SEP-1476: Single source of truth for maintenance task names #7673
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Main CI workflow | |
| name: CI | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| types: | |
| - labeled | |
| - ready_for_review | |
| - synchronize | |
| - unlabeled | |
| workflow_call: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| label-gate: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Block merge on disqualifying labels | |
| if: >- | |
| contains(github.event.pull_request.labels.*.name, 'do not merge') || | |
| contains(github.event.pull_request.labels.*.name, 'qa in progress') || | |
| contains(github.event.pull_request.labels.*.name, 'qa failed') | |
| run: | | |
| echo "::error::PR is blocked by label. Remove 'do not merge', 'qa in progress', or 'qa failed' to proceed." | |
| exit 1 | |
| - name: Require QA approval label | |
| if: >- | |
| !contains(github.event.pull_request.labels.*.name, 'qa passed') && | |
| !contains(github.event.pull_request.labels.*.name, 'skip-test') | |
| run: | | |
| echo "::error::PR requires 'qa passed' or 'skip-test' label to merge." | |
| exit 1 | |
| # Detect changed file types to gate downstream jobs. | |
| # Python/frontend patterns mirror .github/labeler.yml; CI also tracks | |
| # .pre-commit-config.yaml separately to trigger precommit-python / precommit-frontend. | |
| changes: | |
| if: ${{ github.event.pull_request.draft == false }} | |
| runs-on: ubuntu-latest | |
| outputs: | |
| python: ${{ steps.filter.outputs.python }} | |
| precommit: ${{ steps.filter.outputs.precommit }} | |
| frontend: ${{ steps.filter.outputs.frontend }} | |
| docker: ${{ steps.filter.outputs.docker }} | |
| shell: ${{ steps.filter.outputs.shell }} | |
| steps: | |
| - name: Checkout codebase | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Detect changed files | |
| id: filter | |
| uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 | |
| with: | |
| filters: | | |
| python: | |
| - '**/**.py' | |
| - 'pyproject.toml' | |
| - 'poetry.lock' | |
| - 'poetry.toml' | |
| - 'settings.yaml' | |
| - 'frontend/packages/api/specs/**' | |
| precommit: | |
| - '.pre-commit-config.yaml' | |
| shell: | |
| - '**/*.sh' | |
| frontend: | |
| - 'frontend/**' | |
| - 'package.json' | |
| docker: | |
| - 'Containerfile' | |
| - 'Containerfile.base' | |
| - 'app/**' | |
| - 'frontend/**' | |
| - 'pyproject.toml' | |
| - 'poetry.lock' | |
| - 'snippets/**' | |
| - 'static/**' | |
| - 'templates/**' | |
| - 'entrypoint.sh' | |
| - 'entrypoint_celery.sh' | |
| - 'Makefile' | |
| - 'alembic.ini' | |
| precommit-light: | |
| if: ${{ github.event.pull_request.draft == false }} | |
| needs: | |
| - label-gate | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout codebase | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Setup Python | |
| uses: actions/setup-python@28f2168f4d98ee0445e3c6321f6e6616c83dd5ec # v6.2.0 | |
| with: | |
| python-version: "3.11" | |
| - name: Install pre-commit | |
| run: python -m pip install pre-commit==4.5.1 | |
| - name: Cache pre-commit hook environments | |
| uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 | |
| with: | |
| path: ~/.cache/pre-commit | |
| key: pre-commit-${{ runner.os }}-${{ hashFiles('.pre-commit-config.yaml') }} | |
| restore-keys: | | |
| pre-commit-${{ runner.os }}- | |
| - name: Write lightweight pre-commit config | |
| run: | | |
| cat > .pre-commit-light-config.yaml <<'EOF' | |
| repos: | |
| - repo: https://github.com/pre-commit/pre-commit-hooks | |
| rev: cef0300fd0fc4d2a87a85fa2093c6b283ea36f4b | |
| hooks: | |
| - id: check-yaml | |
| - id: check-json | |
| - id: check-toml | |
| - id: check-merge-conflict | |
| - id: check-case-conflict | |
| - id: check-added-large-files | |
| - id: end-of-file-fixer | |
| - id: trailing-whitespace | |
| - id: fix-byte-order-marker | |
| EOF | |
| - name: Perform lightweight pre-commit checks | |
| run: | | |
| pre-commit run --config .pre-commit-light-config.yaml --all-files | |
| precommit-python: | |
| if: >- | |
| ${{ | |
| github.event.pull_request.draft == false && | |
| ( | |
| needs.changes.outputs.python == 'true' || | |
| needs.changes.outputs.precommit == 'true' || | |
| needs.changes.outputs.docker == 'true' || | |
| needs.changes.outputs.shell == 'true' | |
| ) | |
| }} | |
