name: CI/CD Pipeline
on:
push:
branches: [ main, develop ]
pull_request:
branches: [ main, develop ]
workflow_dispatch:
# Cancel previous runs if a new one is triggered
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
env:
PYTHON_VERSION: "3.12.7" # Pin exact version for reproducibility
MINIMUM_PYTHON_VERSION: "3.10"
RUFF_VERSION: "0.12.4" # Pin exact Ruff version to match local
MYPY_VERSION: "1.17.0" # Pin exact MyPy version
BANDIT_VERSION: "1.8.6" # Pin exact Bandit version
jobs:
# Code Quality Checks
code-quality:
name: Code Quality
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: ${{ env.PYTHON_VERSION }}
cache: 'pip'
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -e ".[dev]"
- name: Report versions for transparency
run: |
echo "::group::Environment Information"
echo "Python version: $(python --version)"
echo "Ruff version: $(ruff --version)"
echo "Mypy version: $(mypy --version)"
echo "::endgroup::"
- name: Run Ruff linter
run: |
echo "::group::Ruff Linting"
ruff check . --output-format=github
echo "::endgroup::"
- name: Run Ruff formatter check
run: |
echo "::group::Ruff Formatting"
ruff format --check .
echo "::endgroup::"
- name: Run Mypy type checking
run: |
echo "::group::Type Checking"
mypy src/ --install-types --non-interactive --no-strict-optional
echo "::endgroup::"
- name: Run Bandit security check
run: |
echo "::group::Security Scanning"
bandit -r src/ -f json -o bandit-report.json
bandit -r src/
echo "::endgroup::"
- name: Upload Bandit results
uses: actions/upload-artifact@v4
if: always()
with:
name: bandit-results
path: bandit-report.json
# Test Matrix - macOS only since MoneyWiz is Mac-specific
test:
name: Test (Python ${{ matrix.python-version }})
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os: [macos-latest] # MoneyWiz MCP server is macOS-only
python-version: ["3.10", "3.11", "3.12"]
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v5
with:
python-version: ${{ matrix.python-version }}
cache: 'pip'
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -e ".[test]"
- name: Run tests with coverage
run: |
pytest --cov=moneywiz_mcp_server --cov-report=xml --cov-report=term-missing -m "not integration"
- name: Upload coverage to Codecov
uses: codecov/codecov-action@v4
if: matrix.python-version == env.PYTHON_VERSION && matrix.os == 'macos-latest'
with:
file: ./coverage.xml
fail_ci_if_error: true
# Pre-commit checks
pre-commit:
name: Pre-commit Hooks
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Install pre-commit
run: pip install pre-commit
- name: Run pre-commit hooks
run: pre-commit run --all-files
# Package build test
build:
name: Build Package
runs-on: ubuntu-latest
needs: [code-quality, test]
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Install build dependencies
run: |
python -m pip install --upgrade pip
pip install build twine
- name: Build package
run: python -m build
- name: Check package
run: twine check dist/*
- name: Upload build artifacts
uses: actions/upload-artifact@v4
with:
name: dist
path: dist/
# Integration test with actual MCP server
integration:
name: Integration Test
runs-on: macos-latest # MoneyWiz MCP server is macOS-only
needs: [code-quality]
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -e ".[dev]"
- name: Run integration tests
run: |
pytest tests/integration/ -v --tb=short
# Documentation build (if docs exist)
docs:
name: Documentation
runs-on: ubuntu-latest
if: github.event_name == 'push'
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Check for documentation
id: check-docs
run: |
if [ -f "docs/requirements.txt" ] || [ -f "mkdocs.yml" ]; then
echo "docs-exist=true" >> $GITHUB_OUTPUT
else
echo "docs-exist=false" >> $GITHUB_OUTPUT
fi
- name: Build documentation
if: steps.check-docs.outputs.docs-exist == 'true'
run: |
pip install -r docs/requirements.txt || pip install mkdocs mkdocs-material
mkdocs build --strict
# Final status check
ci-success:
name: CI Success
runs-on: ubuntu-latest
needs: [code-quality, test, pre-commit, build, integration]
if: always()
steps:
- name: Check all jobs status
run: |
if [[ "${{ needs.code-quality.result }}" == "success" && \
"${{ needs.test.result }}" == "success" && \
"${{ needs.pre-commit.result }}" == "success" && \
"${{ needs.build.result }}" == "success" && \
"${{ needs.integration.result }}" == "success" ]]; then
echo "✅ All CI checks passed!"
else
echo "❌ Some CI checks failed"
exit 1
fi
