Repository navigation
ci: pin third-party Actions to commit SHAs and set read-only default permissions #610
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI/CD Pipeline | |
| on: | |
| push: | |
| branches: | |
| - "main" | |
| paths: | |
| - "**" | |
| pull_request: | |
| branches: | |
| - "main" | |
| permissions: | |
| checks: write | |
| contents: read | |
| pull-requests: read | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| strategy: | |
| matrix: | |
| python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"] | |
| fail-fast: false | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5 | |
| - name: Set up Python ${{ matrix.python-version }} | |
| run: uv python install ${{ matrix.python-version }} | |
| - name: Set up environment | |
| run: | | |
| echo "${{ matrix.python-version }}" > .python-version | |
| uv venv | |
| uv sync | |
| - name: Get Python path | |
| run: | | |
| PYTHON_BIN="$(uv run python -c 'import sys; print(sys.executable)')" | |
| echo "PYTHON_BIN=$PYTHON_BIN" >> $GITHUB_ENV | |
| - name: Lint with ruff | |
| run: | | |
| uv run ruff check . | |
| uv run ruff format --check . | |
| - name: Run Pyright | |
| uses: jakebailey/pyright-action@6cabc0f01c4994be48fd45cd9dbacdd6e1ee6e5e # v2 | |
| with: | |
| python-path: ${{ env.PYTHON_BIN }} | |
| pylance-version: latest-release | |
| - name: Run Unit Tests with JUnit XML output | |
| run: | |
| uv run pytest tests/ --cov=src/amrita_core --cov-fail-under=78 | |
| --cov-report=term-missing --cov-report=xml --junitxml=test-results.xml -v | |
| - name: Publish Test Report | |
| uses: dorny/test-reporter@3eeb9fc888e82e8be2fb356bbeec2750231672bc # v1 | |
| if: success() || failure() | |
| with: | |
| name: Python Unit Tests | |
| path: test-results.xml | |
| reporter: java-junit | |
| fail-on-error: false | |
| - name: Build package | |
| run: uv build | |
| all-matrix-jobs-passed: | |
| runs-on: ubuntu-latest | |
| needs: build | |
| if: always() | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - name: Verify all matrix jobs succeeded | |
| run: | | |
| if [ "${{ needs.build.result }}" != "success" ]; then | |
| echo "❌ Some matrix jobs of 'build' failed or were cancelled." | |
| exit 1 | |
| fi | |
| echo "✅ All matrix jobs passed!" |