Chris TonjesandClaude Opus 5.5
5f2d885fdc
Workflow moved to .gitea/workflows/ci.yml (Gitea is the CI host). Every gate now passes locally, step-for-step; green on main is pending an act_runner on gitea.doesworks.net (runs #1-#5 are queued "Waiting"). Gate fixes found by actually running them: - pip-audit: `--disable-pip` without `-r` was a usage error, so the old step could never pass. Now `pip-audit --strict .` audits the runtime dependency set from pyproject. - pip-audit then flagged ecdsa (PYSEC-2026-1325, no fix), a hard dep of python-jose. Swapped to PyJWT (HS256 only; 3-line change in auth/security.py). Flag to OWC. - PyJWT warned the test JWT secret was 11 bytes. JWT_SECRET now requires >= 32 bytes (RFC 7518 s3.2) at settings load; dev/compose/test defaults updated. Test-only value carries an inline gitleaks:allow. - bandit B101: assert in retention._count_past replaced with a raise. - gitleaks: gitleaks-action needs a GitHub token/license; replaced with the pinned 8.30.1 binary, sha256-verified, scanning full history. Added: - SBOM: CycloneDX 1.6 from a clean runtime-only venv (39 components), uploaded as a CI artifact. YPMS-POAM-042. - cyclonedx-bom in dev extras; CI outputs gitignored. 158 tests passing, 95.83% coverage; ruff, mypy, bandit, pip-audit, gitleaks clean. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
52 lines
1.1 KiB
YAML
52 lines
1.1 KiB
YAML
services:
|
|
db:
|
|
image: postgres:16
|
|
environment:
|
|
POSTGRES_USER: ypms
|
|
POSTGRES_PASSWORD: ypms
|
|
POSTGRES_DB: ypms
|
|
TZ: UTC
|
|
PGTZ: UTC
|
|
volumes:
|
|
- pg_data:/var/lib/postgresql/data
|
|
ports:
|
|
- "5433:5432"
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ypms"]
|
|
interval: 3s
|
|
timeout: 3s
|
|
retries: 20
|
|
|
|
app:
|
|
build: .
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
environment:
|
|
DATABASE_URL: postgresql+psycopg://ypms:ypms@db:5432/ypms
|
|
JWT_SECRET: dev-jwt-secret-change-me-32-bytes-min
|
|
JWT_ALG: HS256
|
|
ACCESS_TOKEN_TTL_MINUTES: 60
|
|
COLUMN_ENCRYPTION_KEY: dev-col-enc-key-change-me-32bytes-______
|
|
LOG_LEVEL: INFO
|
|
ENV: dev
|
|
ports:
|
|
- "8000:8000"
|
|
command: >
|
|
sh -c "alembic upgrade head &&
|
|
python -m ypms.seed.run &&
|
|
uvicorn ypms.main:app --host 0.0.0.0 --port 8000 --reload"
|
|
volumes:
|
|
- ./src:/app/src
|
|
- ./migrations:/app/migrations
|
|
|
|
adminer:
|
|
image: adminer:4
|
|
depends_on:
|
|
- db
|
|
ports:
|
|
- "8081:8080"
|
|
|
|
volumes:
|
|
pg_data:
|