osc-github-devops/.github/workflows/build-test.yaml at 776ecf516fdb5242b53e2915bd563faf2ff9cb7a · modeseven-os-climate/osc-github-devops · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
---
# SPDX-License-Identifier: Apache-2.0
# SPDX-FileCopyrightText: 2025 The Linux Foundation

# Runs on a new pull request, performs build and runs tests
name: "Python Build/Test"

# yamllint disable-line rule:truthy
on:
  workflow_dispatch:
  pull_request:
    types: [opened, reopened, edited, synchronize]
    branches:
      - main
      - master
    paths:
      - "**"
      - "!.github/**"
      - "!.*"
      - "!tox.ini"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: {}

jobs:
  repository:
    name: "Repository"
    # yamllint disable-line rule:line-length
    uses: os-climate/osc-github-devops/.github/workflows/reuse-inspect-repository.yaml@50a55963fb815139987f49c15f7380eb5d028974 # Pre v0.1.30
    permissions:
      contents: read

  dynamic-version-check:
    name: "Dynamic Version Check"
    runs-on: ubuntu-24.04
    needs: repository
    if: needs.repository.outputs.python_project == 'true'
    outputs:
      dynamic_version: ${{ steps.dynamic-version.outputs.dynamic_version }}
    permissions:
      contents: read
    timeout-minutes: 1
    steps:
      # Harden the runner used by this workflow
      - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: "Check for dynamic versioning"
        id: dynamic-version
        # yamllint disable-line rule:line-length
        uses: lfreleng-actions/python-dynamic-version-action@757278a7dce3add2c777305e7ec61d9e2b97ed7e # v0.1.6

  python-build:
    name: "Python Build"
    needs:
      - repository
      - dynamic-version-check
    if: needs.repository.outputs.python_project  == 'true'
    runs-on: ubuntu-24.04
    outputs:
      matrix_json: ${{ steps.python-build.outputs.matrix_json }}
      artefact_name: ${{ steps.python-build.outputs.artefact_name }}
      artefact_path: ${{ steps.python-build.outputs.artefact_path }}
    permissions:
      contents: write
    timeout-minutes: 12
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      # Harden the runner used by this workflow
      - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: "Build Python project"
        id: python-build
        # yamllint disable-line rule:line-length
        uses: modeseven-lfreleng-actions/python-build-action@build-requirements-fix # Testing
        # yamllint disable-line rule:line-length
        # uses: lfreleng-actions/python-build-action@56dd541a74b5cf9f0c5939ed98387478824720a2 # v0.1.8
        with:
          # Only pass tag if NOT using dynamic versioning
          # yamllint disable-line rule:line-length
          tag: ${{ needs.dynamic-version-check.outputs.dynamic_version == 'true' && '' || needs.repository.outputs.build_tag }}
          # Skip version patching when using dynamic versioning
          skip_version_patch: ${{ needs.dynamic-version-check.outputs.dynamic_version == 'true' }}

  python-tests:
    name: "Python Tests"
    runs-on: "ubuntu-24.04"
    needs:
      - python-build
    # Matrix job
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.python-build.outputs.matrix_json) }}
    permissions:
      contents: read
    timeout-minutes: 12
    steps:
      # Harden the runner used by this workflow
      - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: "Python tests [pytest] ${{ matrix.python-version }}"
        # yamllint disable-line rule:line-length
        uses: modeseven-lfreleng-actions/python-test-action@update-action # Testing
        # yamllint disable-line rule:line-length
        # uses: lfreleng-actions/python-test-action@b06828bf94ae4beef00d49cddc06839eca2d8f05 # v0.1.6
        with:
          python_version: ${{ matrix.python-version }}

  python-audit:
    name: "Python Audit"
    runs-on: "ubuntu-24.04"
    needs:
      - python-build
    # Matrix job
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.python-build.outputs.matrix_json) }}
    permissions:
      contents: read
    timeout-minutes: 10
    steps:
      # Harden the runner used by this workflow
      - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: "Audit dependencies ${{ matrix.python-version }}"
        # yamllint disable-line rule:line-length
        uses: lfreleng-actions/python-audit-action@4c51bc76f9876b4f294f8afa4bb002b0b89aec68 # v0.1.3
        with:
          python_version: ${{ matrix.python-version }}

  notebooks:
    name: "Test Jupyter Notebooks"
    runs-on: "ubuntu-24.04"
    if: needs.repository.outputs.jupyter_notebooks  == 'true'
    needs:
      - repository
      - python-build
    # Matrix job
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.python-build.outputs.matrix_json) }}
    permissions:
      contents: read
    timeout-minutes: 10
    steps:
      # Harden the runner used by this workflow
      - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: "Notebook tests ${{ matrix.python-version }}"
        # yamllint disable-line rule:line-length
        uses: lfreleng-actions/python-notebook-test-action@471123b59d0ef608f95bece4d36a95ebabab0a68 # v0.1.1
        with:
          python_version: ${{ matrix.python-version }}