Skip to content

README.md

Latest commit

 

History

History
207 lines (169 loc) · 8.08 KB

README.md

File metadata and controls

207 lines (169 loc) · 8.08 KB
Raw

DevForge

11 developer CLI tools that catch problems before production. Open source, MIT licensed.

Tools

Tool What It Does
API Contract Guardian Catch breaking OpenAPI changes in CI
json2sql Convert JSON to SQL INSERT statements
DeployDiff Preview infrastructure costs before deploy
ConfigDrift Detect config drift across environments
APIGhost Mock API server from OpenAPI specs
Envault Sync and rotate .env files
SchemaForge Bidirectional ORM schema conversion (11 formats)
click-to-mcp Wrap any Click/Typer CLI as MCP server
DeadCode Find and remove dead code in React/Next.js
DataMorph Convert between CSV, JSON, YAML, Parquet, Avro, Protobuf
DevForge Unified CLI — install all tools at once

Install

pip install devforge

Reusable Workflows

This repository provides reusable GitHub Actions workflows for use across the DevForge organization.

Python CI

Standard reusable CI for Python repositories. Runs linting (ruff), tests (pytest via hatch) across a configurable Python version matrix, and validates the build.

name: Python CI
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
jobs:
  test:
    uses: Coding-Dev-Tools/.github/.github/workflows/python-ci.yml@main

Supported inputs:

Input Default Description
python-versions ["3.10","3.11","3.12","3.13"] JSON array of Python versions
runner-os ["ubuntu-latest"] JSON array of runner OS targets
run-lint true Run ruff linting
lint-path src Path(s) to lint (space-separated)
run-build true Run hatch build check
test-command (auto) Custom test command override
extra-deps (empty) Extra pip install deps

Dependency Review

Scans PR dependency changes for known vulnerabilities before merging.

name: Dependency Review
on:
  pull_request:
    branches: [main]
jobs:
  dependency-review:
    uses: Coding-Dev-Tools/.github/.github/workflows/dependency-review.yml@main
    permissions:
      contents: read
      pull-requests: write

Supported inputs:

Input Default Description
fail-on-severity high Severity threshold: low, medium, high, critical
allow-licenses (empty) Comma-separated allowed licenses
deny-licenses (empty) Comma-separated denied licenses
fail-on-scopes runtime,unknown Scopes to fail on: runtime, development, unknown

Auto Code Review

Automated code review for pull requests - runs lint, format, secret detection, TODO markers, and large-file checks, then posts a summary PR comment with a pass/warn/fail verdict.

Secret detection uses detect-secrets==1.5.0 with --no-verify. All default detectors remain active; candidate credentials are never validated through network requests. A scan passes only after a successful process and validated JSON with the expected version, plugins, filters, and finding schema. Findings, execution errors, invalid or missing evidence, and failed or skipped required steps produce a failing verdict. Lint, format, TODO, and file-size findings remain warnings. Explicitly disabled optional checks are reported as disabled. Reports include safe status and counts; secret values, hashes, and scanner stderr are never included. Ruff caches use the runner's temporary directory.

The workflow checks out the caller repository and runs its review code inline. The matching template and regression tests exercise these exact YAML run blocks in separate caller-like directories, including synthetic findings in source and test files. The workflow does not exclude tests/ or .secrets.baseline; generated dependency/cache directories and detect-secrets' standard heuristics still apply. Passing a scan is not proof that every secret can be detected.

To run the focused regressions, install PyYAML, detect-secrets==1.5.0, and ruff, then run python -m unittest discover -s tests -p 'test_*.py' -v. CI also validates the active review workflow, template, and CI workflow with checksum-verified actionlint 1.7.12. To run the validator regression locally, set ACTIONLINT_BIN to the installed binary; it verifies that the shipped workflows pass and that the original unsupported job-level runner.temp context fails.

name: Auto Code Review
on:
  pull_request:
    branches: [main]
    types: [opened, synchronize, reopened]
jobs:
  code-review:
    uses: Coding-Dev-Tools/.github/.github/workflows/auto-code-review.yml@main
    permissions:
      contents: read
      pull-requests: write
      security-events: write

Supported inputs:

Input Default Description
python-version '3.12' Python version for lint tools
ruff-targets '.' Paths ruff should scan (space-separated)
detect-secrets true Run detect-secrets credential scan
check-todos false Warn on leftover TODO/FIXME/HACK markers
max-file-size 500 Max allowed file size in KB (0 = skip)
post-comment true Post review summary as a PR comment

Checks performed:

Check Tool Severity
Lint Ruff Warning
Format Ruff Warning
Secret detection detect-secrets Fail
TODO/FIXME/HACK grep Warning
Large files find Warning

Setup note: The workflow file lives in templates/workflows/auto-code-review.yml in this repo. To activate it, copy or symlink it to .github/workflows/auto-code-review.yml. This is required because GitHub only recognizes workflow files under .github/workflows/.

Code Review (Composite Action)

Lightweight code review using the actions/code-review composite action — runs ruff lint, bandit security scan, mypy type-check, and pytest. Posts a pass/fail PR comment.

name: Code Review
on:
  pull_request:
    types: [opened, synchronize, reopened]
jobs:
  review:
    uses: Coding-Dev-Tools/.github/.github/workflows/code-review.yml@main
    with:
      python-version: '3.12'
      run-ruff: true
      run-bandit: true
      run-type-check: false
      run-pytest: true
      source-dir: src
      fail-on-security: true
    permissions:
      contents: read
      pull-requests: write
      checks: write

Supported inputs:

Input Default Description
python-version '3.12' Python version for review tools
run-ruff true Run ruff lint check
run-bandit true Run bandit security scan
run-type-check false Run mypy type checking
run-pytest true Run pytest suite
source-dir src Source directory to lint/scan
fail-on-security true Fail on high-severity security issues
post-comment true Post review summary as a PR comment

Checks performed:

Check Tool Severity
Lint Ruff Warning
Security Bandit Fail
Types Mypy Warning
Tests Pytest Fail

Setup note: The workflow file lives in templates/workflows/code-review.yml in this repo. To activate it, copy or symlink it to .github/workflows/code-review.yml. This is required because GitHub only recognizes workflow files under .github/workflows/.

Links