feat: Add CI and CD workflows for automated build, testing, and release by Wembie · Pull Request #1 · Wembie/Sentinel

Wembie · 2026-05-08T21:13:32Z

No description provided.

- Updated `.flake8` to extend ignore for E501. - Modified `pyproject.toml` to include additional ignore rules for Ruff. - Refactored type hints in `cli.py`, `config.py`, `engine.py`, `pipeline.py`, `registry.py`, and other files for better clarity and consistency. - Improved logging and error handling in various modules. - Enhanced readability by reformatting long lines and ensuring consistent indentation. - Updated hardcoded credential patterns in `auth.py` and `injection.py` for better regex clarity. - Adjusted datetime handling to use UTC consistently across models.

…nd usage

Copilot

Pull request overview

Adds GitHub Actions CI/CD automation for the SENTINEL Python package, alongside dependency and small codebase cleanups to support consistent linting/testing and versioning.

Changes:

Introduces CI workflow to enforce VERSION bumping and run ruff/black/mypy/pytest (with coverage).
Introduces CD workflow to build artifacts and create a tag + GitHub Release when VERSION changes on main.
Updates packaging/dev-dependency configuration (uv groups) and performs minor typing/formatting refactors across the codebase.

Reviewed changes

Copilot reviewed 25 out of 26 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
`VERSION`	Bumps project version to `0.1.4`.
`uv.lock`	Adds `coverage`/`pytest-cov` and updates lock metadata for new dev dependency grouping.
`sentinel/rules/builtin/injection.py`	Minor regex string formatting consistency changes.
`sentinel/rules/builtin/auth.py`	Formatting/line-wrapping adjustments to patterns and exploit-chain construction.
`sentinel/reporting/sarif_reporter.py`	Minor formatting change for `locations` fallback expression.
`sentinel/reporting/markdown_reporter.py`	Minor formatting change in markdown table header lines.
`sentinel/parsers/treesitter.py`	Splits multi-import for clarity/formatting.
`sentinel/models/graph.py`	Migrates enum types to `StrEnum` (Py 3.11+) for better string-enum ergonomics.
`sentinel/models/finding.py`	Migrates to `StrEnum` and uses `datetime.UTC` in default timestamp.
`sentinel/models/audit.py`	Migrates to `StrEnum`, tightens typing, and cleans up annotations.
`sentinel/mcp.py`	Formatting cleanup; adds debug logging for parse failures; minor refactors for readability.
`sentinel/logging.py`	Improves typing and readability around structlog processor configuration.
`sentinel/llm/openai.py`	Minor formatting of structured-system prompt assembly.
`sentinel/llm/claude.py`	Minor formatting of structured-system prompt assembly.
`sentinel/graph/builder.py`	Formatting + safer string conversion for AST child text extraction.
`sentinel/graph/backend.py`	Formatting cleanup in list comprehensions / path finding.
`sentinel/core/registry.py`	Improves typing for decorator registration and removes `type: ignore` via `cast()`.
`sentinel/core/pipeline.py`	Updates return type annotation to non-string form (relies on future annotations).
`sentinel/core/engine.py`	Uses `datetime.UTC`; removes unused import; uses `zip(..., strict=True)` for safer pairing.
`sentinel/config.py`	Formatting cleanup in settings source tuple return.
`sentinel/cli.py`	Typing improvements, Optional modernizations, and some formatting tidy-ups.
`pyproject.toml`	Moves dev deps to `[dependency-groups]`, adds `pytest-cov`, and updates ruff ignores.
`.github/workflows/ci.yml`	Adds CI workflow (lint/format/typecheck/tests + VERSION bump gate).
`.github/workflows/cd.yml`	Adds CD workflow (build + tag/release on VERSION change).
`.flake8`	Simplifies flake8 config (now only ignores `E501`).

Wembie · 2026-05-09T00:42:44Z

+      - name: Check if VERSION changed
+        id: ver
+        run: |
+          if git diff HEAD~1 HEAD -- VERSION | grep -q '^+[^+]'; then
+            echo "changed=true"  >> $GITHUB_OUTPUT
+            echo "version=$(cat VERSION | tr -d '[:space:]')" >> $GITHUB_OUTPUT
+          else
+            echo "changed=false" >> $GITHUB_OUTPUT
+            echo "version=$(cat VERSION | tr -d '[:space:]')" >> $GITHUB_OUTPUT
+          fi


@copilot apply changes based on this feedback

Implemented in 48dd2ed: CD now checks VERSION changes across the full push range (${{ github.event.before }}..${{ github.sha }}), with a null-SHA fallback path, so multi-commit pushes won’t miss a VERSION bump.

Wembie · 2026-05-09T00:52:45Z

+      - name: Sync version to static manifests
+        run: python scripts/sync_version.py
+
+      - name: Build package
+        run: uv build
+


@copilot apply changes based on this feedback

Applied in b886a34: CD no longer relies on workflow-time manifest mutation for release output correctness; it now runs sync_version.py and fails if any workspace changes are introduced, so releases only proceed when synced manifest updates are already committed.

Wembie · 2026-05-09T01:03:51Z

+      - name: Ensure VERSION was bumped
+        if: github.event_name == 'pull_request'
+        shell: bash
+        run: |
+          BASE_VERSION="$(git show "${{ github.event.pull_request.base.sha }}:VERSION")"
+          HEAD_VERSION="$(git show "${{ github.event.pull_request.head.sha }}:VERSION")"
+          if [ "$BASE_VERSION" = "$HEAD_VERSION" ]; then
+            echo "::error::VERSION not bumped. Bump VERSION before merging."
+            exit 1
+          fi


@copilot apply changes based on this feedback

Implemented in b0cae5c: CI now trims whitespace from base/head VERSION values, validates both as semver, and then checks that VERSION was actually bumped. No UI changes in this update.

