Continuous integration
August 12, 2026 · View on GitHub
This document describes what runs in GitHub Actions and how it relates to local pytest (pytest.ini).
Linux PR gates shard the full unit corpus (backend/tests/unit) across
six jobs and run integration, e2e, and stress in
gates-on-linux-extended. Their coverage artifacts are combined and enforce
74% in gates-on-linux-coverage-report. Windows and macOS run the
full unit corpus, then the same extended tier after unit gates pass.
For release tagging and GA promotion, see RELEASE_CHECKLIST.md.
Required checks on pull requests
| Workflow | Job | What runs |
|---|---|---|
| Run Python Tests | gates-on-linux-coverage-{a,b,c,d,g,e} + report | Full unit corpus on Linux with sharded coverage; the report also combines the extended-suite artifact and enforces 74% (--fail-under=74). Execution shards (D/G) skip compileall; syntax is gated on other shards. |
| Run Python Tests | gates-on-linux-extended | Integration, e2e, and stress suites on Linux; its coverage artifact is required by the final coverage-report job. |
| Run Python Tests | gates-on-windows (3.12 + 3.13) | Full unit corpus cross-platform smoke. |
| Run Python Tests | gates-on-windows-extended | Integration, e2e, and stress suites on Windows (runs after unit gates pass; Python 3.12). |
| Run Python Tests | gates-on-macos | Full unit corpus on macOS. |
| Run Python Tests | gates-on-macos-extended | Integration, e2e, and stress suites on macOS (runs after unit gate passes). |
| Run Python Tests | gates-on-linux-py313 | Full unit corpus on Python 3.13 (runs after Linux extended). |
| Lint | lint-python, version/workflow consistency, mypy, repository hygiene | See .github/workflows/lint.yml. |
| CodeQL | analyze | Static security analysis for Python on PRs and main. |
| Security Scan (Bandit) | Bandit | Python SAST; fails on medium/high findings. See .github/workflows/bandit.yml. |
| Dependency Review | dependency-review | Blocks high-severity dependency risk on pull requests. |
| Dependency Audit (pip-audit) | pip-audit | Audits locked runtime dependencies for known CVEs. |
| CLI Regression Tests | (when paths match) | CLI integration smoke and selected orchestration tests; see .github/workflows/e2e-tests.yml. |
| Smoke Install | smoke-install | Clean venv wheel install + source onboarding smoke (scripts/smoke/smoke_install.*, scripts/smoke/smoke_source_onboarding.*) on Linux and Windows; see .github/workflows/smoke-install.yml. |
Advisory (not release-blocking today)
| Job | Notes |
|---|---|
| Heavy / Integration Tests | Marker-filtered heavy | integration | benchmark slice; runs on main, schedule, and manual dispatch only. |
Coverage
The 74% gate combines the six Linux unit-shard artifacts with the Linux
integration/e2e/stress artifact in gates-on-linux-coverage-report. Windows
and macOS extended suites do not contribute to this percentage.
Codecov upload runs from the coverage report job with fail_ci_if_error: false
(upload failure does not block the merge). The enforced threshold is
coverage report --fail-under=74, matching pyproject.toml.
Heavy / integration / benchmark tier
The Heavy / Integration Tests job in py-tests.yml runs only when:
- the workflow is scheduled,
- manually dispatched, or
- the push is to
main.
It executes: pytest backend/tests -m "heavy or integration or benchmark".
Markers are defined in pytest.ini. That job is marker-filtered over the full tree. A bare local pytest (no path arguments) still collects all of backend/tests per testpaths; narrow with pytest backend/tests/unit or add -m when you want a smaller slice.
Local equivalents
| CI job | Local command |
|---|---|
| Linux unit + coverage approximation | PYTHONPATH=. uv run pytest --cov=backend --cov-fail-under=74 backend/tests/unit |
| Windows unit smoke | PYTHONPATH=. uv run pytest backend/tests/unit |
| Integration / e2e / stress | PYTHONPATH=. uv run pytest backend/tests/integration backend/tests/e2e backend/tests/stress |
| Lint | pre-commit run --all-files and uv run mypy --config-file mypy.ini |
What to run before opening a PR
Support stance for announcement copy
For public release messaging, align claims with Support Matrix:
- Linux, Windows, and macOS are officially supported with unit gates plus extended integration/e2e/stress coverage on all three platforms.