Create a CI workflow that runs meaningful tests

CI should reproduce the checks that protect the artifact. A green job that only imports one module is weak evidence.

Review the stage order

The integration lab defines a fixture pipeline.

from integration_cases import ci_case

result = ci_case()
assert result["tests_before_build"] is True
assert result["deploy_step_present"] is False
assert result["secrets_in_pull_request"] is False
assert result["workflow_executed"] is False
assert "contract tests" in result["steps"]

No GitHub Actions workflow ran.

Pin action versions, choose explicit Python versions, install from lock/metadata and run formatting/lint, types, unit and offline contract tests. Build the artifact once after checks and retain test/build evidence. Test migrations or containers where risk warrants it.

Treat fork pull requests as untrusted. Do not expose deployment secrets or grant write tokens. Dependency caches improve speed but are not artifacts and must be treated as untrusted input. Separate reviewed protected-branch deployment from PR validation.

The FDE for Freshers course connects code review to CI/CD and deployment.

Exercise

Create a local workflow file, lint it and run equivalent commands locally. Plant one schema regression and prove the contract stage blocks the artifact.

Continue learning

This article is part of the FDE integration and deployment foundations sequence. Use the neighbouring tasks when you need the prerequisite or the next application.

• Review the prerequisite or neighbouring task in Use Docker Compose for an app and database.
• Continue with Deploy a service with a health endpoint.

Reference: GitHub Actions Python build/test guide.