Python / FastAPI CI Standard

Required stages

1. uv sync --locked --all-groups using a committed uv.lock.
2. ruff format --check and ruff check.
3. MyPy, initially scoped to application modules if legacy typing debt exists.
4. Pytest with pytest-cov and JUnit/Cobertura output.
5. SonarQube analysis.
6. Semgrep, Gitleaks, Trivy filesystem/config.
7. Multi-stage image build; optional ci Docker target for native dependencies.
8. Trivy image scan, SBOM, signing, and publish.

Bandit may run during migration for comparison, but Semgrep is the authoritative cross-language SAST control. Duplicate scanners are retired after rule and finding comparison.

Dependency management

uv 0.11.28 is the standard Python package manager. CI runs project commands through uv run, for example uv run pytest --cov. Existing Poetry or requirements-file repositories are migration exceptions only: convert and review their dependency metadata and uv.lock, then validate tests, Docker builds, and deployed smoke behavior before removing the legacy workflow.

Example caller

jobs:
  ci:
    uses: dataready-ai/nexa-ci/.github/workflows/python-ci.yml@v1
    with:
      python-version: '3.12'
      image-name: nexa-databricks-api
      docker-ci-target: ci
      docker-runtime-target: runtime
      ecr-repository: aws-iac-nexa-databricks-api
      acr-repository: nexa-databricks-api
      spcs-repository: NEXA_DATABRICKS_API_REPO
      run-terraform-scan: false
    secrets: inherit