Skip to content
Merged
Show file tree
Hide file tree
Changes from 8 commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion .github/workflows/main_queryweaver.yml
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ on:
push:
branches:
- main
- staging
workflow_dispatch:

jobs:
Expand Down Expand Up @@ -64,6 +65,8 @@ jobs:
permissions:
id-token: write #This is required for requesting the JWT
contents: read #This is required for actions/checkout
env:
SLOT_NAME: ${{ github.ref_name == 'main' && 'Production' || github.ref_name == 'staging' && 'staging' }}

steps:
- name: Download artifact from build job
Expand All @@ -88,5 +91,5 @@ jobs:
id: deploy-to-webapp
with:
app-name: 'queryweaver'
slot-name: 'Production'
slot-name: ${{ env.SLOT_NAME }}
startup-command: 'python -m uvicorn api.index:app --host 0.0.0.0 --port $PORT'
71 changes: 71 additions & 0 deletions .github/workflows/staging_queryweaver(staging).yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,71 @@
# Docs for the Azure Web Apps Deploy action: https://github.com/Azure/webapps-deploy

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Fix linter blockers: CRLF/EOL and trailing spaces.

Convert file to LF, trim trailing spaces (Lines 31, 34, 57, 71), and add a newline at EOF. Consider enforcing via .gitattributes: "*.yml text eol=lf".

Also applies to: 31-31, 34-34, 57-57, 71-71

🧰 Tools
🪛 YAMLlint (1.37.1)

[error] 1-1: wrong new line character: expected \n

(new-lines)

🤖 Prompt for AI Agents
.github/workflows/staging_queryweaver(staging).yml lines 1-1 and specifically
lines 31, 34, 57, 71 have CRLF/EOL and trailing-space issues; convert the file
encoding to LF, remove trailing spaces on lines 31, 34, 57 and 71, and ensure
there is a single newline at EOF; to prevent regressions add a .gitattributes
entry like "*.yml text eol=lf" in the repo (or update existing) and re-commit
the normalized file.

# More GitHub Actions for Azure: https://github.com/Azure/actions
# More info on Python, GitHub Actions, and Azure App Service: https://aka.ms/python-webapps-actions

name: Build and deploy Python app to Azure Web App - queryweaver

on:
push:
branches:
- staging
workflow_dispatch:

jobs:
build:
runs-on: ubuntu-latest
permissions:
contents: read #This is required for actions/checkout

steps:
- uses: actions/checkout@v4

- name: Set up Python version
uses: actions/setup-python@v5
with:
python-version: '3.12'

- name: Create and start virtual environment
run: |
python -m venv venv
source venv/bin/activate

- name: Install dependencies
run: pip install -r requirements.txt

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Virtualenv is not active across steps; installs go to the system interpreter. Simplify.

Apply:

-      - name: Create and start virtual environment
-        run: |
-          python -m venv venv
-          source venv/bin/activate
-      
-      - name: Install dependencies
-        run: pip install -r requirements.txt
+      - name: Install dependencies
+        run: python -m pip install -r requirements.txt
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Create and start virtual environment
run: |
python -m venv venv
source venv/bin/activate
- name: Install dependencies
run: pip install -r requirements.txt
- name: Install dependencies
run: python -m pip install -r requirements.txt
🧰 Tools
🪛 YAMLlint (1.37.1)

[error] 31-31: trailing spaces

(trailing-spaces)


[error] 34-34: trailing spaces

(trailing-spaces)

🤖 Prompt for AI Agents
In .github/workflows/staging_queryweaver(staging).yml around lines 27-34, the
workflow creates and activates a virtualenv in one step but activation does not
persist across steps so pip ends up installing into the runner system Python;
replace the venv creation/activation with the official actions/setup-python
(e.g., uses: actions/setup-python@v4 with python-version) and then run pip
install -r requirements.txt in a subsequent step (or the same run block) so
dependencies are installed into the configured interpreter; optionally add
actions/cache for pip cache to speed installs.

# Optional: Add step to run tests here (PyTest, Django test suites, etc.)

- name: Upload artifact for deployment jobs
uses: actions/upload-artifact@v4
with:
name: python-app
path: |
.
!venv/

deploy:
runs-on: ubuntu-latest
needs: build
permissions:
id-token: write #This is required for requesting the JWT
contents: read #This is required for actions/checkout

steps:
- name: Download artifact from build job
uses: actions/download-artifact@v4
with:
name: python-app

- name: Login to Azure
uses: azure/login@v2
Comment thread Fixed
Comment thread Fixed
with:

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Pin 3rd-party actions to commit SHAs

Pin azure/login and azure/webapps-deploy to immutable SHAs to reduce supply-chain risk. Consider pinning other actions too (checkout, setup-python, upload/download-artifact).

Apply this pattern (replace with the current published commit):

-      - name: Login to Azure
-        uses: azure/login@v2
+      - name: Login to Azure
+        uses: azure/login@<commit-sha>

-      - name: 'Deploy to Azure Web App'
-        uses: azure/webapps-deploy@v3
+      - name: 'Deploy to Azure Web App'
+        uses: azure/webapps-deploy@<commit-sha>

Also applies to: 66-66

🧰 Tools
🪛 GitHub Check: CodeQL

[warning] 59-59: Unpinned tag for a non-immutable Action in workflow
Unpinned 3rd party Action 'Build and deploy Python app to Azure Web App - queryweaver' step Uses Step uses 'azure/login' with ref 'v2', not a pinned commit hash

🤖 Prompt for AI Agents
.github/workflows/staging_queryweaver(staging).yml lines 58-60 (and also line
66): the workflow uses third-party actions (azure/login and
azure/webapps-deploy) by tag/major version which is mutable; pin each action to
its specific commit SHA to reduce supply-chain risk. Replace uses:
azure/login@v2 and azure/webapps-deploy@v2 (and any other actions like
actions/checkout, actions/setup-python,
actions/upload-artifact/download-artifact) with their published immutable commit
SHAs (e.g. azure/login@<commit-sha>) ensuring you use the current release commit
for each action and update any other action references similarly.

client-id: ${{ secrets.AZUREAPPSERVICE_CLIENTID_95C84156557F40AF875812F7C29CD989 }}
tenant-id: ${{ secrets.AZUREAPPSERVICE_TENANTID_B26FFD333BD44EE98C7ACED0A22637B7 }}
subscription-id: ${{ secrets.AZUREAPPSERVICE_SUBSCRIPTIONID_DEEC4D371D1547A6A3F63C9FE22DF791 }}

- name: 'Deploy to Azure Web App'
uses: azure/webapps-deploy@v3
Comment thread Fixed
Comment thread Fixed
id: deploy-to-webapp
with:
app-name: 'queryweaver'
slot-name: 'staging'

2 changes: 1 addition & 1 deletion Pipfile
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ litellm = "~=1.75.9"
falkordb = "~=1.2.0"
psycopg2-binary = "~=2.9.9"
pymysql = "~=1.1.0"
authlib = "~=1.4.0"
authlib = "~=1.6.2"
itsdangerous = "~=2.2.0"
jsonschema = "~=4.25.0"
tqdm = "~=4.67.1"
Expand Down
8 changes: 4 additions & 4 deletions Pipfile.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.