ci: harden quality gates and clean test warnings

.github/workflows/code-quality.yml

@@ -5,11 +5,13 @@ on:
     branches: [ "main", "master" ]
     paths:
       - "**.py"
+      - "pyproject.toml"
       - "requirements.txt"
       - ".github/workflows/code-quality.yml"
   pull_request:
     paths:
       - "**.py"
+      - "pyproject.toml"
       - "requirements.txt"
       - ".github/workflows/code-quality.yml"
   workflow_dispatch:
@@ -30,19 +32,38 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
+          pip install -r requirements.txt
           pip install flake8 black isort mypy
 
       - name: Run Black (Code Formatter Check)
-        run: black --check --diff .
+        run: black --check --diff outlook_web tests web_outlook_app.py outlook_mail_reader.py start.py
 
       - name: Run isort (Import Sorting Check)
-        run: isort --check-only --diff --profile black .
+        run: isort --check-only --diff --profile black outlook_web tests web_outlook_app.py outlook_mail_reader.py start.py
 
       - name: Run Flake8 (Linting)
-        run: flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
+        run: flake8 outlook_web tests web_outlook_app.py outlook_mail_reader.py start.py --count --select=E9,F63,F7,F82 --show-source --statistics
 
       - name: Run Flake8 (Complexity Check)
-        run: flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
+        run: >
+          flake8
+          outlook_web/repositories/settings.py
+          outlook_web/services/external_api.py
+          outlook_web/controllers/system.py
+          web_outlook_app.py
+          --count
+          --max-complexity=10
+          --max-line-length=127
+          --statistics
+
+      - name: Run mypy (Core Modules)
+        run: >
+          mypy
+          --config-file pyproject.toml
+          outlook_web/repositories/settings.py
+          outlook_web/services/external_api.py
+          outlook_web/controllers/system.py
+          web_outlook_app.py
 
   security:
     name: Security Scan
@@ -63,13 +84,33 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
+          pip install -r requirements.txt
           pip install bandit[toml]
 
       - name: Run Bandit Security Scan
-        run: bandit -r . -f json -o bandit-report.json || true
-
-      - name: Display Bandit Results
+        shell: bash
         run: |
-          if [ -f bandit-report.json ]; then
-            cat bandit-report.json
+          set +e
+          bandit -r outlook_web web_outlook_app.py outlook_mail_reader.py start.py -f sarif -o bandit-report.sarif
+          report_status=$?
+          bandit -r outlook_web web_outlook_app.py outlook_mail_reader.py start.py -lll
+          gate_status=$?
+          echo "bandit_report_exit_code=$report_status" >> "$GITHUB_ENV"
+          echo "bandit_gate_exit_code=$gate_status" >> "$GITHUB_ENV"
+          exit 0
+
+      - name: Upload Bandit SARIF
+        if: always() && hashFiles('bandit-report.sarif') != ''
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: bandit-report.sarif
+
+      - name: Fail on Bandit Findings
+        if: always()
+        shell: bash
+        run: |
+          status="${bandit_gate_exit_code:-1}"
+          if [ "$status" -ne 0 ]; then
+            echo "Bandit found high-severity issues, exit code=$status"
+            exit "$status"
           fi

.github/workflows/docker-build-push.yml

@@ -7,9 +7,11 @@ on:
       - master
     paths:
       - '**.py'
+      - 'pyproject.toml'
       - 'requirements.txt'
       - 'Dockerfile'
       - 'templates/**'
+      - 'static/**'
       - '.github/workflows/docker-build-push.yml'
   workflow_dispatch:
 
@@ -18,7 +20,43 @@ env:
   DOCKERHUB_IMAGE: guangshanshui/outlook-email-plus
 
 jobs:
+  quality-gate:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+          pip install flake8 black isort mypy bandit[toml]
+
+      - name: Run formatter checks
+        run: |
+          black --check outlook_web tests web_outlook_app.py outlook_mail_reader.py start.py
+          isort --check-only --profile black outlook_web tests web_outlook_app.py outlook_mail_reader.py start.py
+
+      - name: Run static analysis gate
+        run: |
+          flake8 outlook_web tests web_outlook_app.py outlook_mail_reader.py start.py --count --select=E9,F63,F7,F82 --show-source --statistics
+          flake8 outlook_web/repositories/settings.py outlook_web/services/external_api.py outlook_web/controllers/system.py web_outlook_app.py --count --max-complexity=10 --max-line-length=127 --statistics
+          mypy --config-file pyproject.toml outlook_web/repositories/settings.py outlook_web/services/external_api.py outlook_web/controllers/system.py web_outlook_app.py
+
+      - name: Run security gate
+        run: bandit -r outlook_web web_outlook_app.py outlook_mail_reader.py start.py -lll
+
+      - name: Run publish gate tests
+        run: python -m unittest discover -s tests -v
+
   build-and-push:
+    needs: quality-gate
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/python-tests.yml

@@ -5,14 +5,20 @@ on:
     branches: [ "main", "master" ]
     paths:
       - "**.py"
+      - "pyproject.toml"
       - "requirements.txt"
       - "tests/**"
+      - "templates/**"
+      - "static/**"
       - ".github/workflows/python-tests.yml"
   pull_request:
     paths:
       - "**.py"
+      - "pyproject.toml"
       - "requirements.txt"
       - "tests/**"
+      - "templates/**"
+      - "static/**"
       - ".github/workflows/python-tests.yml"
   workflow_dispatch:
 
@@ -37,12 +43,21 @@ jobs:
         run: |
           python -m pip install --upgrade pip
           python -m pip install -r requirements.txt
+          python -m pip install coverage
 
       - name: Syntax check
         run: |
-          python -m py_compile web_outlook_app.py
-          python -m py_compile outlook_mail_reader.py
+          python -m compileall -q outlook_web web_outlook_app.py outlook_mail_reader.py start.py tests
 
-      - name: Run unit tests
-        run: python -m unittest discover -s tests -v
+      - name: Run unit tests with coverage
+        run: |
+          coverage run -m unittest discover -s tests -v
+          coverage xml
+          coverage report
+
+      - name: Upload coverage artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-python-${{ matrix.python-version }}
+          path: coverage.xml
 

.github/workflows/sonar.yml

@@ -31,6 +31,12 @@ jobs:
         run: |
           python -m pip install --upgrade pip
           python -m pip install -r requirements.txt
+          python -m pip install coverage
+
+      - name: Run tests with coverage
+        run: |
+          coverage run -m unittest discover -s tests -v
+          coverage xml
 
       - name: SonarQube Scan
         uses: sonarsource/sonarqube-scan-action@v5