Skip to content

Commit 5fa747f

Browse files
ColeMurrayColeMurray
committed
Initial public commit
0 parents  commit 5fa747f

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

44 files changed

+9519
-0
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 179 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,179 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [ main, develop ]
6+
pull_request:
7+
branches: [ main, develop ]
8+
9+
jobs:
10+
lint:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- uses: actions/checkout@v4
14+
15+
- name: Set up Python
16+
uses: actions/setup-python@v5
17+
with:
18+
python-version: "3.11"
19+
20+
- name: Cache pip dependencies
21+
uses: actions/cache@v4
22+
with:
23+
path: ~/.cache/pip
24+
key: ${{ runner.os }}-lint-${{ hashFiles('**/pyproject.toml') }}
25+
restore-keys: |
26+
${{ runner.os }}-lint-
27+
28+
- name: Install linting dependencies
29+
run: |
30+
python -m pip install --upgrade pip
31+
pip install black==23.12.1 isort==5.13.2 mypy==1.8.0
32+
pip install types-requests types-aiofiles
33+
pip install -e .
34+
35+
- name: Lint with black
36+
run: |
37+
black --check --diff src/ tests/
38+
39+
- name: Sort imports with isort
40+
run: |
41+
isort --check-only --diff src/ tests/
42+
43+
- name: Type check with mypy
44+
run: |
45+
mypy src/moondream_mcp --ignore-missing-imports --no-site-packages --disable-error-code=import-untyped
46+
47+
test:
48+
runs-on: ubuntu-latest
49+
strategy:
50+
matrix:
51+
python-version: ["3.10", "3.11", "3.12"]
52+
53+
steps:
54+
- uses: actions/checkout@v4
55+
56+
- name: Set up Python ${{ matrix.python-version }}
57+
uses: actions/setup-python@v5
58+
with:
59+
python-version: ${{ matrix.python-version }}
60+
61+
- name: Cache pip dependencies
62+
uses: actions/cache@v4
63+
with:
64+
path: ~/.cache/pip
65+
key: ${{ runner.os }}-pip-${{ hashFiles('**/pyproject.toml') }}
66+
restore-keys: |
67+
${{ runner.os }}-pip-
68+
69+
- name: Install dependencies
70+
run: |
71+
python -m pip install --upgrade pip
72+
pip install -e ".[dev]"
73+
74+
- name: Run tests with pytest
75+
run: |
76+
pytest tests/ -v --cov=src/moondream_mcp --cov-report=xml --cov-report=term-missing
77+
78+
- name: Upload coverage to Codecov
79+
uses: codecov/codecov-action@v5
80+
with:
81+
file: ./coverage.xml
82+
flags: unittests
83+
name: codecov-umbrella
84+
fail_ci_if_error: false
85+
86+
security:
87+
runs-on: ubuntu-latest
88+
steps:
89+
- uses: actions/checkout@v4
90+
91+
- name: Set up Python
92+
uses: actions/setup-python@v5
93+
with:
94+
python-version: "3.11"
95+
96+
- name: Install dependencies
97+
run: |
98+
python -m pip install --upgrade pip
99+
pip install bandit[toml] safety
100+
101+
- name: Run security checks with bandit
102+
run: |
103+
bandit -r src/ -f json -o bandit-report.json || true
104+
bandit -r src/ --severity-level medium
105+
106+
- name: Check dependencies for known vulnerabilities
107+
run: |
108+
safety check --json --output safety-report.json || true
109+
safety check
110+
111+
- name: Upload security reports
112+
uses: actions/upload-artifact@v4
113+
if: always()
114+
with:
115+
name: security-reports
116+
path: |
117+
bandit-report.json
118+
safety-report.json
119+
120+
build:
121+
runs-on: ubuntu-latest
122+
needs: [lint, test, security]
123+
steps:
124+
- uses: actions/checkout@v4
125+
126+
- name: Set up Python
127+
uses: actions/setup-python@v5
128+
with:
129+
python-version: "3.11"
130+
131+
- name: Install build dependencies
132+
run: |
133+
python -m pip install --upgrade pip
134+
pip install build twine
135+
136+
- name: Build package
137+
run: |
138+
python -m build
139+
140+
- name: Check package
141+
run: |
142+
twine check dist/*
143+
144+
- name: Upload build artifacts
145+
uses: actions/upload-artifact@v4
146+
with:
147+
name: dist
148+
path: dist/
149+
150+
integration-test:
151+
runs-on: ubuntu-latest
152+
needs: build
153+
if: github.event_name == 'pull_request'
154+
steps:
155+
- uses: actions/checkout@v4
156+
157+
- name: Set up Python
158+
uses: actions/setup-python@v5
159+
with:
160+
python-version: "3.11"
161+
162+
- name: Download build artifacts
163+
uses: actions/download-artifact@v4
164+
with:
165+
name: dist
166+
path: dist/
167+
168+
- name: Install from wheel
169+
run: |
170+
pip install dist/*.whl
171+
172+
- name: Test installation
173+
run: |
174+
python -c "import moondream_mcp; print('✅ Package installed successfully')"
175+
python -c "from moondream_mcp import Config, MoondreamClient; print('✅ Core imports work')"
176+
177+
- name: Test CLI entry point
178+
run: |
179+
moondream-mcp --help || echo "CLI help command completed"

