python-checks.yml

name: Python checks

on:
  workflow_dispatch:
  pull_request:
  push:
    branches:
      - main
      - major-release
  schedule:
    - cron: 0 0 * * 1

permissions: read-all

env:
  CACHE_GLOBS: |
    **/pyproject.toml
    **/requirements*.txt
    **/setup.py
    **/uv.lock
  ENDPOINT_WHITELIST: >-
    pypi.org:443
    github.com:443
    files.pythonhosted.org:443
    *.github.com:443
    *.githubusercontent.com:443

jobs:
  pytest:
    runs-on: ${{ matrix.os }}

    strategy:
      fail-fast: false
      matrix:
        python-version:
          - '3.10'
          - '3.11'
          - '3.12'
          - '3.13'
        os:
          - ubuntu-latest
          - windows-latest
          - macos-latest
        resolution:
          - highest
          - lowest-direct
          - limited-dependencies

    permissions:
      contents: write

    steps:
      - uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            auth.docker.io:443
            files.pythonhosted.org:443
            github.com:443
            pypi.org:443
            raw.githubusercontent.com:443

      - run: |
          echo "\
          RUN_KEY=\
          ${{ hashFiles('pyproject.toml') }}-\
          ${{ matrix.os }}-\
          ${{ matrix.python-version }}-\
          ${{ matrix.resolution }}\
          " >> $GITHUB_ENV

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

      - uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098
        with:
          python-version: ${{ matrix.python-version }}
          activate-environment: true
          cache-dependency-glob: ${{ env.CACHE_GLOBS }}

      - run: |
          uv pip install -r requirements-dev.txt
          uv pip install .[all]
        env:
          UV_RESOLUTION: ${{ matrix.resolution == 'limited-dependencies' && 'highest' || matrix.resolution }}
          PARSONS_LIMITED_DEPENDENCIES: ${{ matrix.resolution == 'limited-dependencies' && 'TRUE' || 'FALSE' }}

      - id: cache-pytest
        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306
        with:
          path: .pytest_cache
          key: pytest-${{ env.RUN_KEY }}

      - run: pytest
        env:
          COVERAGE_FILE: .coverage.${{ env.RUN_KEY }}

      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
        with:
          name: coverage-${{ env.RUN_KEY }}
          path: .coverage.${{ env.RUN_KEY }}
          include-hidden-files: true

  pytest-extras-config:
    runs-on: ubuntu-latest

    outputs:
      extras: ${{ steps.get-extras.outputs.extras }}

    steps:
      - uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: ${{ env.ENDPOINT_WHITELIST}}

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

      - uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098
        with:
          python-version: '3.13'
          activate-environment: true
          cache-dependency-glob: ${{ env.CACHE_GLOBS }}

      - run: uv pip install -r requirements-dev.txt

      - name: get-extras
        id: get-extras
        env:
          PARSONS_LIMITED_DEPENDENCIES: 'TRUE'
        run: |
          python -c "
          import json
          from build.util import project_wheel_metadata
          from pathlib import Path

          metadata = project_wheel_metadata(Path('.'))
          extras = metadata.get_all('Provides-Extra') or []

          if 'all' in extras:
            extras.remove('all')

          print(json.dumps(extras))
          " > extras.json
          echo "extras=$(cat extras.json)" >> $GITHUB_OUTPUT

  pytest-extras:
    runs-on: ${{ matrix.os }}

    needs:
      - pytest-extras-config
      - pytest

    strategy:
      fail-fast: false
      matrix:
        extra: ${{ fromJson(needs.pytest-extras-config.outputs.extras) }}
        python-version: ['3.13']
        os: ['ubuntu-latest']
        resolution: ['highest']

    steps:
      - uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: ${{ env.ENDPOINT_WHITELIST}}

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

      - uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098
        with:
          python-version: ${{ matrix.python-version }}
          activate-environment: true
          cache-dependency-glob: ${{ env.CACHE_GLOBS }}

      - run: uv pip install -r requirements-dev.txt

      - run: uv pip install .[${{ matrix.extra }}]
        env:
            PARSONS_LIMITED_DEPENDENCIES: 'TRUE'

