ci: test Python 3.13, check migrations, schema, deploy and audit

- Matrix 3.10-3.13; pip cache keyed on the requirements.
- New steps: makemigrations --check, spectacular --validate
  --fail-on-warn, check --deploy --fail-level ERROR, pip-audit of the
  installed environment (the Django 4.2.30 advisories are ignored until
  the Django 5.2 upgrade), and a Docker image build.
- The separate vrtManager unittest run is dropped; manage.py test
  already runs those tests.
- CodeQL also runs on pull requests to master.
- Docker installs into a plain venv instead of using the distro's
  python3-lxml and python3-libvirt; lxml>=6.1, since the distro's
  lxml 5.2.1 has CVE-2026-41066.
- dev requirements add ruff and pip-audit.

.github/workflows/codeql-analysis.yml

@@ -9,7 +9,7 @@ on:
   push:
     branches: [master]
   pull_request:
-    branches-ignore: [master]
+    branches: [master]
   schedule:
     - cron: '0 21 * * 3'
 

.github/workflows/test.yml

@@ -13,7 +13,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ['3.10', '3.11', '3.12']
+        python-version: ['3.10', '3.11', '3.12', '3.13']
 
     steps:
       - name: Checkout Code
@@ -24,8 +24,11 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
           cache: 'pip'
-          cache-dependency-path: 'conf/requirements.txt'
+          cache-dependency-path: |
+            conf/requirements.txt
+            dev/requirements.txt
 
+      # Build headers for the sdist-only bindings (libvirt-python, python-ldap)
       - name: Install System Dependencies
         run: |
           sudo apt-get update -qq
@@ -33,19 +36,13 @@ jobs:
             libvirt-dev \
             libldap2-dev \
             libsasl2-dev \
-            python3-lxml \
-            zlib1g-dev \
-            libxslt1-dev \
             pkg-config \
-            gcc \
-            libssl-dev \
-            libxml2-dev
+            gcc
 
       - name: Install Python Dependencies
         run: |
-          python -m pip install --upgrade pip setuptools wheel
-          pip install -r conf/requirements.txt
-          if [ -f dev/requirements.txt ]; then pip install -r dev/requirements.txt; fi
+          python -m pip install --upgrade pip setuptools
+          pip install -r dev/requirements.txt
 
       - name: Configure WebVirtCloud Settings
         run: |
@@ -53,14 +50,44 @@ jobs:
           SECRET_KEY=$(python -c 'import secrets; print(secrets.token_urlsafe(50))')
           sed -i "s|^SECRET_KEY = .*|SECRET_KEY = \"${SECRET_KEY}\"|" webvirtcloud/settings.py
 
+      - name: Check For Missing Migrations
+        run: python manage.py makemigrations --check --dry-run
+
       - name: Run Django Migrations
-        run: |
-          python manage.py migrate --noinput
+        run: python manage.py migrate --noinput
 
-      - name: Run Django Test Suite
-        run: |
-          python manage.py test
+      # Includes the vrtManager tests
+      - name: Run Test Suite
+        run: python manage.py test
 
-      - name: Run vrtManager Unit Tests
+      - name: Validate OpenAPI Schema
+        run: python manage.py spectacular --validate --fail-on-warn --file /dev/null
+
+      # Security warnings (HSTS, secure cookies) depend on the deployment;
+      # gate on errors only.
+      - name: Deployment Checks
+        run: python manage.py check --deploy --fail-level ERROR
+
+      # The ignored IDs are Django 4.2.30 advisories, fixed in Django 5.2.17.
+      # Remove them with the Django 5.2 upgrade.
+      - name: Audit Installed Packages
         run: |
-          python -m unittest discover -s vrtManager -p "test_*.py"
+          pip-audit \
+            --ignore-vuln PYSEC-2026-198 \
+            --ignore-vuln PYSEC-2026-199 \
+            --ignore-vuln PYSEC-2026-201 \
+            --ignore-vuln PYSEC-2026-2090 \
+            --ignore-vuln PYSEC-2026-2091 \
+            --ignore-vuln PYSEC-2026-2092 \
+            --ignore-vuln PYSEC-2026-3717 \
+            --ignore-vuln PYSEC-2026-4035
+
+  docker:
+    name: Docker Image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Build Image
+        run: docker build -t webvirtcloud:ci .

Dockerfile

@@ -16,8 +16,6 @@ RUN apt-get update -qqy \
 	python3-venv \
 	python3-pip \
 	python3-dev \
-	python3-lxml \
-	python3-libvirt \
 	libvirt-dev \
 	zlib1g-dev \
 	nginx \
@@ -32,10 +30,10 @@ RUN apt-get update -qqy \
 # Setup webvirtcloud
 WORKDIR /srv/webvirtcloud
 
-# Install Python dependencies first with system-site-packages to leverage prebuilt bindings
+# Install Python dependencies first; libvirt-python and python-ldap build from source
 COPY conf/requirements.txt conf/requirements.txt
 # hadolint ignore=DL3013,DL3042,SC1091
-RUN python3 -m venv --system-site-packages venv && \
+RUN python3 -m venv venv && \
 	. venv/bin/activate && \
 	pip3 install --no-cache-dir -U pip wheel && \
 	pip3 install --no-cache-dir -r conf/requirements.txt

README.md

@@ -1,7 +1,7 @@
 [![Gitpod ready-to-code](https://img.shields.io/badge/Gitpod-ready--to--code-blue?logo=gitpod)](https://gitpod.io/#https://github.com/retspen/webvirtcloud)
 
 # WebVirtCloud
-###### Python >=3.10 & Django 4.2 LTS (tested on Python 3.10 – 3.12)
+###### Python >=3.10 & Django 4.2 LTS (tested on Python 3.10 – 3.13)
 
 ## Purpose and Scope
 
@@ -436,13 +436,12 @@ Use the same virtualenv as in [Local Development Setup](#local-development-setup
 source .venv/bin/activate
 ```
 
-### 2. Run Test Suite
+### 2. Run Test Suite and Linter
 ```bash
-# Run Django test suite (accounts, admin, instances, logs, etc.):
+# All tests, including vrtManager:
 python manage.py test
 
-# Run vrtManager unit tests:
-python -m unittest discover -s vrtManager -p "test_*.py"
+ruff check .
 ```
 
 > **Live Hypervisor Testing (Optional):**

conf/requirements.txt

@@ -12,7 +12,7 @@ eventlet==0.41.2
 gunicorn==26.2.0
 libsass==0.23.0
 libvirt-python>=9.0.0
-lxml>=4.9.0
+lxml>=6.1
 ldap3==2.9.1
 markdown==3.10
 paramiko==5.0.0

dev/requirements.txt

@@ -7,3 +7,5 @@ pyflakes==4.0.0
 pylint==4.0.9
 yapf==0.43.0
 black==26.5.1
+pip-audit==2.10.1
+ruff==0.16.10