 Web query:

GitHub docs ubuntu-latest runner default runner version 2.327.1

💡 Result:

The runner software version 2.327.1 is not the image version for the "ubuntu-latest" GitHub-hosted runner, but rather the version of the GitHub Actions runner application itself [1]. The GitHub Actions runner application (often referred to as the "runner version") is the agent that executes the workflow jobs [1]. As of July 2026, version 2.327.1 is a specific release of this application [1]. In contrast, the "ubuntu-latest" label refers to the underlying operating system image provided by GitHub [2]. As of July 29, 2026, the "ubuntu-latest" label points to the Ubuntu 24.04 LTS image [2]. These OS images are frequently updated with new software versions and maintain their own unique image versioning schemes, such as 20260726.254.1 for the Ubuntu 24.04 image [3]. Key Distinctions: - Runner Version (e.g., 2.327.1): Refers to the version of the software agent that runs your jobs [1]. - Image Version (e.g., 20260726.254.1): Refers to the specific build of the OS environment (including pre-installed tools and runtimes) currently in use [3]. - Workflow Label (e.g., ubuntu-latest): The alias used in your YAML configuration to request a specific type of environment [2].

Citations:

Upgrade actions/setup-python from v3.

actions/setup-python@v3 is obsolete on GitHub-hosted runners. The maintained current release is v7.0.0; for this workflow, use actions/setup-python@v6 unless your runner environment supports the v7 runner app requirement.

Proposed fix 
-      uses: actions/setup-python@v3
+      uses: actions/setup-python@v6
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
uses: actions/setup-python@v3
with:
python-version: "3.10"
uses: actions/setup-python@v6
with:
python-version: "3.10"
🧰 Tools
🪛 actionlint (1.7.12)

[error] 23-23: the runner of "actions/setup-python@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/python-app.yml around lines 23 - 25, Update the Python
setup step to use the maintained actions/setup-python release, preferring v6 for
this workflow unless its runner environment supports the v7 runner-app
requirement; keep the existing Python 3.10 configuration unchanged.

Source: Linters/SAST tools

- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install flake8 pytest
if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
- name: Lint with flake8
run: |
# stop the build if there are Python syntax errors or undefined names
flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
# exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide
flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
Comment on lines +35 to +36

@coderabbitai coderabbitai Bot Jul 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Make the full lint check fail on violations.

--exit-zero converts all complexity and line-length findings into warnings, so CI can pass despite lint failures. Remove it, or move this reporting-only check into a separate explicitly non-blocking step.

Proposed fix 
-        flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
+        flake8 . --count --max-complexity=10 --max-line-length=127 --statistics
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide
flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
# exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide
flake8 . --count --max-complexity=10 --max-line-length=127 --statistics
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/python-app.yml around lines 35 - 36, Update the flake8
command in the workflow so lint violations produce a non-zero exit status by
removing the --exit-zero option; keep the existing complexity, line-length,
count, and statistics settings unchanged.

- name: Test with pytest
run: |
pytest
Comment on lines +37 to +39

@coderabbitai coderabbitai Bot Jul 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Provision PostgreSQL before running pytest.

tests/conftest.py:1-71 points store-backed tests at localhost:55432 and skips them when PostgreSQL is unavailable. Because this job defines no database service, CI can pass without exercising those tests. Add an isolated PostgreSQL service and set DATABASE_URL explicitly.

Example configuration 
 jobs:
   build:
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_PASSWORD: test
+          POSTGRES_DB: hoststore
+        ports:
+          - 55432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
     steps:
       ...
     - name: Test with pytest
+      env:
+        DATABASE_URL: postgresql://postgres:test@localhost:55432/hoststore
       run: |
         pytest
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Test with pytest
run: |
pytest
jobs:
build:
services:
postgres:
image: postgres:16
env:
POSTGRES_PASSWORD: test
POSTGRES_DB: hoststore
ports:
- 55432:5432
options: >-
--health-cmd pg_isready
--health-interval 10s
--health-timeout 5s
--health-retries 5
steps:
- name: Test with pytest
env:
DATABASE_URL: postgresql://postgres:test@localhost:55432/hoststore
run: |
pytest
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/python-app.yml around lines 37 - 39, Update the pytest job
around the “Test with pytest” step to provision an isolated PostgreSQL service
on the port expected by tests/conft.py, wait until it is ready, and set
DATABASE_URL explicitly for the test command. Ensure pytest runs against this
configured database so store-backed tests are exercised rather than skipped.