release: prepare v0.1.5 with coverage and docs updates #304
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| workflow_dispatch: | |
| jobs: | |
| test-and-static-checks: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.10" | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| python -m pip install -r requirements.txt | |
| python -m pip install -r requirements-dev.txt | |
| - name: Run formatting with black | |
| run: python -m black src tests scripts | |
| - name: Verify formatting with black | |
| run: python -m black --check src tests scripts | |
| - name: Lint with ruff | |
| run: python -m ruff check src tests scripts | |
| - name: Type check with mypy | |
| run: python -m mypy src | |
| - name: Compile Python sources | |
| run: python -m compileall -q src tests scripts | |
| - name: Run Python security scanner | |
| run: python -m bandit -r src -q --severity-level medium --confidence-level high | |
| - name: Run dependency vulnerability audit | |
| run: python -m pip_audit -r requirements.txt | |
| - name: Run unit tests with coverage and enforce threshold | |
| run: | | |
| python -m coverage erase | |
| python -m coverage run --source=src -m unittest discover -s tests | |
| python -m coverage run --append --source=src -m unittest discover -s tests_optional | |
| python -m coverage report -m | |
| python -m coverage report --fail-under=70 | |
| - name: Check claims coverage | |
| run: | | |
| python scripts/check_claims_coverage.py \ | |
| --claims-file docs/CLAIMS.md \ | |
| --tests-dir tests \ | |
| --output /tmp/phasmid-release/claims_coverage.json \ | |
| --max-unverified 8 | |
| - name: Generate release review artifacts | |
| run: python scripts/generate_release_artifacts.py --output-dir /tmp/phasmid-release --archive | |
| - name: Upload release review artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: phasmid-release-review | |
| path: /tmp/phasmid-release | |
| optional-test-profile: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.10" | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| python -m pip install -r requirements.txt | |
| python -m pip install -r requirements-dev.txt | |
| - name: Run optional test profile | |
| run: python -m unittest discover -s tests_optional | |
| reproducible-build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.10" | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| python -m pip install -r requirements.txt | |
| python -m pip install -r requirements-dev.txt | |
| - name: Build artifacts twice and compare hashes | |
| run: | | |
| export SOURCE_DATE_EPOCH=1700000000 | |
| python scripts/generate_release_artifacts.py --output-dir /tmp/repro-a --archive | |
| python scripts/generate_release_artifacts.py --output-dir /tmp/repro-b --archive | |
| sha256sum /tmp/repro-a/MANIFEST.sha256 /tmp/repro-a/sbom.cyclonedx.json /tmp/repro-a/release-summary.json /tmp/repro-a/phasmid-release.tar.gz | awk '{print $1}' > /tmp/repro-a.sha | |
| sha256sum /tmp/repro-b/MANIFEST.sha256 /tmp/repro-b/sbom.cyclonedx.json /tmp/repro-b/release-summary.json /tmp/repro-b/phasmid-release.tar.gz | awk '{print $1}' > /tmp/repro-b.sha | |
| diff -u /tmp/repro-a.sha /tmp/repro-b.sha | |
| archive-review-tests: | |
| if: github.event_name == 'workflow_dispatch' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.10" | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| python -m pip install -r requirements.txt | |
| python -m pip install -r requirements-dev.txt | |
| - name: Run archive-review test profile | |
| run: python -m unittest discover -s tests_archive_review |