fix(receipts): reject empty-quote receipts on the verify side too #1194
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| jobs: | |
| test: | |
| name: test (py${{ matrix.python }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python: ["3.11", "3.12", "3.13"] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ matrix.python }} | |
| cache: pip | |
| - name: install | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e '.[dev,web]' | |
| - name: lint | |
| run: python -m ruff check src tests | |
| - name: type | |
| run: python -m mypy src | |
| - name: test | |
| run: python -m pytest --cov=vouch --cov-report=xml | |
| - name: upload coverage | |
| if: matrix.python == '3.12' | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: coverage | |
| path: coverage.xml | |
| # the per-pr bar: every python line this pr adds or changes under src/vouch | |
| # must be executed by a test. repo-wide coverage is a separate ratchet | |
| # (pyproject [tool.coverage.report] fail_under) that stops regressions; this | |
| # job is what makes *new* code arrive covered instead of adding to the debt. | |
| # | |
| # a pr that touches no python under src/vouch passes trivially -- diff-cover | |
| # reports "no lines with coverage information in this diff" and exits 0, so | |
| # docs-only and workflow-only prs are unaffected. | |
| diff-coverage: | |
| name: diff coverage (100% of changed python) | |
| if: github.event_name == 'pull_request' | |
| needs: test | |
| runs-on: ubuntu-latest | |
| steps: | |
| # full history: diff-cover diffs the head against the merge base, which | |
| # a shallow clone cannot resolve. | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| cache: pip | |
| - name: install | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install 'diff-cover>=9,<10' | |
| - name: download coverage | |
| uses: actions/download-artifact@v7 | |
| with: | |
| name: coverage | |
| - name: fetch base branch | |
| env: | |
| BASE_REF: ${{ github.event.pull_request.base.ref }} | |
| run: git fetch --no-tags origin "+refs/heads/$BASE_REF:refs/remotes/origin/$BASE_REF" | |
| # the reports are written even when the gate fails, so the bot can quote | |
| # the uncovered lines back on the PR. the job's own exit code is the gate. | |
| - name: diff coverage | |
| id: gate | |
| env: | |
| BASE_REF: ${{ github.event.pull_request.base.ref }} | |
| run: | | |
| set +e | |
| diff-cover coverage.xml \ | |
| --compare-branch "origin/$BASE_REF" \ | |
| --include 'src/vouch/*' \ | |
| --fail-under 100 \ | |
| --json-report diff-coverage.json \ | |
| --markdown-report diff-coverage.md | |
| echo "status=$?" >> "$GITHUB_OUTPUT" | |
| - name: upload diff-coverage report | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: diff-coverage | |
| path: | | |
| diff-coverage.json | |
| diff-coverage.md | |
| if-no-files-found: warn | |
| - name: summary | |
| if: always() | |
| run: | | |
| if [ -f diff-coverage.md ]; then | |
| cat diff-coverage.md >> "$GITHUB_STEP_SUMMARY" | |
| fi | |
| - name: enforce the gate | |
| env: | |
| STATUS: ${{ steps.gate.outputs.status }} | |
| run: exit "$STATUS" | |
| build: | |
| name: build sdist + wheel | |
| runs-on: ubuntu-latest | |
| needs: test | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: build | |
| run: | | |
| python -m pip install --upgrade pip build | |
| python -m build | |
| - name: upload artifacts | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: dist | |
| path: dist/ |