chore(deps): update github/codeql-action action to v4.37.5 (#295) #1211
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Python checks | |
| on: | |
| push: | |
| branches: [ "main" ] | |
| tags: [v*] | |
| pull_request: | |
| merge_group: | |
| env: | |
| FORCE_COLOR: 1 | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| permissions: {} | |
| jobs: | |
| linting: | |
| runs-on: ubuntu-latest | |
| name: "Python linting" | |
| permissions: | |
| contents: read | |
| env: | |
| UV_FROZEN: true | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Python 🐍 | |
| id: python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version-file: "pyproject.toml" | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 | |
| with: | |
| enable-cache: | # zizmor: ignore[cache-poisoning] cache is disabled when publishing to prevent poisoning | |
| ${{ github.ref_type == 'tag' && 'false' || 'auto' }} | |
| cache-dependency-glob: "uv.lock" | |
| python-version: ${{ steps.python.outputs.python-path }} | |
| activate-environment: true | |
| - name: Check lock is up-to-date | |
| run: | | |
| uv lock --check | |
| - name: Install dependencies | |
| run: | | |
| uv sync | |
| - name: Check file formatting | |
| uses: astral-sh/ruff-action@278981a28ce3188b1e39527901f38254bf3aac89 # v4.1.0 | |
| with: | |
| args: "format --check" | |
| - name: Lint with ruff | |
| env: | |
| RUFF_OUTPUT_FORMAT: github | |
| run: | | |
| ruff check | |
| - name: Typecheck with pyright | |
| uses: jakebailey/pyright-action@8ec14b5cfe41f26e5f41686a31eb6012758217ef # v3.0.2 | |
| with: | |
| version: PATH | |
| tests: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: ["ubuntu-latest", "windows-latest", "macos-latest"] | |
| python-version: ["3.11", "3.12", "3.13", "3.14"] | |
| include: | |
| - extras_best_effort: false # If True, try to install each extra separately and skip those that fail to install | |
| skip_extras: '' # JSON array of extras not to install | |
| - os: windows-latest | |
| extras_best_effort: true | |
| - os: ubuntu-latest | |
| # cvxopt 1.3.3 wheels for Linux are bundled with GLPK 4.65, which | |
| # has a known bug, see | |
| # https://github.com/cvxopt/cvxopt-wheels/issues/8 | |
| skip_extras: '["glpk-mi"]' | |
| name: Python tests (${{ matrix.python-version }}, ${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| permissions: | |
| contents: read | |
| id-token: write # needed for the codecov actions to obtain a OIDC token | |
| env: | |
| UV_FROZEN: true | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Python ${{ matrix.python-version }} 🐍 | |
| id: python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 | |
| with: | |
| enable-cache: | # zizmor: ignore[cache-poisoning] cache is disabled when publishing to prevent poisoning | |
| ${{ github.ref_type == 'tag' && 'false' || 'auto' }} | |
| cache-dependency-glob: "uv.lock" | |
| python-version: ${{ steps.python.outputs.python-path }} | |
| - name: Install dependencies | |
| run: uv sync | |
| - name: Install additional backends | |
| if: ${{ ! matrix.extras_best_effort && matrix.skip_extras == '' }} | |
| run: uv sync --all-extras | |
| - name: Install additional backends (best effort) | |
| if: ${{ matrix.extras_best_effort || matrix.skip_extras != '' }} | |
| env: | |
| NO_COLOR: 1 | |
| SKIP_EXTRAS: ${{ matrix.skip_extras && matrix.skip_extras || '[]' }} | |
| shell: bash | |
| run: | | |
| set -eu -o pipefail | |
| EXTRAS=$( | |
| # for each extra, output the extra name followed by the listed dependencies, space-separated | |
| # This pins hatch to 1.15 or older to work around pypa/hatch#2118, and | |
| # virtualenv 20.x or older, to work around pypa/hatch#2193. | |
| uvx --from 'hatch<1.16' --with 'virtualenv<21' hatch project metadata \ | |
| | jq --raw-output '."optional-dependencies" | to_entries[] | "\(.key) \(.value | join(" "))"' | |
| ) | |
| while read -r -a extra_deps; do | |
| extra_name="${extra_deps[0]}" | |
| if jq --exit-status --null-input --argjson skip_extras "${SKIP_EXTRAS}" --arg extra "${extra_name}" \ | |
