stable-diffusion-webui/.github/workflows/run_quality_tests.yaml
m-cahill 234004ae22
fix(M04): pip-audit deferral, setuptools/protobuf upgrades (#5)
* fix(M04): upgrade setuptools, protobuf for CVE fixes

Made-with: Cursor

* fix(M04): pip-audit continue-on-error, defer vuln remediation to M27

Made-with: Cursor
2026-03-08 20:09:44 -07:00

139 lines
5 KiB
YAML

name: Quality Tests
on:
push:
branches: [main]
jobs:
quality:
name: quality tests
runs-on: ubuntu-latest
steps:
- name: Verify repository
run: |
if [ "$GITHUB_REPOSITORY" != "m-cahill/serena" ]; then
echo "::error::Serena CI must run only inside m-cahill/serena, not $GITHUB_REPOSITORY"
exit 1
fi
- name: Verify ref
run: |
if [ "$GITHUB_REF" != "refs/heads/main" ]; then
echo "::error::Quality workflow must run on push to main, not $GITHUB_REF"
exit 1
fi
- name: Checkout Code
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
- name: Set up Python 3.10
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
with:
python-version: 3.10.6
cache: pip
cache-dependency-path: |
**/requirements*txt
launch.py
- name: Cache models
id: cache-models
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
with:
path: models
key: "2023-12-30"
- name: Install test dependencies
run: pip install wait-for-it -r requirements-test.txt
env:
PIP_DISABLE_PIP_VERSION_CHECK: "1"
PIP_PROGRESS_BAR: "off"
- name: Install base build tools
run: |
python -m pip install --upgrade pip
pip install setuptools wheel
- name: Install runtime dependencies
run: |
pip install torch==2.1.2 torchvision==0.16.2 --extra-index-url https://download.pytorch.org/whl/cpu
pip install https://github.com/openai/CLIP/archive/d50d76daa670286dd6cacf3bcd80b5e4823fc8e1.zip --no-build-isolation
pip install https://github.com/mlfoundations/open_clip/archive/bb6e834e9c70d9c27d0dc3ecedeebeaeb1ffad6b.zip
pip install -r requirements_versions.txt
env:
PIP_DISABLE_PIP_VERSION_CHECK: "1"
PIP_PROGRESS_BAR: "off"
- name: Dependency vulnerability scan
continue-on-error: true
run: |
pip install pip-audit
pip-audit || echo "::warning::pip-audit found vulnerabilities. Remediation deferred to M27. See M04_audit.md."
- name: Verify pinned dependencies
run: bash scripts/ci/verify_pinned_deps.sh requirements_versions.txt
- name: Capture CI environment
run: |
{
python --version
pip --version
pip freeze
} > ci_environment.txt
- name: Create stub repositories
run: python scripts/dev/create_stub_repos.py
- name: Setup environment
run: python launch.py --skip-prepare-environment --skip-torch-cuda-test --exit
env:
PIP_DISABLE_PIP_VERSION_CHECK: "1"
PIP_PROGRESS_BAR: "off"
TORCH_INDEX_URL: https://download.pytorch.org/whl/cpu
WEBUI_LAUNCH_LIVE_OUTPUT: "1"
PYTHONUNBUFFERED: "1"
- name: Smoke startup
run: |
python launch.py --skip-prepare-environment --skip-torch-cuda-test --test-server --use-cpu all --exit
- name: Print installed packages
run: pip freeze
- name: Start test server
run: >
python -m coverage run
--data-file=.coverage.server
launch.py
--skip-prepare-environment
--skip-torch-cuda-test
--test-server
--do-not-download-clip
--no-half
--disable-opt-split-attention
--use-cpu all
--api-server-stop
--port 7860
2>&1 | tee output.txt &
- name: Run quality tests
run: |
wait-for-it --service 127.0.0.1:7860 -t 20
python -m pytest test/smoke test/quality -vv --junitxml=test/results.xml --cov . --cov-report=xml --cov-report=term --verify-base-url
- name: Kill test server
if: always()
run: curl -vv -XPOST http://127.0.0.1:7860/sdapi/v1/server-stop && sleep 10
- name: Show coverage
run: |
python -m coverage combine .coverage*
python -m coverage report -i
python -m coverage report --fail-under=40 -i
python -m coverage xml -i
python -m coverage html -i
- name: Upload main app output
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
if: always()
with:
name: output
path: output.txt
- name: Upload coverage HTML
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
if: always()
with:
name: htmlcov
path: htmlcov
- name: Upload coverage XML
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
if: always()
with:
name: coverage-xml
path: coverage.xml
- name: Upload CI environment
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
if: always()
with:
name: ci-environment
path: ci_environment.txt