ci: add comprehensive CI/CD pipelines

GitHub Actions workflows:
1. CI/CD Pipeline (ci-cd.yml)
   - Automated testing (Python 3.11, 3.12)
   - Code linting (black, isort, flake8)
   - Docker image build
   - Staging/Production deployment
   - Code coverage reporting

2. Security Scan (security.yml)
   - Dependency vulnerability check (safety)
   - Security linting (bandit)
   - Weekly scheduled scans
   - Dependency review for PRs

3. Release (release.yml)
   - Automated release creation
   - Docker image build and push
   - Semantic versioning tags

Features:
- ✅ Multi-Python version testing
- ✅ Pip package caching
- ✅ Code coverage with Codecov
- ✅ Security scanning
- ✅ Automated deployments
- ✅ Docker Hub integration

Phase 4 Tasks 61-62 completed (88.2% → 91.2%)!
This commit is contained in:
Xiaoxia AI
2026-06-17 09:15:25 +08:00
parent 16db463bf7
commit 5269e80d4c
3 changed files with 265 additions and 0 deletions
+59
View File
@@ -0,0 +1,59 @@
name: Security Scan
on:
push:
branches: [ main, develop ]
pull_request:
branches: [ main ]
schedule:
# Run every Monday at 00:00 UTC
- cron: '0 0 * * 1'
jobs:
security-scan:
name: Security Scan
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v4
with:
python-version: '3.12'
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install safety bandit
- name: Check for known security vulnerabilities
run: |
pip install -r requirements.txt
safety check --json
- name: Run Bandit security linter
run: |
bandit -r packages/ apps/ -f json -o bandit-report.json || true
cat bandit-report.json
- name: Upload security reports
uses: actions/upload-artifact@v3
if: always()
with:
name: security-reports
path: |
bandit-report.json
dependency-review:
name: Dependency Review
runs-on: ubuntu-latest
if: github.event_name == 'pull_request'
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Dependency Review
uses: actions/dependency-review-action@v3