feat: migrate build/release tooling to uv + python-semantic-release #67
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,82 @@ | ||
| name: Test and Release | ||
|
|
||
| on: | ||
| push: | ||
| branches: [ main ] | ||
| paths-ignore: | ||
| - 'docs/**' | ||
| - '*.md' | ||
| pull_request: | ||
| branches: [ main ] | ||
|
Member
There was a problem hiding this comment. Question: both triggers here ( |
||
| paths-ignore: | ||
| - 'docs/**' | ||
| - '*.md' | ||
| workflow_dispatch: | ||
|
|
||
| jobs: | ||
| test: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Install uv | ||
| uses: astral-sh/setup-uv@v5 | ||
| with: | ||
| python-version: "3.11" | ||
| enable-cache: true | ||
|
|
||
| - name: Sync dependencies | ||
| run: uv sync | ||
|
|
||
| - name: Run tests | ||
| run: uv run pytest | ||
|
Comment on lines
+52
to
+53
There was a problem hiding this comment. 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/release.yml | sed -n '1,120p'
printf '%s\n' '--- project files ---'
git ls-files | sed -n '1,160p'
printf '%s\n' '--- packaging and test configuration ---'
for f in pyproject.toml setup.cfg setup.py tox.ini noxfile.py; do
if [ -f "$f" ]; then
printf '%s\n' "--- $f ---"
cat -n "$f" | sed -n '1,220p'
fi
done
printf '%s\n' '--- smoke test ---'
if [ -f tests/test_smoke.py ]; then
cat -n tests/test_smoke.py | sed -n '1,220p'
fiRepository: deployml-core/deployml Length of output: 14974 🏁 Script executed: #!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import re
workflow = Path(".github/workflows/release.yml").read_text()
pyproject = Path("pyproject.toml").read_text()
tests = sorted(str(p) for p in Path("tests").glob("test_*.py"))
print("smoke_test_present:", Path("tests/test_smoke.py").is_file())
print("test_files:", tests)
print("test_job_syncs:", bool(re.search(r"(?ms)^ test:.*?^\s+run: uv sync$", workflow)))
print("test_job_runs_pytest:", bool(re.search(r"(?ms)^ test:.*?^\s+run: uv run pytest$", workflow)))
print("release_builds_wheel:", "uv build" in pyproject)
print("release_build_command:")
match = re.search(r'(?ms)^\s*build_command\s*=\s*"""\n(.*?)\n\s*"""', pyproject)
print(match.group(1) if match else "<not found>")
PY
printf '%s\n' '--- repository status ---'
git status --short
printf '%s\n' '--- test references ---'
rg -n 'test_smoke|uv sync|uv build|semantic-release|editable' .github pyproject.toml tests README.md docs || trueRepository: deployml-core/deployml Length of output: 1631 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- smoke test and related tests ---'
cat -n tests/test_smoke.py | sed -n '1,140p'
printf '%s\n' '--- lockfile project entry ---'
rg -n -A18 -B4 'name = "deployml-core"|source = \{ editable' uv.lock || true
printf '%s\n' '--- relevant packaging docs ---'
cat -n docs/contributing.md | sed -n '1,60p'
printf '%s\n' '--- uv availability ---'
if command -v uv >/dev/null 2>&1; then
uv --version
else
printf '%s\n' 'uv unavailable in sandbox'
fiRepository: deployml-core/deployml Length of output: 5794 Test the built wheel before release.
🧰 Tools🪛 zizmor (1.29.0)[warning] 38-53: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block (excessive-permissions) 🤖 Prompt for AI Agents |
||
|
|
||
| release: | ||
| needs: test | ||
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | ||
| runs-on: ubuntu-latest | ||
| concurrency: | ||
| group: release | ||
| cancel-in-progress: false | ||
| permissions: | ||
| contents: write # semantic-release pushes the version commit + tag + GitHub Release | ||
| id-token: write # OIDC trusted publishing to PyPI (no token needed) | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 # semantic-release needs full history to analyse commits | ||
|
|
||
| - name: Install uv | ||
| uses: astral-sh/setup-uv@v5 | ||
| with: | ||
| python-version: "3.11" | ||
| enable-cache: true | ||
|
|
||
| - name: Sync dependencies | ||
| run: uv sync | ||
|
|
||
| - name: Python Semantic Release (bump, changelog, tag, build) | ||
| id: release | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| run: | | ||
| git config user.name "github-actions[bot]" | ||
| git config user.email "github-actions[bot]@users.noreply.github.com" | ||
| rm -rf dist | ||
| uv run semantic-release version | ||
| if ls dist/*.whl >/dev/null 2>&1; then | ||
| echo "released=true" >> "$GITHUB_OUTPUT" | ||
| else | ||
| echo "released=false" >> "$GITHUB_OUTPUT" | ||
| echo "No release-worthy commits since the last tag; skipping publish." | ||
| fi | ||
|
|
||
| - name: Publish to PyPI (trusted publishing) | ||
| if: steps.release.outputs.released == 'true' | ||
| run: uv publish | ||
|
|
||
| - name: Attach artifacts to the GitHub Release | ||
| if: steps.release.outputs.released == 'true' | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| run: uv run semantic-release publish | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,4 @@ | ||
| __pycache__ | ||
| .DS_Store | ||
| .terraform | ||
| .terraform.lock.hcl | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| """Smoke tests: verify the package installs and its version resolves. | ||
|
|
||
| These are intentionally minimal and run against whatever source is on `main`. | ||
| The broader unit suite currently lives on the `dev` branch and targets modules | ||
| not yet merged to `main`; it should be wired in once those land here. | ||
| """ | ||
|
|
||
| import importlib.metadata | ||
|
|
||
|
|
||
| def test_distribution_is_installed(): | ||
| """The built/installed distribution exposes a version (packaging works).""" | ||
| assert importlib.metadata.version("deployml-core") | ||
|
|
||
|
|
||
| def test_cli_get_version_resolves(): | ||
| """The CLI resolves its version from package metadata, not the fallback.""" | ||
| from deployml.cli.cli import get_version | ||
|
|
||
| version = get_version() | ||
| assert isinstance(version, str) | ||
| assert version not in ("", "version unknown") | ||
| assert version == importlib.metadata.version("deployml-core") |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: deployml-core/deployml
Length of output: 5901
Security Misconfiguration (CWE-269): Improper Privilege Management
Reachability: External
Set explicit baseline token permissions.
Add workflow-level
permissions: { contents: read }for the lint and test jobs. Keep the existing release-job override for publishing and release commits.🤖 Prompt for AI Agents
Source: Linters/SAST tools