Fix CI

Author: rsyring

.github/workflows/nox.yaml

@@ -8,54 +8,52 @@ on:
   workflow_dispatch:
 
 
+# Limit this workflow to a single run at a time per-branch to avoid wasting worker resources
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 
+# env:
+  # hardlinks don't work in containers and just spam the logs with warning messages
+  # UV_LINK_MODE: copy
+  UV_DISABLE_UPDATE: 1
+
+
+
 jobs:
-  nox:
+  # JOB: NOX-OTHER
+  nox-other:
     runs-on: ubuntu-latest
 
+    strategy:
+      fail-fast: false
+      matrix:
+        session: [precommit, audit]
+
     steps:
-      - name: Checkout Code
-        uses: actions/checkout@v4
+      - uses: level12/coppy/gh-actions/nox-run@main
+        with:
+          nox-session: ${{ matrix.session }}
+
+  # JOB: NOX-PYTEST
+  nox-pytest:
+    runs-on: ubuntu-latest
 
-      - name: Add ~/bin to PATH
-        run: echo "PATH=/home/runner/bin:$PATH" >> $GITHUB_ENV
+    steps:
+      - uses: level12/coppy/gh-actions/uv-prep@main
+
+      - name: Add our user to test user group
+        run: |
+          uv run --no-dev tasks/test-user-prep.py
+
+      - name: Finish prepping test user
+        run: |
+          id
+          ls -l /home
+          ls -la /home/coppy-tests
+          uv run --no-dev  tasks/test-user-prep.py
 
-      - name: Prep
+      - name: Run pytest
         run: |
-          # Mise
-          mkdir ~/bin
-          curl -LsS https://mise.jdx.dev/mise-latest-linux-x64 > ~/bin/mise
-          chmod +x ~/bin/mise
-
-          # build the image used to test
-          mise docker-build
-
-          # uv
-          mise use -g ubi:astral-sh/uv
-          mkdir -p /home/runner/.local/share/uv/python/
-
-          # Prep mise
-          mise trust
-          mise install
-
-      # Uncomment to help troubleshooting
-      # - name: Debug info
-      #   run: |
-      #     # Python versions
-      #     echo "Python versions:"
-      #     mise exec -- python --version
-      #     mise exec -- uv run python --version
-
-      #     # Path
-      #     echo "Path:"
-      #     echo $PATH
-
-      #     mise demo --no-bootstrap --no-nox
-      #     mise sandbox --doctor
-
-      - name: nox
-        run: mise exec -- uv run --frozen --only-group nox nox
+          uv run --frozen --only-group nox -- nox -s pytest

noxfile.py

@@ -7,34 +7,59 @@
 nox.options.default_venv_backend = 'uv'
 
 
-def uv_sync(session, group: str, project: bool = False):
-    # NOTE: not sure why, but sys.path doesn't get correctly configured to include the coppy pkg's
-    # `src` directory when using '--only-group'.  But, in a templated generated app, like the
-    # coppy demo, '--only-group' works just fine.  I spent some time trying to debug but am punting
-    # for now since the problem/solution seem convoluted to me.
-    groups_args = ('--no-default-groups', '--group') if project else ('--only-group',)
-    session.run('uv', 'sync', '--active', '--frozen', *groups_args, group)
-
-
 @nox.session
-def tests(session: nox.Session):
-    uv_sync(session, 'tests', project=True)
+def pytest(session: nox.Session):
+    uv_sync(session)
+    # TODO: no coverage because the far majority of the code in this project is just for testing.
+    # But it wouldn't hurt to add it.
     session.run(
         'pytest',
         '-ra',
         '--tb=native',
         '--strict-markers',
-        f'--junit-xml={package_path}/ci/test-reports/{session.name}.pytests.xml',
         'tests',
         *session.posargs,
     )
 
 
 @nox.session
-def standards(session: nox.Session):
+def precommit(session: nox.Session):
     uv_sync(session, 'pre-commit')
     session.run(
         'pre-commit',
         'run',
         '--all-files',
     )
+
+
+@nox.session
+def audit(session: nox.Session):
+    # Much faster to install the deps first and have pip-audit run against the venv
+    uv_sync(session)
+    session.run(
+        'pip-audit',
+        '--desc',
+        '--skip-editable',
+    )
+
+
+def uv_sync(session: nox.Session, *groups, project=False, extra=None):
+    # If no group given, assume group shares name of session.
+    if not groups:
+        groups = (session.name,)
+
+    # At least pytest needs the project installed.
+    project_args = () if project or session.name.startswith('pytest') else ('--no-install-project',)
+
+    group_args = [arg for group in groups for arg in ('--group', group)]
+    extra_args = ('--extra', extra) if extra else ()
+    run_args = (
+        'uv',
+        'sync',
+        '--active',
+        '--no-default-groups',
+        *project_args,
+        *group_args,
+        *extra_args,
+    )
+    session.run(*run_args)

pyproject.toml

@@ -26,7 +26,7 @@ coppy = 'coppy.cli:cli'
 
 [dependency-groups]
 dev = [
-    {include-group = "tests"},
+    {include-group = "pytest"},
     {include-group = "pre-commit"},
     {include-group = "nox"},
     "hatch>=1.14.0",
@@ -39,9 +39,13 @@ pre-commit = [
     'pre-commit-uv>=4.1.4',
 ]
 # Used by nox
-tests = [
+pytest = [
     'pytest>=8.3.4',
 ]
+# Used by nox
+audit = [
+    'pip-audit',
+]
 # Used by CI
 nox = [
     'nox>=2025.2.9',

tasks/test-user-prep.py

@@ -41,16 +41,14 @@ def main(systemd_skip: bool, systemd_force: bool, reinstall: bool):
 
     if not coppy_user.is_current:
         curr_user = User.current()
-        # This would clear them all (i.e. fix a mistake if you have one)
-        utils.sub_run('sudo', 'setfacl', '-R', '-b', coppy_user_home)
-        # utils.sudo_run('setfacl', '-R', '-m', f'u:{curr_user.name}:rwX', coppy_user_home)
-        # utils.sudo_run('setfacl', '-R', '-d', '-m', f'u:{curr_user.name}:rwX', coppy_user_home)
+
         if coppy_user.name not in curr_user.groups():
             log.info(f'Adding your user to the user group: {coppy_user.name}')
             utils.sudo_run('usermod', '-aG', coppy_user.name, curr_user.name)
             log.warning(
                 f'Please logout and then back in to enable access to the {coppy_user.name} group.',
             )
+            return
         else:
             log.info(f'Your user is already in the group: {coppy_user.name}')