Support rooted task and split CI tests

.github/workflows/bandit.yml

@@ -0,0 +1,56 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+# Bandit is a security linter designed to find common security issues in Python code.
+# This action will run Bandit on your codebase.
+# The results of the scan will be found under the Security tab of your repository.
+
+# https://github.com/marketplace/actions/bandit-scan is ISC licensed, by abirismyname
+# https://pypi.org/project/bandit/ is Apache v2.0 licensed, by PyCQA
+
+name: Bandit
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ "main" ]
+  schedule:
+    - cron: '38 4 * * 1'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  bandit:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Bandit Scan
+        uses: shundor/python-bandit-scan@ab1d87dfccc5a0ffab88be3aaac6ffe35c10d6cd
+        with: # optional arguments
+          # exit with 0, even with results found
+          exit_zero: true # optional, default is DEFAULT
+          # Github token of the repository (automatically created by Github)
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information.
+          # File or directory to run bandit on
+          # path: # optional, default is .
+          # Report only issues of a given severity level or higher. Can be LOW, MEDIUM or HIGH. Default is UNDEFINED (everything)
+          # level: # optional, default is UNDEFINED
+          # Report only issues of a given confidence level or higher. Can be LOW, MEDIUM or HIGH. Default is UNDEFINED (everything)
+          # confidence: # optional, default is UNDEFINED
+          # comma-separated list of paths (glob patterns supported) to exclude from scan (note that these are in addition to the excluded paths provided in the config file) (default: .svn,CVS,.bzr,.hg,.git,__pycache__,.tox,.eggs,*.egg)
+          # excluded_paths: # optional, default is DEFAULT
+          # comma-separated list of test IDs to skip
+          # skips: # optional, default is DEFAULT
+          # path to a .bandit file that supplies command line arguments
+          # ini_path: # optional, default is DEFAULT
+

.github/workflows/ci.yml

@@ -1,10 +1,9 @@
-name: Python tests
+name: CI
 
 on:
   push:
     branches: [main]
   pull_request:
-  workflow_dispatch:
 
 jobs:
   validate-branch-target:
@@ -16,30 +15,64 @@ jobs:
         run: |
           SOURCE_BRANCH="${{ github.head_ref }}"
           TARGET_BRANCH="${{ github.base_ref }}"
-          
+
           echo "Source branch: $SOURCE_BRANCH"
           echo "Target branch: $TARGET_BRANCH"
-          
+
           # Rule 1: Only develop branch can merge to main
           if [[ "$TARGET_BRANCH" == "main" && "$SOURCE_BRANCH" != "develop" ]]; then
             echo "❌ Error: Only 'develop' branch can merge to 'main'"
             echo "Your branch '$SOURCE_BRANCH' cannot target 'main' directly"
             echo "Please target 'develop' branch instead"
             exit 1
           fi
-          
+
           echo "✅ Branch targeting rules validated successfully"
 
-  tests:
-    name: Run Tests
+  unit-tests:
+    name: Unit Tests (Python ${{ matrix.python-version }})
     runs-on: ubuntu-latest
-    needs: [ validate-branch-target ]
+    needs: [validate-branch-target]
     if: always() && (needs.validate-branch-target.result == 'success' || needs.validate-branch-target.result == 'skipped')
 
     strategy:
+      fail-fast: false
       matrix:
-        python-version:  ['3.11', '3.12', '3.13']
+        python-version: ['3.11', '3.12', '3.13']
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: 'pip'
+
+      - name: Install dependencies
+        run: |
+          pip install --upgrade pip
+          pip install tox
+
+      - name: Run Unit Tests
+        run: |
+          PYTHON_VER=$(echo "${{ matrix.python-version }}" | tr -d '.')
+          TOX_ENV="py${PYTHON_VER}-unit"
+          echo "Running tox environment: $TOX_ENV"
+          tox -e $TOX_ENV
+
+  integration-tests:
+    name: Integration (Py${{ matrix.python-version }}/H${{ matrix.hatchet-version }}/G${{ matrix.group }})
+    runs-on: ubuntu-latest
+    needs: [validate-branch-target]
+    if: always() && (needs.validate-branch-target.result == 'success' || needs.validate-branch-target.result == 'skipped')
+
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.11', '3.12', '3.13']
         hatchet-version: ['1.20', '1.21']
+        group: [1, 2, 3]
 
     steps:
       - uses: actions/checkout@v4
@@ -55,51 +88,51 @@ jobs:
           pip install --upgrade pip
           pip install tox
 
-      - name: Deploy Hatch Lite
+      - name: Deploy Hatchet Lite
         run: |
           docker compose -f tests/integration/hatchet/docker-compose.hatchet.yml up -d
 