‎.github/workflows/codeql.yml‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
name: "CodeQL Security Analysis"
2+
3+
on:
4+
push:
5+
branches: [ "main", "develop" ]
6+
pull_request:
7+
branches: [ "main" ]
8+
schedule:
9+
# Run CodeQL analysis weekly on Sundays at 2 AM UTC
10+
- cron: '0 2 * * 0'
11+
12+
jobs:
13+
analyze:
14+
name: Analyze
15+
runs-on: ubuntu-latest
16+
timeout-minutes: 360
17+
permissions:
18+
actions: read
19+
contents: read
20+
security-events: write
21+
22+
strategy:
23+
fail-fast: false
24+
matrix:
25+
language: [ 'python' ]
26+
27+
steps:
28+
- name: Checkout repository
29+
uses: actions/checkout@v4
30+
31+
- name: Set up Python
32+
uses: actions/setup-python@v5
33+
with:
34+
python-version: '3.12'
35+
36+
- name: Install dependencies
37+
run: |
38+
python -m pip install --upgrade pip
39+
pip install -e ".[dev]"
40+
41+
- name: Initialize CodeQL
42+
uses: github/codeql-action/init@v3
43+
with:
44+
languages: ${{ matrix.language }}
45+
# Override default queries to include security-extended pack
46+
queries: security-extended,security-and-quality
47+
config: |
48+
name: "Moondream MCP CodeQL Config"
49+
queries:
50+
- uses: security-extended
51+
- uses: security-and-quality
52+
paths-ignore:
53+
- "tests/**"
54+
- "examples/**"
55+
- "docs/**"
56+
- "scripts/**"
57+
- ".github/**"
58+
- "*.md"
59+
60+
- name: Autobuild
61+
uses: github/codeql-action/autobuild@v3
62+
63+
- name: Perform CodeQL Analysis
64+
uses: github/codeql-action/analyze@v3
65+
with:
66+
category: "/language:${{matrix.language}}"
67+
upload: true
68+
69+
security-scan:
70+
name: Additional Security Scans
71+
runs-on: ubuntu-latest
72+
needs: analyze
73+
if: github.event_name == 'push' || github.event_name == 'schedule'
74+
75+
steps:
76+
- name: Checkout repository
77+
uses: actions/checkout@v4
78+
79+
- name: Set up Python
80+
uses: actions/setup-python@v5
81+
with:
82+
python-version: '3.12'
83+
84+
- name: Install security tools
85+
run: |
86+
python -m pip install --upgrade pip
87+
pip install bandit[toml] safety semgrep
88+
89+
- name: Run Bandit security linter
90+
run: |
91+
bandit -r src/ -f json -o bandit-report.json || true
92+
bandit -r src/ -f txt
93+
94+
- name: Run Safety check for known vulnerabilities
95+
run: |
96+
safety check --json --output safety-report.json || true
97+
safety check
98+
99+
- name: Run Semgrep security analysis
100+
run: |
101+
semgrep --config=auto src/ --json --output=semgrep-report.json || true
102+
semgrep --config=auto src/
103+
104+
- name: Upload security reports
105+
uses: actions/upload-artifact@v4
106+
if: always()
107+
with:
108+
name: security-reports
109+
path: |
110+
bandit-report.json
111+
safety-report.json
112+
semgrep-report.json
113+
retention-days: 30
114+
115+
dependency-review:
116+
name: Dependency Review
117+
runs-on: ubuntu-latest
118+
if: github.event_name == 'pull_request'
119+
120+
steps:
121+
- name: Checkout repository
122+
uses: actions/checkout@v4
123+
124+
- name: Dependency Review
125+
uses: actions/dependency-review-action@v4
126+
with:
127+
fail-on-severity: moderate
128+
allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC

0 commit comments

Comments
 (0)