earthaccess/.github/workflows/integration-test.yml at c8946f933969f4233a4a233a5f8a23ae9328f2fd · earthaccess-dev/earthaccess · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
name: Integration Tests

on:
  push:
    branches:
      - main
    paths:
      - .github/workflows/integration-test*.yml
      - earthaccess/**
      - scripts/integration-test.sh
      - tests/**
      - pyproject.toml
  pull_request:
    branches:
      - main
    paths:
      - .github/workflows/integration-test*.yml
      - earthaccess/**
      - scripts/integration-test.sh
      - tests/**
      - pyproject.toml
  pull_request_target:
    branches:
      - main
    paths:
      - .github/workflows/integration-test*.yml
      - earthaccess/**
      - scripts/integration-test.sh
      - tests/**
      - pyproject.toml

# When this workflow is queued, automatically cancel any previous running
# or pending jobs from the same branch
concurrency:
  group: integration-tests-${{ github.ref }}
  cancel-in-progress: true

jobs:
  integration-tests:
    #
    # This condition prevents DUPLICATE attempts to run integration tests for
    # PRs coming from FORKS.
    #
    # When a PR originates from a fork, both a pull_request and a
    # pull_request_target event are triggered.  This means that without a
    # condition, GitHub will attempt to run integration tests TWICE, once for
    # each event.
    #
    # To prevent this, this condition ensures that integration tests are run
    # in only ONE of the following cases:
    #
    #   1. The event is NOT a pull_request (it's a pull_request_target) and the base
    #      repo is NOT the head repo (i.e., the PR is from a fork).
    #   2. The event IS a pull_request AND the base repo IS the head repo
    #      (i.e., the PR is not from a fork).
    #
    if: (github.event_name != 'pull_request') == github.event.pull_request.head.repo.fork
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - python-version: 3.12
            # We must save the PR number only once, and this also prevents
            # "duplicate artifact" errors caused when attempting to save the same
            # artifact for every python version we're running with.  More specifically,
            # save-pr-number must be set to 'true' for 1 (and only 1) matrix combo
            # (it doesn't matter which combo).
            save-pr-number: true
          - python-version: 3.13
            save-pr-number: false
      fail-fast: false

    steps:
      # The first 2 steps will save the PR number to a file and upload the file as an
      # artifact, which we can then download if the workflow run fails (due to
      # insufficient permissions), which is handled in integration-test-review.yml.
      # See https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#using-data-from-the-triggering-workflow
      - name: Save PR number
        if: matrix.save-pr-number
        env:
          PR_NUMBER: ${{ github.event.number }}
        run: |
          mkdir -p ./pr
          echo $PR_NUMBER > ./pr/pr_number

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: matrix.save-pr-number
        with:
          path: pr/
          name: pr_number

      - name: Fetch user permission
        if: github.event_name == 'pull_request_target'
        id: permission
        uses: actions-cool/check-user-permission@c21884f3dda18dafc2f8b402fe807ccc9ec1aa5e # v2
        with:
          require: write
          username: ${{ github.triggering_actor }}

      - name: Check user permission
        # The name of the output require-result is a bit confusing, but when its value
        # is 'false', it means that the triggering actor does NOT have the required
        # permission.
        if: github.event_name == 'pull_request_target' && steps.permission.outputs.require-result == 'false'

        # If the triggering actor does not have write permission (i.e., this is a
        # PR from a fork), then we exit, otherwise most of the integration tests will
        # fail because they require access to secrets.  In this case, a maintainer
        # will need to make sure the PR looks safe, and if so, manually re-run the
        # failed pull_request_target jobs.
        run: |
          echo "User **${{ github.triggering_actor }}** does not have permission to run integration tests." >> $GITHUB_STEP_SUMMARY
          echo "A maintainer must perform a security review and re-run this build, if the code is safe." >> $GITHUB_STEP_SUMMARY
          echo "See [Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/resources/github-actions-preventing-pwn-requests)." >> $GITHUB_STEP_SUMMARY
          exit 1

      - name: Checkout source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # Getting the correct commit for a pull_request_target event appears to be
          # a known, problematic issue: https://github.com/actions/checkout/issues/518
          # It seems that ideally, we want github.event.pull_request.merge_commit_sha,
          # but that it is not reliable, and can sometimes be a null values.  It
          # appears that the most reasonable way to ensure that we are pulling the same
          # code that triggered things is shown in this issue comment:
          # https://github.com/actions/checkout/issues/518#issuecomment-1661941548
          # However, attempts to get that working resulted in getting an empty
          # github.event.number, so we're resorting to this simpler approach, which
          # is apparently less than ideal, but seems to be the best we can muster at
          # this point.
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false
          # The previous step will exit with failure if the user does not have
          # appropriate permissions, so only a maintainer can reach this step.
          # Thus, an "unsafe PR checkout" should be safe, but this does REQUIRE
          # a maintainer to deem the contributor's changes are safe BEFORE
          # rerunning the failed (due to lack of permissions) integration tests.
          # (This input was added to the checkout action v7, and defaults to
          # false, so we must explicitly set it to true.)
          allow-unsafe-pr-checkout: true

      - name: Install package with dependencies
        uses: ./.github/actions/install-pkg
        with:
          python-version: ${{ matrix.python-version }}
          cache-key: integration

      - name: Run integration tests
        env:
          EARTHDATA_USERNAME: ${{ secrets.EDL_USERNAME }}
          EARTHDATA_PASSWORD: ${{ secrets.EDL_PASSWORD }}
        run: |
          # -rxXs: Show provided (r)eason in summary for (x)fail, (X)pass, and (s)kipped tests
          uv run pytest tests/integration \
            -rxXs \
            --cov=earthaccess \
            --cov-report=term-missing \
            --capture=no \
            --color=yes \
            --tb=native \
            --log-cli-level=INFO

      - name: Upload coverage report
        # Don't upload coverage when using the `act` tool to run the workflow locally
        if: ${{ !env.ACT }}
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0