-      - name: Generate Env File
+      - name: Generate Hatchet API Key
         env:
           SERVER_AUTH_COOKIE_INSECURE: "t"
-        working-directory: .
         run: |
           sleep 10
           HATCHET_API_KEY=$(docker compose -f tests/integration/hatchet/docker-compose.hatchet.yml exec hatchet-lite /hatchet-admin token create --config /config --tenant-id 707d0855-80ab-4e1f-a156-f1c4546cbf52)
-          echo "HATCHET_API_KEY=$HATCHET_API_KEY"
-          echo "HATCHET_API_KEY=$HATCHET_API_KEY" >> $GITHUB_ENV
           echo "DYNACONF_hatchet__api_key=$HATCHET_API_KEY" >> $GITHUB_ENV
           echo "DYNACONF_hatchet__tls_config__strategy=none" >> $GITHUB_ENV
           echo "DYNACONF_REDIS__URL=redis://localhost:6379/" >> $GITHUB_ENV
           echo "HATCHET_CLIENT_WORKER_HEALTHCHECK_ENABLED=True" >> $GITHUB_ENV
 
-      - name: Run Tests with Tox
+      - name: Run Integration Tests
         env:
           PYTHONHASHSEED: 0
+          PYTEST_SPLITS: 3
+          PYTEST_GROUP: ${{ matrix.group }}
         run: |
-          # Map Python and Hatchet versions to tox env
           PYTHON_VER=$(echo "${{ matrix.python-version }}" | tr -d '.')
           HATCHET_VER=$(echo "${{ matrix.hatchet-version }}" | tr -d '.')
-          TOX_ENV="py${PYTHON_VER}-hatchet${HATCHET_VER}"
-          echo "Running tox environment: $TOX_ENV"
+          TOX_ENV="py${PYTHON_VER}-hatchet${HATCHET_VER}-integration"
+          echo "Running tox environment: $TOX_ENV (Group ${{ matrix.group }} of 3)"
           tox -e $TOX_ENV
 
-      - name: Clean up credentials
+      - name: Clean up
         if: always()
         run: |
-          rm -f ~/.git-credentials
-          docker stop hatchet-lite || true
-          docker rm hatchet-lite || true
+          docker compose -f tests/integration/hatchet/docker-compose.hatchet.yml down
 
   test-results:
     runs-on: ubuntu-22.04
-    needs: [ tests ]
+    needs: [unit-tests, integration-tests]
     if: always()
     steps:
       - name: Check test results
         run: |
-          if [[ "${{ needs.tests.result }}" != "success" ]]; then
-            echo "Test job failed"
+          if [[ "${{ needs.unit-tests.result }}" != "success" ]]; then
+            echo "Unit tests failed"
+            exit 1
+          fi
+          if [[ "${{ needs.integration-tests.result }}" != "success" ]]; then
+            echo "Integration tests failed"
             exit 1
           fi
-          echo "All checks passed successfully!"
+          echo "All checks passed successfully!"

.github/workflows/coverage.yml

@@ -8,6 +8,10 @@ on:
       - main
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   coverage:
     environment:

.github/workflows/pm.yml

@@ -0,0 +1,19 @@
+name: Close issues related to a merged pull request based on master branch.
+
+on:
+  pull_request:
+    types: [closed]
+    branches:
+      - develop
+      - main
+
+jobs:
+  closeIssueOnPrMergeTrigger:
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Closes issues related to a merged pull request.
+        uses: ldez/gha-mjolnir@v1.4.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/publish.yml

@@ -8,6 +8,10 @@ on:
     branches:
       - main
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   publish:
     environment:

.github/workflows/release.yml

@@ -7,7 +7,8 @@ on:
 
 jobs:
   create-github-release:
-    needs: check-tests
+    environment:
+      name: create-release
     runs-on: ubuntu-22.04
     permissions:
       contents: write  # Required for creating releases

.github/workflows/security.yml

@@ -0,0 +1,89 @@
+name: Security Scan
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main, develop]
+  schedule:
+    # Run weekly on Monday at 9am UTC
+    - cron: '0 9 * * 1'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  pip-audit:
+    name: Dependency Vulnerability Scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install tools
+        run: |
+          python -m pip install --upgrade pip pipx
+          pip install pip-audit
+          pipx install poetry
+          pipx inject poetry poetry-plugin-export
+
+      - name: Export and audit dependencies
+        run: |
+          poetry export -f requirements.txt --without-hashes -o requirements-audit.txt
+          pip-audit --strict -r requirements-audit.txt
+
+
+  secrets-scan:
+    name: Secrets Detection
+    environment:
+      name: security
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Run Gitleaks
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
+
+  summary:
+    name: Security Summary
+    runs-on: ubuntu-latest
+    needs: [pip-audit, secrets-scan]
+    if: always()
+    steps:
+      - name: Check results
+        run: |
+          echo "## Security Scan Summary" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          if [ "${{ needs.pip-audit.result }}" == "success" ]; then
+            echo "✅ pip-audit: Passed" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "❌ pip-audit: Failed" >> $GITHUB_STEP_SUMMARY
+          fi
+
+          if [ "${{ needs.secrets-scan.result }}" == "success" ]; then
+            echo "✅ Secrets scan: Passed" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "❌ Secrets scan: Failed" >> $GITHUB_STEP_SUMMARY
+          fi
+
+      - name: Fail if any check failed
+        if: |
+          needs.pip-audit.result == 'failure' ||
+          needs.secrets-scan.result == 'failure'
+        run: exit 1