You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
echo "::warning title=Capella paths not verified::CB_CAPELLA_API_KEY is not configured, so no v4 path was checked. This job is green because it did not run, not because it passed."
154
+
{
155
+
echo "### Capella path verification SKIPPED"
156
+
echo ""
157
+
echo "\`CB_CAPELLA_API_KEY\` is not configured, so **no path was verified**."
158
+
echo "Set it to a read-only Capella API key SECRET to enable this job."
159
+
} >> "$GITHUB_STEP_SUMMARY"
160
+
exit 0
161
+
fi
162
+
uv run python scripts/verify_capella_paths.py
163
+
What I changed and why
164
+
165
+
1. React install in the test job. This one would have broken your first CI run, not just left a gap. I made test_gui_frontend.py fail instead of skip when CI is set — and GitHub Actions sets CI=true. Without this step, that test now fails in CI. The step is what makes the change safe.
166
+
167
+
2. import pytest_randomly assertion. The plugin is now in [dev], so uv sync installs it and your existing "randomised order" step becomes real. The one-line import check means a future dependency change fails loudly rather than silently reverting the step to file order — which is how it came to be a no-op in the first place.
168
+
169
+
3. Coverage gate step. fail_under = 89 is in pyproject.toml; measured 90.5%.
170
+
171
+
4. capella-paths — visible skip, still exit 0. I kept your reasoning: your comment is right that a job failing for everyone without credentials gets disabled. So the skip stays, but it now emits a ::warning and a job-summary line, so a green tick can't be mistaken for a verified one. Note your if: already excludes pull_request, so the fork case is handled by that condition — if you'd rather a missing secret fail on push to main, change exit 0 to exit 1; that's a one-word edit and I've deliberately left the decision with you.
110
172
173
+
Two things I did not change: the mutation job needs no React (I checked — no mutation round runs test_gui_frontend.py), and I left the job order and permissions: contents: read alone.
174
+
175
+
Separately, while checking that: mutation_round_4.py and mutation_round_5.py had the same timeout-as-caught bug I'd only fixed in rounds_1_3 — a pytest timeout returned "caught" with no assertion having failed, in the one tool whose job is to say which controls are untested. Both now raise. Fixed, lint clean, 3061 tests still passing, and both files are on your disk.
176
+
177
+
Mutation round 4
178
+
PY
179
+
Mutation round 5
180
+
PY
181
+
182
+
name: CI
183
+
# Nothing ran automatically before this. 641 tests and 45 mutation entries existed and
184
+
# were only ever verified by hand, which makes them a snapshot rather than a guarantee.
185
+
on:
186
+
push:
187
+
branches: [main]
188
+
pull_request:
189
+
workflow_dispatch:
190
+
concurrency:
191
+
group: ${{ github.workflow }}-${{ github.ref }}
192
+
cancel-in-progress: true
193
+
permissions:
194
+
contents: read
195
+
jobs:
196
+
lint:
197
+
runs-on: ubuntu-latest
198
+
steps:
199
+
- uses: actions/checkout@v4
200
+
- uses: astral-sh/setup-uv@v5
201
+
with:
202
+
enable-cache: true
203
+
- run: uv sync --extra dev
204
+
- name: ruff check
205
+
run: uv run ruff check .
206
+
- name: ruff format
207
+
run: uv run ruff format --check .
208
+
test:
209
+
runs-on: ubuntu-latest
210
+
strategy:
211
+
fail-fast: false
212
+
matrix:
213
+
# The floor and the current release. requires-python is >=3.10,<3.15, and the
214
+
# floor matters: this code uses X | None annotations behind
215
+
# from __future__ import annotations, which is easy to break on 3.10 only.
216
+
# 3.14 is included because requires-python claims <3.15 and it was never built.
217
+
python-version: ["3.10", "3.13", "3.14"]
218
+
steps:
219
+
- uses: actions/checkout@v4
220
+
- uses: astral-sh/setup-uv@v5
221
+
with:
222
+
enable-cache: true
223
+
- uses: actions/setup-python@v5
224
+
with:
225
+
python-version: ${{ matrix.python-version }}
226
+
- run: uv sync --extra dev
227
+
# Node is only needed by the console's compile-and-render tests. They skip cleanly
228
+
# without it, and a skipped frontend test is how the console came to render a blank
229
+
# page unnoticed — so CI installs it.
230
+
- uses: actions/setup-node@v4
231
+
with:
232
+
node-version: "20"
233
+
- name: Tests, in randomised order
234
+
run: uv run pytest -q
235
+
- name: Tests, in file order
236
+
# Both orders, because several modules read environment variables at import time
237
+
# and order-dependent tests have hidden real bugs here before.
238
+
run: uv run pytest -q -p no:randomly
239
+
mutation:
240
+
# The tests that prove the tests. A control whose mutation SURVIVES has no test
241
+
# behind it, however green the suite looks.
242
+
runs-on: ubuntu-latest
243
+
steps:
244
+
- uses: actions/checkout@v4
245
+
- uses: astral-sh/setup-uv@v5
246
+
with:
247
+
enable-cache: true
248
+
- run: uv sync --extra dev
249
+
- uses: actions/setup-node@v4
250
+
with:
251
+
node-version: "20"
252
+
- name: Mutations, rounds 1-3
253
+
run: uv run python scripts/mutation_rounds_1_3.py
254
+
- name: Mutations, round 4
255
+
run: uv run python scripts/mutation_round_4.py
256
+
- name: Mutations, round 5
257
+
# The session-cookie and mcp-version-compat guards, plus the cross-handler
258
+
# contract harness. Round 5 also mutates a TEST fixture: if the fixture goes
259
+
# back to short-circuiting the SQL++ handlers, the routing checks for three
260
+
# modules silently stop proving anything, and that is only detectable this way.
261
+
run: uv run python scripts/mutation_round_5.py
262
+
package:
263
+
# The image and the wheel both listed their top-level modules by hand and both once
264
+
# omitted three, so import server failed at startup with none of the security
265
+
# controls present. A green test suite said nothing, because it runs from the source
266
+
# tree where every file exists.
267
+
runs-on: ubuntu-latest
268
+
steps:
269
+
- uses: actions/checkout@v4
270
+
- uses: astral-sh/setup-uv@v5
271
+
with:
272
+
enable-cache: true
273
+
- run: uv sync --extra dev
274
+
- name: Build the wheel and import from the INSTALLED copy
0 commit comments