ci: Add explicit permissions to workflows (#143) #489
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # workflows/ci.yml | |
| # | |
| # CI | |
| # Run linting and test matrix across supported Python and Django versions. | |
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| concurrency: | |
| group: ci-${{ github.head_ref || github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| POSTGRES_USER: postgres | |
| POSTGRES_PASSWORD: postgres | |
| POSTGRES_DB: postgres | |
| permissions: | |
| contents: read | |
| jobs: | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.13" | |
| - name: Set up uv | |
| uses: astral-sh/setup-uv@v7 | |
| with: | |
| enable-cache: true | |
| - name: Install dependencies | |
| run: | | |
| uv venv --python "3.13" | |
| uv sync --extra dev | |
| - name: Ruff check | |
| run: uv run --no-sync ruff check . | |
| - name: Ruff format check | |
| run: uv run --no-sync ruff format --check . | |
| - name: Type check | |
| run: uv run --no-sync mypy paradedb | |
| - name: Check API coverage | |
| run: uv run --no-sync python scripts/check_api_coverage.py | |
| - name: Check API stub sync | |
| run: uv run --no-sync python scripts/check_api_stub_sync.py | |
| - name: Wheel install smoke test | |
| run: bash scripts/smoke_wheel_install.sh | |
| matrix-tests: | |
| name: Python ${{ matrix.python-version }} / Django ${{ matrix.django-version }} / PG ${{ matrix.postgres-version }} | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| # Django 4 supports Python 3.8-3.12, but we only support Python 3.10+ | |
| - django-version: "4.2" | |
| python-version: "3.10" | |
| postgres-version: "18" | |
| - django-version: "4.2" | |
| python-version: "3.11" | |
| postgres-version: "18" | |
| - django-version: "4.2" | |
| python-version: "3.12" | |
| postgres-version: "18" | |
| # Django 5 supports Python 3.10-3.12 | |
| - django-version: "5.2" | |
| python-version: "3.10" | |
| postgres-version: "18" | |
| - django-version: "5.2" | |
| python-version: "3.11" | |
| postgres-version: "18" | |
| - django-version: "5.2" | |
| python-version: "3.12" | |
| postgres-version: "18" | |
| # Django 6 supports Python 3.12-3.14 | |
| - django-version: "6.0" | |
| python-version: "3.12" | |
| postgres-version: "18" | |
| - django-version: "6.0" | |
| python-version: "3.13" | |
| postgres-version: "18" | |
| - django-version: "6.0" | |
| python-version: "3.14" | |
| postgres-version: "18" | |
| # Postgres compatibility coverage for supported older versions | |
| - django-version: "5.2" | |
| python-version: "3.12" | |
| postgres-version: "15" | |
| - django-version: "5.2" | |
| python-version: "3.12" | |
| postgres-version: "16" | |
| - django-version: "5.2" | |
| python-version: "3.12" | |
| postgres-version: "17" | |
| services: | |
| paradedb: | |
| image: paradedb/paradedb:0.23.4-pg${{ matrix.postgres-version }} | |
| env: | |
| POSTGRES_USER: postgres | |
| POSTGRES_PASSWORD: postgres | |
| POSTGRES_DB: postgres | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd "pg_isready -U postgres -d postgres" | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 12 | |
| env: | |
| PARADEDB_TEST_DSN: postgresql://postgres:postgres@localhost:5432/postgres | |
| PGPASSWORD: postgres | |
| DATABASE_URL: postgresql://postgres:postgres@localhost:5432/postgres | |
| PYTHONPATH: ${{ github.workspace }} | |
| DJANGO_SPEC: Django~=${{ matrix.django-version }}.0 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Set up uv | |
| uses: astral-sh/setup-uv@v7 | |
| with: | |
| enable-cache: true | |
| - name: Install dependencies | |
| run: | | |
| uv venv --python "${{ matrix.python-version }}" | |
| uv sync --extra dev | |
| - name: Run tests | |
| run: uv run --with "${DJANGO_SPEC}" pytest --cov=paradedb --cov-report=xml | |
| - name: Upload to Codecov | |
| uses: codecov/codecov-action@v7 | |
| with: | |
| files: ./coverage.xml | |
| flags: django-paradedb,py${{ matrix.python-version }},dj${{ matrix.django-version }},pg${{ matrix.postgres-version }} | |
| fail_ci_if_error: false | |
| verbose: true | |
| env: | |
| CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} | |
| - name: Run examples | |
| run: scripts/run_examples.sh | |
| - name: Run RAG example (if API key configured) | |
| env: | |
| OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }} | |
| run: | | |
| if [ -n "${OPENROUTER_API_KEY}" ]; then | |
| uv run --with "${DJANGO_SPEC}" python examples/rag/rag.py | |
| else | |
| echo "Skipping RAG example: OPENROUTER_API_KEY is not configured." | |
| fi |