v3-operator/.github/workflows/ci.yaml at master · stakewise/v3-operator · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
name: CI

on: [ push ]

jobs:
  pre-commit:
    name: Linting
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5

      - name: Set up python
        id: setup-python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: 3.12.12

      - name: Install Poetry
        uses: snok/install-poetry@76e04a911780d5b312d89783f7b1cd627778900a # v1
        with:
          version: 1.8.3
          virtualenvs-create: true
          virtualenvs-in-project: true
          installer-parallel: true

      - name: Cache Packages
        id: cache-packages
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: .venv
          key: venv-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('**/poetry.lock') }}

      # Install dependencies
      - name: Install dependencies
        if: steps.cache-packages.outputs.cache-hit != 'true'
        run: poetry install --no-interaction --no-root

      # Run precommit
      - name: Run precommit
        run: poetry run pre-commit run --all-files

      # Markdown lint
      - name: markdownlint-cli
        uses: nosborn/github-action-markdown-cli@9b5e871c11cc0649c5ac2526af22e23525fa344d # v3.3.0
        with:
          config_file: .markdownlint.yaml
          files: .
          dot: true
          ignore_files: .venv/
  test:
    name: Testing
    runs-on: ubuntu-latest
    env:
      ENVIRONMENT: test
    steps:
      - name: Checkout code
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5

      - name: Set up python
        id: setup-python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: 3.12.12

      - name: Install Poetry
        uses: snok/install-poetry@76e04a911780d5b312d89783f7b1cd627778900a # v1
        with:
          version: 1.8.3
          virtualenvs-create: true
          virtualenvs-in-project: true
          installer-parallel: true

      - name: Cache Packages
        id: cache-packages
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: .venv
          key: venv-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('**/poetry.lock') }}

      # Install dependencies
      - name: Install dependencies
        if: steps.cache-packages.outputs.cache-hit != 'true'
        run: poetry install --no-interaction --no-root

      # Run tests
      - name: Run tests
        run: poetry run coverage run -m pytest src

      # Check coverage
      - name: Check test coverage
        run: poetry run coverage report

  security:
    name: pip-audit
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5

      - name: Set up python
        id: setup-python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: 3.12.12

      - name: Install Poetry
        uses: snok/install-poetry@76e04a911780d5b312d89783f7b1cd627778900a # v1
        with:
          version: 1.8.3
          virtualenvs-create: true
          virtualenvs-in-project: true
          installer-parallel: true

      - name: Cache Packages
        id: cache-packages
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: .venv
          key: venv-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('**/poetry.lock') }}

      - name: Install dependencies
        if: steps.cache-packages.outputs.cache-hit != 'true'
        run: poetry install --no-interaction --no-root

      - name: Export requirements
        # Drop git-sourced deps: pip-audit only checks PyPI and skips them anyway, and
        # keeping them causes resolution conflicts (e.g. milagro pinned by commit here but
        # by tag in sw-utils' metadata).
        run: poetry export -f requirements.txt --without-hashes | grep -v "git+" > audit_requirements.txt

      # Run audit
      - uses: pypa/gh-action-pip-audit@3ac8fed01c7b32ab70210f182e557d4cb8c45fec # v1.0.7
        with:
          inputs: audit_requirements.txt