      - id: cache-pytest
        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306
        with:
          path: .pytest_cache
          key: pytest-${{ hashFiles('pyproject.toml') }}-${{ matrix.os }}-${{ matrix.python-version }}-${{ matrix.resolution }}

      - run: pytest test/test_${{ matrix.extra }}

  ruff-format:
    runs-on: ubuntu-latest

    steps:
      - uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: ${{ env.ENDPOINT_WHITELIST}}

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

      - uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098
        with:
          python-version: '3.13'
          activate-environment: true
          cache-dependency-glob: ${{ env.CACHE_GLOBS }}

      - run: uv pip install -r requirements-dev.txt

      - id: cache-ruff
        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306
        with:
          path: .ruff_cache
          key: ruff-${{ hashFiles('pyproject.toml') }}

      - id: run-ruff
        run: ruff format --diff .

  ruff-check:
    runs-on: ubuntu-latest

    permissions:
      security-events: write

    steps:
      - uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: ${{ env.ENDPOINT_WHITELIST}}

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

      - uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098
        with:
          python-version: '3.13'
          activate-environment: true
          cache-dependency-glob: ${{ env.CACHE_GLOBS }}

      - run: uv pip install -r requirements-dev.txt

      - id: cache-ruff
        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306
        with:
          path: .ruff_cache
          key: ruff-${{ hashFiles('pyproject.toml') }}

      - id: run-ruff-sarif
        run: ruff check --output-format=sarif -o results.sarif .

      - uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98
        if: ( success() || failure() ) && contains('["success", "failure"]', steps.run-ruff-sarif.outcome)
        with:
          sarif_file: results.sarif

      - id: run-ruff
        if: failure() && contains('["failure"]', steps.run-ruff-sarif.outcome)
        run: ruff check --output-format=github .

  bandit:
    runs-on: ubuntu-latest

    permissions:
      security-events: write

    steps:
      - uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: ${{ env.ENDPOINT_WHITELIST}}

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

      - uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098
        with:
          python-version: '3.13'
          activate-environment: true
          cache-dependency-glob: ${{ env.CACHE_GLOBS }}

      - run: uv pip install -r requirements-dev.txt

      - id: run-bandit-sarif
        run: |
          bandit --confidence-level 'medium' --severity-level 'medium' --recursive 'parsons' --exclude '**/vendor/*' --format 'sarif' --output 'results.sarif'

      - uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98
        if: ( success() || failure() ) && contains('["success", "failure"]', steps.run-bandit-sarif.outcome)
        with:
          sarif_file: results.sarif

      - id: run-bandit
        if: failure() && contains('["failure"]', steps.run-bandit-sarif.outcome)
        run: |
          bandit --confidence-level 'medium' --severity-level 'medium' --recursive 'parsons' --exclude '**/vendor/*'

  coverage:
    runs-on: ubuntu-latest

    needs:
      - pytest

    permissions:
      pull-requests: write
      contents: write

    steps:
      - uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: img.shields.io:443 ${{ env.ENDPOINT_WHITELIST}}

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

      - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3
        with:
          pattern: coverage-*
          merge-multiple: true

      - id: coverage_comment
        uses: py-cov-action/python-coverage-comment-action@7188638f871f721a365d644f505d1ff3df20d683
        with:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          MERGE_COVERAGE_FILES: true

      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
        if: steps.coverage_comment.outputs.COMMENT_FILE_WRITTEN == 'true'
        with:
          name: python-coverage-comment-action
          path: python-coverage-comment-action.txt

  pre-commit:
    runs-on: ubuntu-latest

    needs:
      - ruff-format
      - ruff-check
      - bandit

    permissions:
      contents: write

    steps:
      - uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: proxy.golang.org:443 ${{ env.ENDPOINT_WHITELIST}}

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

      - uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098
        with:
          python-version: '3.13'
          activate-environment: true
          cache-dependency-glob: ${{ env.CACHE_GLOBS }}

      - run: uv pip install -r requirements-dev.txt

      - id: cache-pre-commit
        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306
        with:
          path: ~/.cache/pre-commit
          key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}

      - run: pre-commit run --all-files --show-diff-on-failure --color=always