pybiorythm

GitHub Actions Workflows Documentation

This repository uses comprehensive GitHub Actions workflows for CI/CD, security, and automation.

Workflows Overview

1. CI/CD Pipeline (ci.yml)

Triggers: Push to main/develop, PRs to main, releases Purpose: Comprehensive testing and quality assurance

Jobs:

2. Docker Publish (docker-publish.yml)

Triggers: Push to main, tags, PRs Purpose: Container image building and publishing

Features:

3. Release Management (release.yml)

Triggers: Version tags (v*) Purpose: Automated release process

Jobs:

4. Security Analysis (codeql.yml)

Triggers: Push, PRs, weekly schedule Purpose: Static code analysis and security scanning

Features:

5. Dependency Review (dependency-review.yml)

Triggers: Pull requests to main Purpose: Analyze dependency changes for security risks

Capabilities:

6. SBOM Generation (sbom.yml)

Triggers: Push to main, scheduled weekly, manual dispatch Purpose: Generate Software Bill of Materials for BSI TR-03183-2-2 compliance

BSI TR-03183-2-2 Compliance Features:

Generated Artifacts:

7. Semantic Release (semantic-release.yml)

Triggers: Push to main, manual dispatch Purpose: Automated version management and release

Features:

8. Documentation Build (docs.yml)

Triggers: Push to main, PRs to main Purpose: Automated documentation building and deployment

Features:

Automation Features

Dependabot Configuration

File: .github/dependabot.yml Purpose: Automated dependency updates

Update Schedules:

Features:

Issue Templates

Location: .github/ISSUE_TEMPLATE/

Templates:

Pull Request Template

File: .github/pull_request_template.md Purpose: Standardized PR structure and checklists

Sections:

Security Integration

Multi-Layered Security Approach

Static Code Analysis:

Dependency Security:

Container Security:

Supply Chain Security:

Security Enforcement

Quality Gates:

Compliance Reporting:

Quality Gates

Code Quality Requirements

Performance Requirements

Documentation Requirements

Secrets Configuration

Required repository secrets for full functionality:

# PyPI Publishing
PYPI_API_TOKEN           # Production PyPI token
TEST_PYPI_API_TOKEN      # TestPyPI token

# Docker Hub (optional)
DOCKERHUB_USERNAME       # Docker Hub username
DOCKERHUB_TOKEN         # Docker Hub token

# Codecov (optional)
CODECOV_TOKEN           # Coverage reporting token

Branch Protection

Recommended branch protection rules for main:

Workflow Integration & Dependencies

Workflow Orchestration

graph TB
    A[Code Push/PR] --> B[CI Pipeline]
    B --> C{All Checks Pass?}
    C -->|Yes| D[Security Scans]
    C -->|No| E[Build Failure]
    
    D --> F{Security Clean?}
    F -->|Yes| G[SBOM Generation]
    F -->|No| H[Security Block]
    
    G --> I[Container Build]
    I --> J[Documentation Update]
    J --> K[Release Ready]
    
    K --> L{Is Release?}
    L -->|Yes| M[Semantic Release]
    L -->|No| N[Merge Complete]
    
    M --> O[PyPI Publish]
    M --> P[Docker Publish]
    M --> Q[GitHub Release]

Workflow Triggers & Dependencies

Workflow Triggers Dependencies Outputs
CI (ci.yml) Push, PR None Test results, coverage
Security (codeql.yml) Push, PR, schedule None Security findings
Dependency Review PR None Vulnerability analysis
SBOM (sbom.yml) Push to main, schedule CI success BSI-compliant artifacts
Docker Publish Push, tags, PR CI + Security pass Container images
Documentation Push, PR None GitHub Pages site
Semantic Release Push to main All workflows pass Version tags, releases
Release (release.yml) Version tags Semantic Release PyPI packages, assets

Testing & Coverage Integration

Comprehensive Test Pipeline

Test Execution Matrix:

Coverage Requirements:

Test Categories & Metrics:

Test Type Count Coverage Focus Performance Target
Unit Tests 31 tests Core calculations < 1ms per test
CLI Tests 18 tests Command interface < 5ms per test
JSON Tests 14 tests Data serialization < 10ms per test
Coverage Tests 9 tests Edge case completion < 2ms per test
Total 72 tests 90%+ coverage < 30s total

Coverage Dashboard Integration

Codecov Integration:

Coverage Reporting Features:

Workflow Monitoring

Success Indicators

Failure Response & Troubleshooting

Local Development

Pre-commit Validation

Run locally before pushing:

# Run all quality checks
pytest --cov=. --cov-fail-under=90
ruff check .
ruff format --check .

# Test Docker build
docker build --target production -t pybiorythm:test .
docker run --rm pybiorythm:test python -c "import biorythm; print('OK')"

# Security scan
safety check
bandit -r . -f json

Workflow Testing

Test workflows locally using act:

# Install act
curl https://raw.githubusercontent.com/nektos/act/master/install.sh | sudo bash

# Run CI workflow
act push

# Run specific job
act -j test

Maintenance

Regular Tasks

Workflow Updates

This comprehensive workflow setup ensures high code quality, security, and automation while maintaining the project’s educational and entertainment purpose.

Next Steps

Related: Security Workflows Blue-Green Deployment Local Testing
This site is open source. Improve this page.