mirror of
https://github.com/wiltodelta/remove-ai-watermarks.git
synced 2026-10-14 13:30:55 +02:00
Victor KuznetsovandClaude Opus 5.5
72752feb33
Add a CI job running the maintain.sh uv-secure scan, pinned to the gate by a parity test, and a SECURITY.md with private reporting and dependency remediation. Refresh the security-gate block record for accelerate 1.15.0. Closes #114 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
128 lines
4.0 KiB
YAML
128 lines
4.0 KiB
YAML
name: Tests
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: tests-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
lint:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: astral-sh/setup-uv@v7
|
|
- name: Sync dev environment
|
|
run: uv sync --frozen --extra dev
|
|
- name: Check C2PA soft-binding registry snapshot
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: uv run python scripts/sync_c2pa_soft_bindings.py --check
|
|
- name: Ruff lint
|
|
run: uv run ruff check
|
|
- name: Ruff format check
|
|
run: uv run ruff format --check
|
|
|
|
security:
|
|
name: lockfile vulnerability scan
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: astral-sh/setup-uv@v7
|
|
with:
|
|
enable-cache: false
|
|
# Policy and triaged blocks: docs/development.md "Known security-gate blocks".
|
|
- name: Scan uv.lock with uv-secure
|
|
run: uvx uv-secure uv.lock
|
|
|
|
test:
|
|
name: test ${{ matrix.os }} py${{ matrix.python-version }}
|
|
runs-on: ${{ matrix.os }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
# Exercise every supported minor. The floor and latest minor run on all
|
|
# operating systems; intermediate minors run on Linux to bound the
|
|
# matrix without leaving a declared Python version untested.
|
|
include:
|
|
- os: ubuntu-latest
|
|
python-version: "3.11"
|
|
- os: macos-latest
|
|
python-version: "3.11"
|
|
- os: windows-latest
|
|
python-version: "3.11"
|
|
- os: ubuntu-latest
|
|
python-version: "3.12"
|
|
- os: ubuntu-latest
|
|
python-version: "3.13"
|
|
- os: ubuntu-latest
|
|
python-version: "3.14"
|
|
- os: macos-latest
|
|
python-version: "3.14"
|
|
- os: windows-latest
|
|
python-version: "3.14"
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: astral-sh/setup-uv@v7
|
|
with:
|
|
python-version: ${{ matrix.python-version }}
|
|
- name: Sync dev environment
|
|
run: uv sync --frozen --extra dev
|
|
- name: Run tests
|
|
run: uv run pytest -q
|
|
|
|
transport-contract-python-314:
|
|
name: versioned transport contracts py3.14
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: astral-sh/setup-uv@v7
|
|
with:
|
|
python-version: "3.14"
|
|
- name: Create clean runtime contract environment
|
|
run: uv venv --python 3.14 .venv-contract
|
|
- name: Install runtime contract dependencies
|
|
run: >-
|
|
uv pip install --python .venv-contract/bin/python
|
|
".[pixels,heif]" "numpy>=2,<3" "pytest>=8"
|
|
- name: Run versioned transport contract tests
|
|
run: >-
|
|
.venv-contract/bin/python -m pytest -q
|
|
tests/test_forensic_metadata.py
|
|
tests/test_metadata_record.py
|
|
tests/test_pixel_evidence.py
|
|
|
|
video-e2e:
|
|
name: video full-clip end-to-end
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: astral-sh/setup-uv@v7
|
|
with:
|
|
python-version: "3.12"
|
|
- name: Install ffmpeg
|
|
# Third-party apt sources baked into the runner image (google-chrome et
|
|
# al.) can publish a broken index and fail `apt-get update`, while this
|
|
# job only needs ffmpeg from Ubuntu's own repositories: drop every
|
|
# non-Ubuntu source definition before updating.
|
|
run: |
|
|
sudo find /etc/apt/sources.list.d -mindepth 1 -maxdepth 1 \
|
|
! -name 'ubuntu.sources' -delete
|
|
sudo apt-get update
|
|
sudo apt-get install --yes ffmpeg
|
|
- name: Sync dev environment
|
|
run: uv sync --frozen --extra dev
|
|
- name: Run full-clip video test
|
|
run: >-
|
|
uv run pytest -vv -o faulthandler_timeout=60
|
|
tests/test_video.py::TestVideoVisibleFullClip
|
|
tests/test_video_fidelity_probe.py
|