parsons/.github/workflows/python-checks.yml at 22da32aa003d49ee368496efa1ba78b49656f977 · move-coop/parsons · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
name: Python checks

on:
    push:
        branches: ["main", "major-release"]
    pull_request:
    workflow_dispatch:

permissions:
    contents: read

jobs:
    test:
        strategy:
            fail-fast: false
            matrix:
                python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
                os: ["ubuntu-latest", "windows-latest", "macos-latest"]
                limited-dependencies: ["", "TRUE"]

        runs-on: ${{ matrix.os }}

        permissions:
            contents: write

        steps:
            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

            - name: Set up Python ${{ matrix.python-version }}
              uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
              with:
                  python-version: ${{ matrix.python-version }}

            - name: Install uv
              uses: install-pinned/uv@b9511b633710c8bbe8ba48376771dba624746799  # 0.4.12

            - name: Install dependencies
              env:
                  PARSONS_LIMITED_DEPENDENCIES: ${{ matrix.limited-dependencies }}
              run: |
                uv pip install --system -e .[all]
                uv pip install --system -r requirements-dev.txt

            - name: Test with pytest
              run: |
                pytest
              env:
                  COVERAGE_FILE: ".coverage.${{ matrix.os }}.${{ matrix.python-version }}${{ matrix.limited-dependencies }}"

            - name: Store coverage file
              uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
              with:
                  name: coverage-${{ matrix.os }}${{ matrix.python-version }}${{ matrix.limited-dependencies }}
                  path: .coverage.${{ matrix.os }}.${{ matrix.python-version }}${{ matrix.limited-dependencies }}
                  include-hidden-files: true

    ruff-format:
        runs-on: ubuntu-latest

        steps:
            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

            - name: Set up Python 3.13
              uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
              with:
                  python-version: "3.13"

            - name: Install uv
              uses: install-pinned/uv@b9511b633710c8bbe8ba48376771dba624746799  # 0.4.12

            - name: Install dependencies
              run: |
                uv pip install --system -r requirements-dev.txt

            - name: Run ruff format
              run: |
                ruff format --diff --target-version=py39 .

    ruff-check:
        runs-on: ubuntu-latest

        steps:
            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

            - name: Set up Python 3.13
              uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
              with:
                  python-version: "3.13"

            - name: Install uv
              uses: install-pinned/uv@b9511b633710c8bbe8ba48376771dba624746799  # 0.4.12

            - name: Install dependencies
              run: |
                uv pip install --system -r requirements-dev.txt

            - name: Run ruff
              run: |
                ruff check --output-format=github .

    bandit:
        runs-on: ubuntu-latest

        steps:
            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

            - name: Set up Python 3.13
              uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
              with:
                  python-version: "3.13"

            - name: Install uv
              uses: install-pinned/uv@b9511b633710c8bbe8ba48376771dba624746799  # 0.4.12

            - name: Install bandit
              run: |
                uv pip install --system -r requirements-dev.txt

            - name: Run bandit scan
              run: |
                bandit -c pyproject.toml -r . -ll -ii

    coverage:
        runs-on: ubuntu-latest
        needs: test

        permissions:
            pull-requests: write
            contents: write

        steps:
            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

            - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
              id: download
              with:
                  pattern: coverage-*
                  merge-multiple: true

            - name: Coverage comment
              id: coverage_comment
              uses: py-cov-action/python-coverage-comment-action@b2eb38dd175bf053189b35f738f9207278b00925  # v3.29
              with:
                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                  MERGE_COVERAGE_FILES: true

            - name: Store Pull Request comment to be posted
              uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
              if: steps.coverage_comment.outputs.COMMENT_FILE_WRITTEN == 'true'
              with:
                  name: python-coverage-comment-action
                  path: python-coverage-comment-action.txt

    pip-install:
        strategy:
            fail-fast: false
            matrix:
                python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
                os: ["ubuntu-latest", "windows-latest", "macos-latest"]
                limited-dependencies: ["", "TRUE"]

        runs-on: ${{ matrix.os }}

        steps:
            - name: Harden Runner
              uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
              with:
                  egress-policy: audit

            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

            - name: Set up Python ${{ matrix.python-version }}
              uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
              with:
                  python-version: ${{ matrix.python-version }}
                  cache: pip

            - name: Install dependencies
              env:
                  PARSONS_LIMITED_DEPENDENCIES: ${{ matrix.limited-dependencies }}
              run: |
                  pip install -r requirements-dev.txt
                  pip install -e .[all]