| needs: | |
| - label-gate | |
| - changes | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout codebase | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Setup Python | |
| uses: actions/setup-python@28f2168f4d98ee0445e3c6321f6e6616c83dd5ec # v6.2.0 | |
| with: | |
| python-version: "3.11" | |
| - name: Install pre-commit | |
| run: python -m pip install pre-commit==4.5.1 | |
| - name: Cache pre-commit hook environments | |
| uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 | |
| with: | |
| path: ~/.cache/pre-commit | |
| key: pre-commit-${{ runner.os }}-${{ hashFiles('.pre-commit-config.yaml') }} | |
| restore-keys: | | |
| pre-commit-${{ runner.os }}- | |
| - name: Perform Python and system pre-commit checks | |
| env: | |
| SKIP: oxfmt,oxlint | |
| run: pre-commit run --all-files | |
| precommit-frontend: | |
| if: >- | |
| ${{ | |
| github.event.pull_request.draft == false && | |
| ( | |
| needs.changes.outputs.frontend == 'true' || | |
| needs.changes.outputs.precommit == 'true' | |
| ) | |
| }} | |
| needs: | |
| - label-gate | |
| - changes | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout codebase | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8 | |
| with: | |
| version: 11.1.2 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: "22.13.0" | |
| cache: pnpm | |
| cache-dependency-path: frontend/pnpm-lock.yaml | |
| - name: Install frontend dependencies | |
| run: pnpm install --frozen-lockfile | |
| working-directory: frontend | |
| - name: Run oxfmt | |
| run: pnpm run format:check | |
| working-directory: frontend | |
| - name: Run oxlint | |
| run: pnpm run lint | |
| working-directory: frontend | |
| python: | |
| # `lint-fmt-only`: precommit-python already re-runs the bumped linters. | |
| if: >- | |
| ${{ | |
| github.event.pull_request.draft == false && | |
| needs.changes.outputs.python == 'true' && | |
| !contains(github.event.pull_request.labels.*.name, 'lint-fmt-only') | |
| }} | |
| uses: ./.github/workflows/python.yaml | |
| needs: | |
| - label-gate | |
| - changes | |
| frontend: | |
| if: >- | |
| ${{ | |
| github.event.pull_request.draft == false && | |
| needs.changes.outputs.frontend == 'true' && | |
| !contains(github.event.pull_request.labels.*.name, 'lint-fmt-only') | |
| }} | |
| uses: ./.github/workflows/frontend.yaml | |
| needs: | |
| - label-gate | |
| - changes | |
| build: | |
| # Runs concurrently with the python test matrix — the docker image build | |
| # consumes no test output, so it no longer gates on `python`. It starts as | |
| # soon as label-gate and changes succeed, while tests are still running. | |
| # running. Merge correctness is preserved by ci-success below, which | |
| # aggregates python, frontend, and build. | |
| # `lint-fmt-only`: audit-group deps not in the production image. | |
| if: >- | |
| ${{ | |
| github.event.pull_request.draft == false && | |
| needs.label-gate.result == 'success' && | |
| needs.changes.result == 'success' && | |
| needs.changes.outputs.docker == 'true' && | |
| !contains(github.event.pull_request.labels.*.name, 'lint-fmt-only') | |
| }} | |
| runs-on: ubuntu-latest | |
| needs: | |
| - label-gate | |
| - changes | |
| steps: | |
| - name: Checkout codebase | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@a0c73a10bb6782f082cd6714666c87911e4fc7d3 # v4.0.0 | |
| - name: Build base image | |
| uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 | |
| with: | |
| context: . | |
| file: Containerfile.base | |
| tags: sep:builder | |
| load: true | |
| cache-from: type=gha,scope=base | |
| cache-to: type=gha,mode=max,scope=base | |
| - name: Prepare app bundle | |
| run: make pack | |
| - name: Build app image | |
| run: >- | |
| docker build | |
| --build-context "localhost/sep:builder=docker-image://sep:builder" | |
| -f Containerfile -t "sep:HEAD" . | |
| - name: Smoke test | |
| run: docker run --rm --entrypoint /bin/sh "sep:HEAD" -c 'sleep 1' | |
| ci-success: | |
| if: always() | |
| needs: | |
| - label-gate | |
| - changes | |
| - precommit-light | |
| - precommit-python | |
| - precommit-frontend | |
| - python | |
| - frontend | |
| - build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Fail if any dependency failed or was cancelled | |
| if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') | |
| run: exit 1 |