Phase 7: CI/CD Pipelines for AI Code · 50 min · GitHub Actions · ESLint · mypy

GitHub Actions for AI Code

Configure every gate as a GitHub Actions step. Cache aggressively. Fail fast.

Hiring signal: Engineers who can configure GitHub Actions workflows with quality gates for AI-generated code demonstrate practical CI/CD skills.

What you will learn

Configure GitHub Actions workflows with quality gates for AI-generated code
Implement ESLint, mypy, Bandit, Semgrep, pip-audit, and mutation testing steps
Apply caching strategies for faster AI code verification
Set up required status checks for branch protection

The Problem

You've designed the pipeline architecture (Lesson 1). Now you need to implement it in GitHub Actions. This lesson covers configuring workflows with quality gates, caching strategies, and branch protection.

The Complete Workflow

# .github/workflows/ai-code-quality.yml
name: AI Code Quality Gates
on: [pull_request]

jobs:
  # Gate 1: Linting
  linting:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - run: pip install flake8
      - run: flake8 --max-line-length=100 --extend-ignore=W503 src/

  # Gate 2: Type Checking
  type-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
      - run: pip install mypy
      - run: mypy --strict src/

  # Gate 3: Unit Tests + Coverage
  tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
      - run: pip install pytest pytest-cov
      - run: pytest --cov=src --cov-fail-under=90

  # Gate 4: SAST (Bandit)
  sast-bandit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: pip install bandit
      - run: bandit -r src/ -f json -o bandit-report.json
      - run: bandit -r src/ --severity-level high

  # Gate 5: SAST (Semgrep)
  sast-semgrep:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: pip install semgrep
      - run: semgrep scan --config=p/python --config=p/owasp-top-ten src/

  # Gate 6: SCA (pip-audit)
  sca:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: pip install pip-audit
      - run: pip-audit -r requirements.txt

  # Gate 7: Mutation Testing (depends on tests)
  mutation:
    needs: tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: pip install mutmut
      - run: mutmut run --paths-to-mutate=src/
      - run: mutmut results --threshold=80

  # Gate 8: Dependency Allowlist
  allowlist:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: python check_allowlist.py requirements.txt

  # Gate 9: Lockfile + Hash Verification
  lockfile:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: pip install pip-tools
      - run: pip-compile --generate-hashes --no-header requirements.in
      - run: git diff --exit-code requirements.txt
      - run: pip install --require-hashes -r requirements.txt

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers Caching Strategies, Build It — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.