chore(providers): onboarding prep — unblock Azure/GCP/OCI merges #1837
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Quality Checks | |
| on: | |
| push: | |
| branches: [ main, develop ] | |
| paths: | |
| - 'src/**' | |
| - 'tests/**' | |
| - 'pyproject.toml' | |
| - 'requirements*.txt' | |
| - 'uv.lock' | |
| - '.ruff.toml' | |
| - '.github/workflows/ci-quality.yml' | |
| pull_request: | |
| branches: [ main, develop ] | |
| paths: | |
| - 'src/**' | |
| - 'tests/**' | |
| - 'pyproject.toml' | |
| - 'requirements*.txt' | |
| - 'uv.lock' | |
| - '.ruff.toml' | |
| - '.github/workflows/ci-quality.yml' | |
| # workflow_dispatch: allows re-running quality checks manually from the Actions UI | |
| workflow_dispatch: | |
| # Cancel in-progress runs when a new push arrives on the same branch/ref. | |
| # The auto-format job is exempted via its own job-level concurrency block | |
| # (cancel-in-progress: false) because it pushes a commit back to the branch — | |
| # cancelling it mid-push could leave the branch in a partially formatted state. | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| config: | |
| name: Configuration | |
| uses: ./.github/workflows/shared-config.yml | |
| setup-cache: | |
| name: Setup Cache | |
| needs: config | |
| uses: ./.github/workflows/cache-management.yml | |
| with: | |
| cache-type: dependencies | |
| cache-key-base: quality-deps | |
| python-version: ${{ needs.config.outputs.default-python-version }} | |
| auto-format: | |
| name: Auto-Format Code | |
| # Same-repo PRs only. Fork PRs handled by auto-format-suggest below. | |
| # Bot-actor guard prevents the job re-triggering on its own push. | |
| if: | | |
| github.event_name == 'pull_request' | |
| && github.event.pull_request.head.repo.full_name == github.repository | |
| && github.actor != 'open-resource-broker-cicd[bot]' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| needs: [config, setup-cache] | |
| # Override the workflow-level concurrency so this job is never cancelled | |
| # mid-run. If it were interrupted after `ruff` rewrites files but before | |
| # `git push`, the PR branch would be left in a half-formatted state. | |
| concurrency: | |
| group: ci-auto-format-${{ github.ref }} | |
| cancel-in-progress: false | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| ref: ${{ github.head_ref }} | |
| # See semantic-release.yml for the rationale - the App-token URL | |
| # set by the composite below must be the only credential source | |
| # so the auto-format push lands as the ORB CICD App rather than | |
| # falling back to github-actions[bot] via the persisted extraheader. | |
| persist-credentials: false | |
| - name: ORB CICD App token | |
| id: cicd | |
| uses: ./.github/actions/orb-cicd-app-token | |
| with: | |
| app-id: ${{ secrets.GH_APP_ID }} | |
| private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} | |
| - name: Setup UV with cache | |
| uses: ./.github/actions/setup-uv-cached | |
| with: | |
| cache-key: ${{ needs.setup-cache.outputs.cache-key }} | |
| fail-on-cache-miss: false | |
| - name: Auto-format code | |
| run: make format-fix | |
| - name: Commit formatting changes | |
| env: | |
| GIT_AUTHOR_NAME: ${{ steps.cicd.outputs.committer-name }} | |
| GIT_AUTHOR_EMAIL: ${{ steps.cicd.outputs.committer-email }} | |
| GIT_COMMITTER_NAME: ${{ steps.cicd.outputs.committer-name }} | |
| GIT_COMMITTER_EMAIL: ${{ steps.cicd.outputs.committer-email }} | |
| run: | | |
| git add . | |
| if ! git diff --staged --quiet; then | |
| git commit -m "style: auto-format code with ruff" | |
| git push | |
| fi | |
| auto-format-suggest: | |
| name: Auto-Format Suggestions | |
| # Fork PRs: post formatted changes as PR review suggestions for the | |
| # contributor to apply via the GitHub UI's "Commit suggestion" button. | |
| # Runs under plain pull_request (not pull_request_target) — reviewdog | |
| # action-suggester posts review comments via the GITHUB_TOKEN scoped to | |
| # pull-requests: write, which works for fork PRs without needing | |
| # pull_request_target's elevated context. pull_request_target is | |
| # deliberately avoided here: it would execute fork code with a write token | |
| # (pwn-request risk). | |
| if: >- | |
| github.event_name == 'pull_request' | |
| && github.event.pull_request.head.repo.full_name != github.repository | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| needs: [config, setup-cache] | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - name: Checkout PR head | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| persist-credentials: false | |
| - name: Setup UV with cache | |
| uses: ./.github/actions/setup-uv-cached | |
| with: | |
| cache-key: ${{ needs.setup-cache.outputs.cache-key }} | |
| fail-on-cache-miss: false | |
| - name: Run formatter | |
| run: make format-fix | |
| - name: Post review suggestions | |
| uses: reviewdog/action-suggester@2558ba17e65a9039e73764a73009fc05fef28a46 # v1.24.3 | |
| with: | |
| tool_name: ruff | |
| level: warning | |
| fail_on_error: false | |
| lint-ruff: | |
| name: Ruff (Code Quality) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| needs: [config, setup-cache] | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Setup UV with cache | |
| uses: ./.github/actions/setup-uv-cached | |
| with: | |
| cache-key: ${{ needs.setup-cache.outputs.cache-key }} | |
| fail-on-cache-miss: false | |
| - name: Check code quality | |
| run: make ci-quality-ruff | |
| lint-ruff-optional: | |
| name: Ruff (Extended Checks) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| needs: [config, setup-cache, lint-ruff] | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Setup UV with cache | |
| uses: ./.github/actions/setup-uv-cached | |
| with: | |
| cache-key: ${{ needs.setup-cache.outputs.cache-key }} | |
| fail-on-cache-miss: false | |
| - name: Extended linting (warnings) | |
| run: make ci-quality-ruff-optional | |
| continue-on-error: true | |
| lint-pyright: | |
| name: Type Checking (pyright) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| needs: [config, setup-cache, lint-ruff] | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Setup UV with cache | |
| uses: ./.github/actions/setup-uv-cached | |
| with: | |
| cache-key: ${{ needs.setup-cache.outputs.cache-key }} | |
| fail-on-cache-miss: false | |
| - name: Run pyright type check | |
| run: make ci-quality-pyright | |
| arch-validation: | |
| name: Architecture Validation | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| needs: [config, setup-cache, lint-ruff] | |
| permissions: | |
| contents: read | |
| strategy: | |
| matrix: | |
| check: [cqrs, clean, imports, file-sizes] | |
| include: | |
| - check: cqrs | |
| description: "CQRS Pattern Validation" | |
| - check: clean | |
| description: "Clean Architecture Dependencies" | |
| - check: imports | |
| description: "Import Validation" | |
| - check: file-sizes | |
| description: "File Size Compliance" | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Setup UV with cache | |
| uses: ./.github/actions/setup-uv-cached | |
| with: | |
| cache-key: ${{ needs.setup-cache.outputs.cache-key }} | |
| fail-on-cache-miss: false | |
| - name: Run architecture validation (${{ matrix.description }}) | |
| run: make ci-arch-${{ matrix.check }} | |
| python-version-drift: | |
| name: Python Version Drift Check | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| # Runs independently of lint to give early signal on version drift. | |
| # Only needs a checkout + pyyaml — no UV venv required. | |
| needs: config | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Install PyYAML | |
| run: pip install --quiet pyyaml | |
| - name: Check Python version drift | |
| run: make ci-check-python-version-drift |