Tests

Bump pypdf from 6.14.2 to 6.16.2 #9

	name: Tests

	on:
	push:
	branches: [ main, master, develop ]
	pull_request:
	branches: [ main, master, develop ]

	jobs:
	test:
	name: Lint and unit tests
	runs-on: ubuntu-latest

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: '3.11'

	- name: Install uv
	uses: astral-sh/setup-uv@v3

	- name: Install dependencies
	run: uv sync

	- name: Run ruff
	# Q-1: src/ is clean as of the 2026-09-03 fix wave, so this is a
	# blocking gate there. tests/ still carries pre-existing findings in
	# the two excluded key-management modules, so it stays advisory.
	run: uv run ruff check src

	- name: Run ruff over tests (advisory)
	continue-on-error: true
	run: uv run ruff check tests

	- name: Run mypy (advisory ratchet)
	# Q-7: 40 errors under the committed lenient config, down from 48.
	# Advisory so the count can only be driven down deliberately; the
	# step exists so a regression is visible in the run log.
	continue-on-error: true
	run: uv run mypy src/fpd_mcp

	- name: Run pytest
	run: uv run pytest -q

	- name: Audit dependencies for known advisories
	# L-25: the repo had no dependency advisory gate at all. Advisory
	# because an upstream CVE disclosure must not block an unrelated
	# merge; it does put the finding in the run log the same day.
	continue-on-error: true
	run: uv run --with pip-audit pip-audit

Navigation Menu