chore(deps): bump pyright from 1.1.409 to 1.1.410 #68
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| # Note: matrix.* and github.ref/github.workflow are trusted, non-attacker-controlled. | |
| # No usage of github.event.{issue,pull_request,comment,review}.* in any run: step. | |
| # Actions are pinned to full commit SHAs (repo policy: sha_pinning_required). | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| name: test (py${{ matrix.python-version }} / ${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| python-version: ["3.11", "3.12", "3.13", "3.14"] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | |
| with: | |
| # Pin uv so CI resolves uv.lock identically to local -- required for | |
| # the `uv sync --locked` guard to be reliable (lock revision is | |
| # uv-version-tied). | |
| version: "0.11.17" | |
| enable-cache: true | |
| python-version: ${{ matrix.python-version }} | |
| # Route PyPI installs through Takumi Guard (blocks known-malicious | |
| # packages before they execute; sets UV_INDEX_URL/PIP_INDEX_URL to the | |
| # screened registry for this job). Blocking-only mode, no account needed. | |
| # Must precede any uv/pip install. | |
| - name: Route installs through Takumi Guard | |
| uses: flatt-security/setup-takumi-guard-pypi@733047c120b6377fa05fb77f714df8d8cd3a41a9 # v1.0.1 | |
| # --locked fails if uv.lock drifts from pyproject.toml (e.g. a version | |
| # bump that forgot to sync the lock), catching it before a release tag. | |
| - name: Install (locked; dev + cli + teds extras) | |
| run: uv sync --locked --extra dev --extra cli --extra teds | |
| - name: Lint (ruff check + format) | |
| run: | | |
| uv run ruff check src/ tests/ | |
| uv run ruff format --check src/ tests/ | |
| - name: Type check (pyright strict) | |
| run: uv run pyright src/ tests/ | |
| - name: Unit tests (pytest) | |
| run: uv run pytest tests/ -v | |
| # Regenerate the codec-derived docs and fail if they drift from what is | |
| # committed (the `just docs-check` gate, run once on a single matrix leg). | |
| - name: Docs up to date (generated tables) | |
| if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.13' | |
| run: | | |
| uv run python scripts/gen_format_support.py | |
| uv run python scripts/gen_loss_matrix.py | |
| git diff --quiet docs/format_support.md docs/loss_matrix.md \ | |
| || { echo "docs/{format_support,loss_matrix}.md is stale; run 'just docs'"; exit 1; } | |
| semgrep: | |
| name: semgrep (rules + core scan) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - name: Install semgrep | |
| run: pipx install semgrep | |
| - name: Test semgrep rules (rule correctness, not real code) | |
| run: semgrep test .semgrep/rules/ | |
| - name: Scan source with semgrep meta-rules | |
| run: semgrep --config .semgrep/rules/ --error src/ | |
| pip-install-check: | |
| name: pip install -e . | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - name: Set up Python 3.11 | |
| uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 | |
| with: | |
| python-version: "3.11" | |
| - name: Install (no extras) — verifies core stays stdlib-only at import time | |
| run: | | |
| python -m venv .venv-check | |
| .venv-check/bin/python -m pip install --upgrade pip | |
| .venv-check/bin/python -m pip install -e . | |
| .venv-check/bin/python -c "import tablecodec; print(tablecodec.__version__)" |