Repository navigation
chore: secure CI #2190
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| - develop | |
| workflow_dispatch: | |
| permissions: {} | |
| concurrency: | |
| # Skip intermediate builds: always. | |
| # Cancel intermediate builds: only if it is a pull request build. | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ startsWith(github.ref, 'refs/pull/') }} | |
| env: | |
| # The "FORCE_COLOR" variable, when set to 1, | |
| # tells Nox to colorize itself. | |
| FORCE_COLOR: "1" | |
| jobs: | |
| pre-commit: | |
| name: Check SDist | |
| runs-on: ubuntu-latest | |
| permissions: {} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: 3.x | |
| - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 | |
| - name: PyLint | |
| run: uvx nox -s pylint -- --output-format=github | |
| check-lite: | |
| runs-on: ubuntu-latest | |
| permissions: {} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: | |
| - "3.10" | |
| - "3.11" | |
| - "3.12" | |
| - "3.13" | |
| - "3.14" | |
| - "3.14t" | |
| name: Python ${{ matrix.python-version }} - Lite | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| allow-prereleases: true | |
| - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 | |
| - name: Test lite package | |
| run: uvx nox -s lite-$PYTHON --verbose | |
| env: | |
| PYTHON: ${{ matrix.python-version }} | |
| check-full: | |
| needs: [check-lite] | |
| runs-on: ubuntu-latest | |
| permissions: {} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: | |
| - "3.10" | |
| - "3.11" | |
| - "3.12" | |
| - "3.13" | |
| - "3.14" | |
| - "3.14t" | |
| name: Python ${{ matrix.python-version }} - Full | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| allow-prereleases: true | |
| - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 | |
| - name: Install nox | |
| run: uv tool install nox | |
| - name: Run doctests on Python 3.11 | |
| if: matrix.python-version == 3.11 | |
| run: nox -s doctests-$PYTHON --verbose | |
| env: | |
| PYTHON: ${{ matrix.python-version }} | |
| - name: Test package and generate coverage report | |
| run: nox -s coverage-$PYTHON --verbose | |
| env: | |
| PYTHON: ${{ matrix.python-version }} | |
| - name: Upload coverage report | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| root: | |
| name: ROOT comparison tests | |
| runs-on: ubuntu-latest | |
| permissions: {} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: prefix-dev/setup-pixi@f00437f565399d418b0acc85936d12c1fb668347 # v0.10.1 | |
| with: | |
| environments: root | |
| - name: Run ROOT comparison tests | |
| run: pixi run root-tests | |
| pass: | |
| name: Pass | |
| needs: [pre-commit, check-lite, check-full, root] | |
| if: always() | |
| runs-on: ubuntu-latest | |
| permissions: {} | |
| steps: | |
| - name: Decide whether all required jobs succeeded | |
| run: $SUCCESS | |
| env: | |
| SUCCESS: ${{ !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') }} |