feat(ci): enforce min release age for npm dep installation #93029
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Python unit tests | |
| name: Python-Unit | |
| # Least-privilege default for GITHUB_TOKEN. Jobs that need more (e.g. OIDC for | |
| # codecov uploads) opt in via their own job-level `permissions:` block. | |
| permissions: | |
| contents: read | |
| on: | |
| push: | |
| branches: | |
| - "master" | |
| - "[0-9].[0-9]*" | |
| pull_request: | |
| types: [synchronize, opened, reopened, ready_for_review] | |
| # cancel previous workflow jobs for PRs | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }} | |
| cancel-in-progress: true | |
| jobs: | |
| changes: | |
| runs-on: ubuntu-26.04 | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| outputs: | |
| python: ${{ steps.check.outputs.python }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Check for file changes | |
| id: check | |
| uses: ./.github/actions/change-detector/ | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| unit-tests: | |
| needs: changes | |
| if: needs.changes.outputs.python == 'true' | |
| runs-on: ubuntu-26.04 | |
| timeout-minutes: 30 | |
| permissions: | |
| id-token: write | |
| strategy: | |
| matrix: | |
| # Full version spread on push (master/release) + nightly; current only | |
| # on PRs to cut runner cost (cross-version breaks are caught at merge). | |
| python-version: ${{ github.event_name == 'pull_request' && fromJSON('["current"]') || fromJSON('["current", "next"]') }} | |
| env: | |
| PYTHONPATH: ${{ github.workspace }} | |
| # Promotes the SQLAlchemy 2.0 deprecation warnings already locked in as | |
| # errors via pytest.ini's `filterwarnings` to actually run in CI, so a | |
| # regression on those fails the build instead of relying on a | |
| # contributor remembering to set this locally. See the migration | |
| # battleplan: https://github.com/apache/superset/discussions/40273 | |
| SQLALCHEMY_WARN_20: "1" | |
| steps: | |
| - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )" | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| submodules: recursive | |
| - name: Setup Python | |
| uses: ./.github/actions/setup-backend/ | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Python unit tests | |
| env: | |
| SUPERSET_TESTENV: true | |
| SUPERSET_SECRET_KEY: not-a-secret | |
| run: | | |
| pytest --durations-min=0.5 --cov-report= --cov=superset ./tests/common ./tests/unit_tests --cache-clear --maxfail=50 --junit-xml=test-results/junit-unit.xml | |
| - name: Python 100% coverage unit tests | |
| env: | |
| SUPERSET_TESTENV: true | |
| SUPERSET_SECRET_KEY: not-a-secret | |
| run: | | |
| pytest --durations-min=0.5 --cov=superset/sql/ ./tests/unit_tests/sql/ --cache-clear --cov-fail-under=100 --junit-xml=test-results/junit-sql-coverage.xml | |
| pytest --durations-min=0.5 --cov=superset/semantic_layers/ ./tests/unit_tests/semantic_layers/ --cache-clear --cov-fail-under=100 --junit-xml=test-results/junit-semantic-layers-coverage.xml | |
| - name: Upload code coverage | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 | |
| with: | |
| flags: python,unit | |
| verbose: true | |
| use_oidc: true | |
| slug: apache/superset | |
| # Uploaded even when a pytest step above fails, since that is exactly | |
| # when the JUnit results are needed downstream, to annotate the PR with | |
| # the failing tests. Consumed by the "Python Unit Test Results" workflow | |
| # via workflow_run (see that workflow for why it can't just be a step | |
| # here: it needs to run with write permissions, which this PR-triggered | |
| # job can't safely have on a fork PR). | |
| - name: Upload JUnit test results | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: junit-results-${{ matrix.python-version }} | |
| path: test-results/ | |
| retention-days: 7 | |
| # Uploads the raw pull_request event payload so the "Python Unit Test | |
| # Results" workflow (running via workflow_run, in base-branch context) can | |
| # look up which PR/commit to annotate without checking out untrusted code. | |
| event-file: | |
| runs-on: ubuntu-26.04 | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Upload event file | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: Event File | |
| path: ${{ github.event_path }} | |
| retention-days: 7 | |
| # Stable required-status-check anchor. `unit-tests` is a matrix job gated on | |
| # change detection, so on non-Python PRs it is skipped and never produces its | |
| # `unit-tests (current)` context (a job-level skip happens before matrix | |
| # expansion). This always-running job reports a single context that branch | |
| # protection can require: it passes when unit-tests succeeded or was skipped, | |
| # and fails only on a real failure. | |
| unit-tests-required: | |
| needs: [changes, unit-tests] | |
| if: always() | |
| runs-on: ubuntu-26.04 | |
| timeout-minutes: 5 | |
| permissions: | |
| contents: read | |
| actions: read | |
| steps: | |
| - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0 | |
| with: | |
| expand-composite-actions: true | |
| - name: Check unit-tests result | |
| env: | |
| RESULT: ${{ needs.unit-tests.result }} | |
| run: | | |
| if [ "$RESULT" != "success" ] && [ "$RESULT" != "skipped" ]; then | |
| echo "unit-tests did not pass (result: $RESULT)" | |
| exit 1 | |
| fi | |
| echo "unit-tests result: $RESULT" |