Skip to content

Support Python 3.14 #2027

Support Python 3.14

Support Python 3.14 #2027

Workflow file for this run

name: Python checks
on:
workflow_dispatch:
pull_request:
push:
branches:
- main
- major-release
schedule:
- cron: 0 0 * * 1
permissions: read-all
jobs:
pytest:
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
python-version:
- '3.10'
- '3.11'
- '3.12'
- '3.13'
- '3.14'
os:
- ubuntu-latest
- windows-latest
- macos-latest
resolution:
- highest
- lowest-direct
- limited-dependencies
permissions:
contents: write
steps:
- uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9
with:
disable-sudo: true
egress-policy: audit
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
with:
python-version: ${{ matrix.python-version }}
cache: pip
- uses: install-pinned/uv@259f91feb61b6e94766d7a1dbcd5f17335370e64
- if: matrix.resolution != 'limited-dependencies'
run: |
uv pip install --system --resolution ${{ matrix.resolution }} -e .[all]
uv pip install --system --resolution ${{ matrix.resolution }} -r requirements-dev.txt
- if: matrix.resolution == 'limited-dependencies'
env:
PARSONS_LIMITED_DEPENDENCIES: 'TRUE'
run: |
uv pip install --system -e .[all]
uv pip install --system -r requirements-dev.txt
- id: cache-pytest
uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7
with:
path: .pytest_cache
key: pytest-${{ matrix.python-version }}-${{ matrix.os }}-${{ matrix.resolution }}-${{ hashFiles('pyproject.toml') }}
- run: pytest
env:
COVERAGE_FILE: ".coverage.${{ matrix.os }}.${{ matrix.python-version }}.${{ matrix.resolution }}"
- uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
with:
name: coverage-${{ matrix.os }}-${{ matrix.python-version }}-${{ matrix.resolution }}
path: .coverage.${{ matrix.os }}.${{ matrix.python-version }}.${{ matrix.resolution }}
include-hidden-files: true
ruff-format:
runs-on: ubuntu-latest
steps:
- uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9
with:
disable-sudo: true
egress-policy: block
allowed-endpoints: >
files.pythonhosted.org:443
github.com:443
pypi.org:443
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
with:
python-version: 3.13
cache: pip
- uses: install-pinned/uv@259f91feb61b6e94766d7a1dbcd5f17335370e64
- run: uv pip install --system -r requirements-dev.txt
- id: cache-ruff
uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7
with:
path: .ruff_cache
key: ruff-${{ hashFiles('pyproject.toml') }}
- id: run-ruff
run: ruff format --diff .
ruff-check:
runs-on: ubuntu-latest
permissions:
security-events: write
steps:
- uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9
with:
disable-sudo: true
egress-policy: block
allowed-endpoints: >
api.github.com:443
files.pythonhosted.org:443
github.com:443
pypi.org:443
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
with:
python-version: 3.13
cache: pip
- uses: install-pinned/uv@259f91feb61b6e94766d7a1dbcd5f17335370e64
- run: uv pip install --system -r requirements-dev.txt
- id: cache-ruff
uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7
with:
path: .ruff_cache
key: ruff-${{ hashFiles('pyproject.toml') }}
- id: run-ruff-sarif
run: |
ruff check --output-format=sarif -o results.sarif .
- uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89
if: ( success() || failure() ) && contains('["success", "failure"]', steps.run-ruff-sarif.outcome)
with:
sarif_file: results.sarif
- id: run-ruff
if: failure() && contains('["failure"]', steps.run-ruff-sarif.outcome)
run: |
ruff check --output-format=github .
bandit:
runs-on: ubuntu-latest
permissions:
security-events: write
steps:
- uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9
with:
disable-sudo: true
egress-policy: block
allowed-endpoints: >
api.github.com:443
files.pythonhosted.org:443
github.com:443
pypi.org:443
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
with:
python-version: 3.13
cache: pip
- uses: install-pinned/uv@259f91feb61b6e94766d7a1dbcd5f17335370e64
- run: uv pip install --system -r requirements-dev.txt
- id: run-bandit-sarif
run: |
bandit --confidence-level 'medium' --severity-level 'medium' --recursive 'parsons' --exclude '**/vendor/*' --format 'sarif' --output 'results.sarif'
- uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89
if: ( success() || failure() ) && contains('["success", "failure"]', steps.run-bandit-sarif.outcome)
with:
sarif_file: results.sarif
- id: run-bandit
if: failure() && contains('["failure"]', steps.run-bandit-sarif.outcome)
run: |
bandit --confidence-level 'medium' --severity-level 'medium' --recursive 'parsons' --exclude '**/vendor/*'
coverage:
runs-on: ubuntu-latest
needs: pytest
permissions:
pull-requests: write
contents: write
steps:
- uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9
with:
disable-sudo: true
egress-policy: block
allowed-endpoints: >
api.github.com:443
github.com:443
img.shields.io:443
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
- uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
with:
pattern: coverage-*
merge-multiple: true
- id: coverage_comment
uses: py-cov-action/python-coverage-comment-action@7188638f871f721a365d644f505d1ff3df20d683
with:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
MERGE_COVERAGE_FILES: true
- uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
if: steps.coverage_comment.outputs.COMMENT_FILE_WRITTEN == 'true'
with:
name: python-coverage-comment-action
path: python-coverage-comment-action.txt
pre-commit:
runs-on: ubuntu-latest
needs:
- ruff-format
- ruff-check
- bandit
permissions:
contents: write
steps:
- uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9
with:
disable-sudo: true
egress-policy: block
allowed-endpoints: >
files.pythonhosted.org:443
github.com:443
proxy.golang.org:443
pypi.org:443
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
with:
python-version: 3.13
cache: pip
- uses: install-pinned/uv@259f91feb61b6e94766d7a1dbcd5f17335370e64
- run: uv pip install --system -r requirements-dev.txt
- id: cache-pre-commit
uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7
with:
path: .pre-commit-cache
key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}-${{ hashFiles('pyproject.toml') }}
- run: |
pre-commit install
pre-commit run --all-files
env:
PRE_COMMIT_HOME: .pre-commit-cache