Agent-Logs-Url: https://github.com/Wembie/Sentinel/sessions/ac47afdf-b5d7-423c-a4ae-48969a4cdda1 Co-authored-by: Wembie <73087520+Wembie@users.noreply.github.com>

Agent-Logs-Url: https://github.com/Wembie/Sentinel/sessions/b33259f7-53dc-427f-8103-7c90bb5fcd4d Co-authored-by: Wembie <73087520+Wembie@users.noreply.github.com>

Agent-Logs-Url: https://github.com/Wembie/Sentinel/sessions/2813ab75-17b1-40ec-bdf5-7408fad85718 Co-authored-by: Wembie <73087520+Wembie@users.noreply.github.com>

feat: Add CI and CD workflows for automated build, testing, and release

c123a12

Wembie self-assigned this May 8, 2026

Wembie added 3 commits May 8, 2026 16:14

chore: update version to 0.1.4 in VERSION file

75f2c6c

Refactor code structure for improved readability and maintainability

c72c099

Wembie requested a review from Copilot May 9, 2026 00:37

Copilot started reviewing on behalf of Wembie May 9, 2026 00:38 View session

Wembie added 2 commits May 8, 2026 19:38

docs: Update README for improved clarity and detail on installation a…

a9d847c

…nd usage

chore: update version to 1.0.0 in VERSION file

cc9364a

Copilot AI reviewed May 9, 2026

View reviewed changes

Copilot started work on behalf of Wembie May 9, 2026 00:42 View session

Copilot AI and others added 4 commits May 9, 2026 00:44

fix(cd): detect VERSION changes across full push range

a3d5d98

Agent-Logs-Url: https://github.com/Wembie/Sentinel/sessions/ac47afdf-b5d7-423c-a4ae-48969a4cdda1 Co-authored-by: Wembie <73087520+Wembie@users.noreply.github.com>

chore(cd): tighten VERSION path match in release gate

056c6a4

Agent-Logs-Url: https://github.com/Wembie/Sentinel/sessions/ac47afdf-b5d7-423c-a4ae-48969a4cdda1 Co-authored-by: Wembie <73087520+Wembie@users.noreply.github.com>

refactor(cd): replace hardcoded null SHA in version gate

50c5f50

Agent-Logs-Url: https://github.com/Wembie/Sentinel/sessions/ac47afdf-b5d7-423c-a4ae-48969a4cdda1 Co-authored-by: Wembie <73087520+Wembie@users.noreply.github.com>

refactor(cd): use git diff --quiet for VERSION gate

48dd2ed

Agent-Logs-Url: https://github.com/Wembie/Sentinel/sessions/ac47afdf-b5d7-423c-a4ae-48969a4cdda1 Co-authored-by: Wembie <73087520+Wembie@users.noreply.github.com>

Copilot finished work on behalf of Wembie May 9, 2026 00:47

Wembie added 2 commits May 8, 2026 19:49

Refactor code structure for improved readability and maintainability

6d984aa

Merge branch 'dev' of https://github.com/Wembie/Sentinel into dev

491fd8a

Copilot started work on behalf of Wembie May 9, 2026 00:52 View session

Copilot AI and others added 4 commits May 9, 2026 00:54

fix(cd): fail release when version manifests are out of sync

a8e42e4

Agent-Logs-Url: https://github.com/Wembie/Sentinel/sessions/b33259f7-53dc-427f-8103-7c90bb5fcd4d Co-authored-by: Wembie <73087520+Wembie@users.noreply.github.com>

refactor(cd): verify manifest sync via git diff

096f739

Agent-Logs-Url: https://github.com/Wembie/Sentinel/sessions/b33259f7-53dc-427f-8103-7c90bb5fcd4d Co-authored-by: Wembie <73087520+Wembie@users.noreply.github.com>

chore(cd): fail on any sync-induced workspace changes

b7f65e6

Agent-Logs-Url: https://github.com/Wembie/Sentinel/sessions/b33259f7-53dc-427f-8103-7c90bb5fcd4d Co-authored-by: Wembie <73087520+Wembie@users.noreply.github.com>

refactor(cd): detect any workspace changes after sync check

b886a34

Agent-Logs-Url: https://github.com/Wembie/Sentinel/sessions/b33259f7-53dc-427f-8103-7c90bb5fcd4d Co-authored-by: Wembie <73087520+Wembie@users.noreply.github.com>

Copilot finished work on behalf of Wembie May 9, 2026 00:56

Copilot started work on behalf of Wembie May 9, 2026 01:03 View session

fix(ci): trim and semver-validate VERSION bump gate

b0cae5c

Agent-Logs-Url: https://github.com/Wembie/Sentinel/sessions/2813ab75-17b1-40ec-bdf5-7408fad85718 Co-authored-by: Wembie <73087520+Wembie@users.noreply.github.com>

Copilot finished work on behalf of Wembie May 9, 2026 01:06

Wembie merged commit d05f322 into main May 9, 2026
1 check passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Add CI and CD workflows for automated build, testing, and release#1

feat: Add CI and CD workflows for automated build, testing, and release#1
Wembie merged 17 commits into
mainfrom
dev

Wembie commented May 8, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Wembie May 9, 2026

Uh oh!

Copilot AI May 9, 2026

Uh oh!

Wembie May 9, 2026

Uh oh!

Copilot AI May 9, 2026

Uh oh!

Wembie May 9, 2026

Uh oh!

Copilot AI May 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Wembie commented May 8, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Wembie May 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 9, 2026

Choose a reason for hiding this comment

Uh oh!

Wembie May 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 9, 2026

Choose a reason for hiding this comment

Uh oh!

Wembie May 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 9, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants