reflake/.github/workflows/ci.yml at 56f626b239f4f3bb5df305dd5a5cdd3dc8717435 · londogard/reflake · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
name: CI

on:
    push:
    pull_request:

jobs:
    test-and-build:
        runs-on: ubuntu-latest

        steps:
            - name: Check out repository
              uses: actions/checkout@v4

            - name: Set up Python
              uses: actions/setup-python@v5
              with:
                  python-version: "3.12"

            - name: Set up uv
              uses: astral-sh/setup-uv@v4

            - name: Install dependencies
              run: uv sync --group dev

            - name: Reject macOS junk files
              run: |
                  if git ls-files | grep -E '(^__MACOSX/|(^|/)\.DS_Store$|(^|/)\._)'; then
                    echo "Remove macOS archive/junk files before merging."
                    exit 1
                  fi

            - name: Run non-integration tests
              run: uv run pytest tests -m "not integration"

            - name: Smoke-test CLI help
              run: uv run dataref --help

            - name: Build package
              run: uv build

            - name: Clean-tree check
              run: |
                  if [ -n "$(git status --porcelain)" ]; then
                    echo "Working tree is dirty after build:"
                    git status
                    git diff
                    exit 1
                  fi

            - name: Upload wheel artifact
              uses: actions/upload-artifact@v4
              with:
                  name: wheel
                  path: dist/*.whl
                  if-no-files-found: error

    s3-integration:
        runs-on: ubuntu-latest

        steps:
            - name: Check out repository
              uses: actions/checkout@v4

            - name: Set up Python
              uses: actions/setup-python@v5
              with:
                  python-version: "3.12"

            - name: Set up uv
              uses: astral-sh/setup-uv@v4

            - name: Install dependencies
              run: uv sync --group dev

            - name: Run S3 integration tests against MiniStack
              run: bash scripts/run_s3_integration.sh

    isolated-install-smoke:
        needs: [test-and-build]
        runs-on: ubuntu-latest

        steps:
            - name: Set up Python
              uses: actions/setup-python@v5
              with:
                  python-version: "3.12"

            - name: Download wheel artifact
              uses: actions/download-artifact@v4
              with:
                  name: wheel
                  path: dist

            - name: Isolated install and smoke
              run: |
                  set -euo pipefail
                  WHEEL=$(ls dist/*.whl | head -1)
                  python -m venv /tmp/smoke-venv
                  /tmp/smoke-venv/bin/pip install "$WHEEL"
                  echo "=== dataref --help ==="
                  /tmp/smoke-venv/bin/dataref --help
                  echo "=== dataref --version ==="
                  /tmp/smoke-venv/bin/dataref --version 2>/dev/null || true
                  echo "=== basic commit smoke ==="
                  TMPDIR=$(mktemp -d)
                  echo "smoke-test-content" > "$TMPDIR/smoke.txt"
                  /tmp/smoke-venv/bin/dataref commit --repo "$TMPDIR" -m "smoke" > /dev/null
                  echo "Isolated install smoke test passed."

    release-gate:
        if: startsWith(github.ref, 'refs/tags/v')
        needs: [test-and-build, s3-integration, isolated-install-smoke]
        runs-on: ubuntu-latest
        permissions:
            id-token: write  # OIDC -> PyPI trusted publishing (no API token)
            contents: read

        steps:
            - name: Check out repository
              uses: actions/checkout@v4

            - name: Set up Python
              uses: actions/setup-python@v5
              with:
                  python-version: "3.12"

            - name: Set up uv
              uses: astral-sh/setup-uv@v4

            - name: Verify tag matches package version
              run: |
                  set -euo pipefail
                  TAG_VERSION="${GITHUB_REF_NAME#v}"
                  PACKAGE_VERSION="$(sed -n 's/^version = "\(.*\)"/\1/p' pyproject.toml)"
                  if [ "$TAG_VERSION" != "$PACKAGE_VERSION" ]; then
                    echo "Tag ${GITHUB_REF_NAME} does not match pyproject version ${PACKAGE_VERSION}" >&2
                    exit 1
                  fi
                  echo "Releasing dataref ${PACKAGE_VERSION}"

            - name: Build package
              run: uv build

            - name: Publish to PyPI
              run: uv publish --publish-url https://upload.pypi.org/legacy/ --check-url https://pypi.org/pypi/dataref/json