python-ci-setup

Python CI Setup

Multi-step workflow to create a production-grade Python CI pipeline.

When to Use

• New Python project needs CI from scratch
• Existing project has incomplete or fragile CI
• Adding security scanning, multi-version testing, or Trusted Publishing

Pipeline Layers (in order)

Each layer gates the next. If a layer fails, the pipeline stops.

1. Format — ruff format --check . (or black --check .) must pass
2. Lint — ruff check . (or flake8) must pass
3. Type check — mypy src (or Pyright) must pass
4. Test — pytest with coverage threshold
5. Security scan — bandit -r src + pip-audit
6. Build — python -m build produces valid sdist/wheel
7. Publish (optional) — Trusted Publishing to PyPI via OIDC

Steps

1. Choose CI Platform

Default to GitHub Actions for GitHub-hosted repositories. Ensure matrix testing across supported Python versions (3.11, 3.12, 3.13, 3.14).

2. Create Quality Workflow

For GitHub Actions: .github/workflows/ci.yml

name: CI
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  quality:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.11", "3.12", "3.13", "3.14"]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - run: python -m pip install -U pip
      - run: python -m pip install -e ".[dev]"

      - run: ruff format --check .
      - run: ruff check .
      - run: mypy src
      - run: pytest --tb=short
      - run: coverage run -m pytest && coverage report --fail-under=85
      - run: bandit -r src
      - run: pip-audit

3. Configure Tools in pyproject.toml

All tool configuration lives in pyproject.toml:

[tool.ruff]
line-length = 100
target-version = "py311"

[tool.ruff.lint]
select = ["E", "F", "I", "B", "UP"]

[tool.pytest.ini_options]
testpaths = ["tests"]
addopts = "-ra"

[tool.coverage.run]
branch = true
source = ["src/my_package"]

[tool.coverage.report]
fail_under = 85

[tool.mypy]
python_version = "3.11"
strict = true
mypy_path = ["src"]

[tool.bandit]
exclude_dirs = ["tests"]