deltakit-decode/.github/workflows/pull_request.yml at main · Deltakit/deltakit-decode · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
name: Pull Request

on:
  push:
    branches:
      - main
  pull_request:
    types: [opened, synchronize, reopened, labeled]

jobs:
  # Build wheels.
  build-wheels:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
      - name: Install uv
        uses: astral-sh/setup-uv@v7
      - name: Build deltakit-decode wheel
        run: uv build --no-sources .
      - name: Upload wheels artefacts
        uses: actions/upload-artifact@v7
        with:
          name: deltakit-decode-wheels
          path: ./dist/*.whl
          retention-days: 7

  # Test the built wheels.
  tests-wheels:
    needs: [build-wheels]
    strategy:
      matrix:
        python-version: ['3.10', '3.11', '3.12', '3.13', '3.14']
        dependency-resolution: ['highest', 'lowest-direct']
    name: Test deltakit-decode on ${{ matrix.python-version }} with ${{matrix.dependency-resolution}}
    env:
      ENABLE_COVERAGE: ${{ (matrix.python-version == '3.10') && (matrix.dependency-resolution == 'highest') }}
      # See https://github.com/orgs/community/discussions/25217
      PR_FROM_FORK: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
      PR_FROM_DEPENDABOT: ${{ startsWith(github.head_ref, 'dependabot/' )}}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
      - name: Install uv
        uses: astral-sh/setup-uv@v7
      - name: Download wheels
        uses: actions/download-artifact@v8
        with:
          name: deltakit-decode-wheels
          path: ./dist
      - name: Setup and sync venv for testing deltakit-decode
        run: |
          uv sync --python ${{ matrix.python-version }} --resolution ${{matrix.dependency-resolution}} --group test
          uv pip install ./dist/*.whl
      - name: Test deltakit-decode
        env:
          COVERAGE_ARGS: ${{env.ENABLE_COVERAGE == 'true' && '--cov deltakit_decode --cov-config pyproject.toml --cov-report xml:coverage.xml' || ''}}
        run: |
          uv run --python ${{ matrix.python-version }} --no-sync pytest $COVERAGE_ARGS tests/
      - name: Export coverage data to XML and report
        if: ${{ env.ENABLE_COVERAGE == 'true' }}
        run: |
          uv run --no-sync coverage xml
          uv run --no-sync coverage report
      - name: Printing coverage report as a message
        if: ${{ env.ENABLE_COVERAGE == 'true' && env.PR_FROM_FORK == 'false' && env.PR_FROM_DEPENDABOT == 'false' }}
        uses: 5monkeys/cobertura-action@v13
        with:
          repo_token : ${{ secrets.GITHUB_TOKEN }}
          path: ./coverage.xml
          skip_covered: true
          minimum_coverage: 95
          fail_below_threshold: false
          show_missing: true
          link_missing_lines: true
          link_missing_lines_source_dir: ''
          only_changed_files: true

  # Perform static check on each deltakit-decode project package.
  static-checks:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
      - name: Install uv
        uses: astral-sh/setup-uv@v7
      - name: Setup venv
        run: uv sync --group=lint --group=security
      - name: Check for typos
        run: uv run --no-sync typos
      - name: Run `ruff` syntax checker
        run: uv run --no-sync ruff check
        if: ${{ always() }}
      - name: Run `ruff` formatting
        run: uv run --no-sync ruff format --check
        if: ${{ always() }}
      - name: Run `pydoclint` documentation formatting
        run: uv run --no-sync pydoclint .
        if: ${{ always() }}
      - name: Run `mypy` type checker
        run: uv run --no-sync mypy
        if: ${{ always() }}
      - name: Run `deptry` for dependency hygiene
        run: uv run --no-sync deptry src/
        if: ${{ always() }}
      - name: Run `bandit` for code vulnerabilities
        run: uv run --no-sync bandit .
        if: ${{ always() }}
      - name: Run `pip_audit` to check dependencies for known vulnerabilities
        # Ignore CVE-2025-53000 as it only affects `nbconvert` on Windows.
        # `nbconvert` is only used for documentation building on Linux.
        # Remove when https://github.com/jupyter/nbconvert/issues/2258 is fixed.
        run: uv run --no-sync pip-audit --ignore-vuln CVE-2025-53000
        if: ${{ always() }}