| '$skip_extras | contains([$extra])' > /dev/null; | |
| then | |
| echo "NOT installing $extra_name backend" | |
| continue | |
| fi | |
| deps=("${extra_deps[@]:1}") | |
| echo "::group::Installing $extra_name backend" | |
| uv pip install "${deps[@]}" \ | |
| || IFS=' ' echo "::warning title=Could not install $extra_name solver backend::Failed to install ${deps[*]}" | |
| echo "::endgroup::" | |
| done <<< "$EXTRAS" | |
| - name: Test with pytest | |
| run: | | |
| # codecov requires that the test results are shared in xunit1 / legacy format. | |
| uv run pytest -v --junitxml=junit.xml -o junit_family=legacy | |
| - name: Upload coverage reports to Codecov | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 | |
| with: | |
| use_oidc: true | |
| - name: Upload test results to Codecov | |
| if: ${{ !cancelled() }} | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 | |
| with: | |
| report_type: test_results | |
| use_oidc: true | |
| test-summary: | |
| name: Test matrix status | |
| runs-on: ubuntu-latest | |
| needs: | |
| - linting | |
| - tests | |
| if: always() | |
| steps: | |
| - name: Decide whether the needed jobs succeeded or failed | |
| env: | |
| SUCCEEDED: ${{ !(contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped')) }} | |
| run: | | |
| echo "All jobs passed: ${SUCCEEDED}" | |
| if [ "${SUCCEEDED}" = 'false' ]; then exit 1; fi | |
| build: | |
| name: Build distribution 📦 | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| env: | |
| UV_FROZEN: true | |
| if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags') | |
| needs: | |
| - test-summary | |
| outputs: | |
| version: ${{ steps.note.outputs.version }} | |
| prerelease: ${{ steps.note.outputs.prerelease }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Python 🐍 | |
| id: python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version-file: "pyproject.toml" | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 | |
| with: | |
| enable-cache: false | |
| cache-dependency-glob: "uv.lock" | |
| python-version: ${{ steps.python.outputs.python-path }} | |
| - name: Build the Python 🐍 binary wheel and source tarball 📦 | |
| id: build-dist | |
| run: | | |
| uv build | |
| rm -f dist/.gitignore # get-releasenotes can't handle non-dist files here | |
| echo "version=$(uvx hatch version)" >> "$GITHUB_OUTPUT" | |
| - name: Check build | |
| run: uvx twine check --strict dist/* | |
| - name: Prepare Release Note | |
| id: note | |
| uses: aio-libs/get-releasenote@b0fcc7f3e5f5cc7c8b01e2f75516b1732f6bd8b2 # v1.4.5 | |
| with: | |
| changes_file: CHANGELOG.md | |
| output_file: release_notes.md | |
| version: ${{ steps.build-dist.outputs.version }} | |
| start_line: '<!-- changes go below this line -->' | |
| head_line: '## \[{version}\] - {date}' | |
| name: Rummikub Solver library | |
| dist_dir: dist | |
| - name: Store the Python 🐍 distribution 📦 | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: python-package-distributions | |
| path: | | |
| dist/ | |
| release_notes.md | |
| pypi-publish: | |
| name: Upload release to PyPI | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags') | |
| needs: | |
| - build | |
| environment: | |
| name: pypi | |
| url: https://pypi.org/p/rummikub-solver | |
| permissions: | |
| id-token: write # IMPORTANT: this permission is mandatory for trusted publishing | |
| contents: write # required for creating GH releases | |
| steps: | |
| - name: Download Python 🐍 distribution 📦 | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: python-package-distributions | |
| - name: Publish Python 🐍 distribution 📦 to PyPI | |
| uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 | |
| - name: GitHub release | |
| env: | |
| RELEASE_TITLE: Rummikub Solver library ${{ needs.build.outputs.version }} | |
| PRERELEASE_SWITCH: ${{ case(fromJSON(needs.build.outputs.prerelease), '--prerelease', '') }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| run: gh release create --title "${RELEASE_TITLE}" --notes-file release_notes.md "${PRERELEASE_SWITCH}" "${GITHUB_REF_NAME}" dist/* |