fix(ocr): raise default page-image resolution so Textract keeps small glyphs (#729) #868
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. | |
| # SPDX-License-Identifier: MIT-0 | |
| name: Developer Tests | |
| on: | |
| pull_request: | |
| branches: | |
| - "**" # Run on PR open, update, or synchronize (i.e., any push to PR branch) | |
| # Least-privilege default for the GITHUB_TOKEN. Without this, any job that | |
| # omits its own `permissions:` block inherits the repository default, which can | |
| # be write-all. Jobs that need more declare it themselves (see below), and this | |
| # floor is what any future job gets until it does. | |
| permissions: | |
| contents: read | |
| # Global timeout for all jobs | |
| # Note: GitHub Actions uses minutes, GitLab uses duration strings | |
| jobs: | |
| developer_tests: | |
| name: Lint, Type Check, and Test | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 120 # 2 hours | |
| permissions: | |
| contents: read | |
| issues: read | |
| checks: write | |
| # pull-requests: write - Not needed: PR comments are disabled (see line 115) | |
| # Use Python 3.13 to match GitLab configuration | |
| container: | |
| image: python:3.13-bookworm | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| fetch-depth: 0 # Fetch all history for git diff in typecheck-pr | |
| - name: Set up Git safe directory | |
| run: | | |
| git config --global --add safe.directory "$GITHUB_WORKSPACE" | |
| # `github.base_ref` is attacker-controllable (a fork can name its branch | |
| # anything), so it must never be interpolated straight into `run:` where | |
| # the shell would evaluate it. Pass it through `env:` and quote the | |
| # expansion instead. | |
| - name: Fetch base branch | |
| env: | |
| BASE_REF: ${{ github.base_ref || 'main' }} | |
| run: | | |
| git fetch origin "${BASE_REF}:refs/remotes/origin/${BASE_REF}" | |
| git branch -a | |
| - name: Set up environment | |
| run: | | |
| python --version | |
| apt-get update -y | |
| apt-get install make curl -y | |
| # Use the first-party pinned action rather than | |
| # `curl -LsSf https://astral.sh/uv/install.sh | sh`: piping a remote | |
| # script into a shell executes whatever the endpoint serves, and the | |
| # pipeline also hid failures (it exited with sh's status, not curl's). | |
| # The action also puts uv on PATH itself — the old step appended a | |
| # `$HOME/.cargo/bin` that recent uv installers no longer use. | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.3.1 | |
| - name: Create virtual environment | |
| run: | | |
| uv venv .venv | |
| echo "$GITHUB_WORKSPACE/.venv/bin" >> $GITHUB_PATH | |
| # Node 22 is needed for the UI unit tests and for basedpyright. Use the | |
| # first-party setup-node action (as deploy-docs.yml already does) rather | |
| # than piping NodeSource's installer into bash: that pipeline swallowed a | |
| # failed download (`curl ... | bash -` exits with bash's status, not | |
| # curl's), so a NodeSource 403 silently left the repo unregistered, the | |
| # following apt-get installed Debian's own nodejs 18 — which ships no npm | |
| # — and the job failed several steps later with a bare `npm: not found`. | |
| - name: Install Node.js | |
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 | |
| with: | |
| node-version: 22 | |
| - name: Install basedpyright | |
| run: npm install -g basedpyright | |
| - name: Install Python dependencies | |
| run: | | |
| uv pip install 'ruff==0.15.13' | |
| uv pip install typer rich boto3 | |
| # ALL first-party packages in a single pip pass. They depend on each | |
| # other by bare name and those names are squatted on public PyPI, so a | |
| # split install would resolve a sibling from PyPI — see the | |
| # FIRST_PARTY_EDITABLES note in the Makefile. The target also runs | |
| # scripts/check_first_party_deps.py, which fails if any of them did. | |
| # Previously CI installed only idp_common_pkg, so the package/Lambda | |
| # suites could not even import idp_sdk. | |
| make install-first-party PIP="uv pip" | |
| - name: Run linting checks | |
| run: make lint-cicd | |
| - name: Run type checking | |
| env: | |
| BASE_REF: ${{ github.base_ref }} | |
| run: | | |
| TARGET_BRANCH="$BASE_REF" | |
| echo "=== Type Checking Configuration ===" | |
| echo "PR target branch (github.base_ref): $TARGET_BRANCH" | |
| echo "Comparing: origin/$TARGET_BRANCH...HEAD" | |
| echo "====================================" | |
| echo "" | |
| make typecheck-pr TARGET_BRANCH="$TARGET_BRANCH" | |
| - name: Run tests | |
| id: run-tests | |
| run: make test-cicd -C lib/idp_common_pkg | |
| continue-on-error: false | |
| # `make test-cicd -C lib/idp_common_pkg` above covers only idp_common_pkg. | |
| # This target covers the package/Lambda suites it does not: idp_cli, idp_sdk, | |
| # idp_feature_sdk, the feature-platform resolvers, the seller entitlement | |
| # service (including its template-security assertions and payload-robustness | |
| # fuzz corpus), and the SDLC harness suite (deployment-variant probes, the | |
| # API security cases, and the IAM trust-policy partition guards that keep a | |
| # GovCloud-only principal out of a commercial trust policy — see issue #632). | |
| # All offline — no AWS, no credentials. | |
| # These were previously ungated: ~400 tests, including ones that have caught | |
| # real security bugs, ran only on developers' machines. | |
| - name: Run package and Lambda test suites | |
| id: run-package-tests | |
| run: make test-packages-cicd | |
| continue-on-error: false | |
| - name: Run UI unit tests | |
| id: run-ui-tests | |
| # Vitest + jsdom (no browser). Node 22 comes from setup-node above. | |
| run: cd src/ui && npm ci --prefer-offline --no-audit && npx vitest run | |
| continue-on-error: false | |
| - name: Upload coverage reports | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | |
| if: always() && steps.run-tests.outcome != 'skipped' | |
| with: | |
| name: test-reports | |
| path: | | |
| lib/idp_common_pkg/test-reports/coverage.xml | |
| lib/idp_common_pkg/test-reports/test-results.xml | |
| retention-days: 7 | |
| - name: Publish test results | |
| uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2.23.0 | |
| if: always() && hashFiles('lib/idp_common_pkg/test-reports/test-results.xml') != '' | |
| with: | |
| files: lib/idp_common_pkg/test-reports/test-results.xml | |
| check_name: Test Results | |
| comment_mode: off # Disable PR comments to avoid permission issues on fork PRs | |
| - name: Code Coverage Report | |
| uses: irongut/CodeCoverageSummary@51cc3a756ddcd398d447c044c02cb6aa83fdae95 # v1.3.0 | |
| if: always() && hashFiles('lib/idp_common_pkg/test-reports/coverage.xml') != '' | |
| with: | |
| filename: lib/idp_common_pkg/test-reports/coverage.xml | |
| badge: true | |
| fail_below_min: false | |
| format: markdown | |
| hide_branch_rate: false | |
| hide_complexity: true | |
| indicators: true | |
| output: both | |
| thresholds: "60 80" | |
| # Note: PR comments disabled for fork PRs due to permission restrictions | |
| # Coverage results are available in: | |
| # 1. Workflow artifacts (test-reports) | |
| # 2. Job summary (automatically generated by CodeCoverageSummary) | |
| # 3. GitHub checks tab |