REE MCP Server

name: CI/CD on: push: branches: [ main, develop ] pull_request: branches: [ main, develop ] jobs: test: name: Test Suite runs-on: ubuntu-latest strategy: matrix: python-version: ["3.11", "3.12"] steps: - name: Checkout code uses: actions/checkout@v4 - name: Set up Python ${{ matrix.python-version }} uses: actions/setup-python@v5 with: python-version: ${{ matrix.python-version }} - name: Install uv uses: astral-sh/setup-uv@v3 - name: Install dependencies run: | uv venv source .venv/bin/activate uv pip install -e ".[dev]" - name: Run unit tests (fast) run: | source .venv/bin/activate pytest tests/unit/ -v --tb=short - name: Run type checking run: | source .venv/bin/activate mypy src/ree_mcp/ - name: Run linting run: | source .venv/bin/activate ruff check . security: name: Security Checks runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkout@v4 - name: Set up Python uses: actions/setup-python@v5 with: python-version: "3.11" - name: Install uv uses: astral-sh/setup-uv@v3 - name: Install dependencies run: | uv venv source .venv/bin/activate uv pip install -e ".[dev]" uv pip install bandit safety - name: Run Bandit security scan run: | source .venv/bin/activate bandit -r src/ree_mcp/ -f json -o bandit-report.json || true bandit -r src/ree_mcp/ -ll - name: Check for secrets run: | # Check for hardcoded secrets (not variable names or type hints) # This allows legitimate use of variables like 'api_key' but catches actual secrets ! grep -rE '(api[_-]?key|password|token|secret)["\s]*[=:]["\s]*[a-zA-Z0-9]{20,}' --include="*.py" src/ree_mcp/ quality: name: Code Quality runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkout@v4 - name: Set up Python uses: actions/setup-python@v5 with: python-version: "3.11" - name: Install uv uses: astral-sh/setup-uv@v3 - name: Install dependencies run: | uv venv source .venv/bin/activate uv pip install -e ".[dev]" - name: Check code formatting run: | source .venv/bin/activate ruff format . || echo "⚠️ Code formatting issues found (non-blocking)" - name: Generate coverage report run: | source .venv/bin/activate pytest tests/unit/ --cov=src/ree_mcp --cov-report=term --cov-report=xml - name: Upload coverage to Codecov uses: codecov/codecov-action@v4 with: file: ./coverage.xml fail_ci_if_error: false continue-on-error: true