Repository navigation
chore(ci): add stage pipeline, pin pip/uv/deps, issue forms and make pr #893
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI-dev-pipeline | |
| # No paths filter: a required check that never starts leaves the PR pending forever. | |
| on: | |
| # A squash merge creates a SHA no PR run tested; stage can only require checks this run reports. | |
| push: | |
| branches: [dev] | |
| pull_request: | |
| branches-ignore: | |
| - main | |
| permissions: | |
| contents: read | |
| # PR runs supersede each other; push runs are grouped per SHA so a fast second merge never cancels the first. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.sha }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| defaults: | |
| run: | |
| # Explicit bash adds -o pipefail, so `| tee` keeps the tool's exit code. | |
| shell: bash | |
| jobs: | |
| ci-checks: | |
| # Pinned: ubuntu-26.04 has no Python 3.11.2 build. | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 15 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # Debian 12 bookworm python3, what the printers run. | |
| python-version: ["3.11.2"] | |
| test-type: [ruff, pylint, pytest, docstrcov, security] | |
| steps: | |
| - name: Checkout repo | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| cache: pip | |
| cache-dependency-path: | | |
| scripts/requirements.txt | |
| scripts/requirements-dev.txt | |
| - name: Install system dependencies | |
| if: matrix.test-type == 'pytest' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libgl1 libglib2.0-0 libegl1 | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install -r scripts/requirements-pip.txt | |
| pip install -r scripts/requirements.txt -r scripts/requirements-dev.txt | |
| # The fleet installs wheels only (sdbus aside), so a pin without an aarch64 wheel passes CI yet breaks every box. | |
| - name: Check pins have bookworm aarch64 wheels | |
| if: matrix.test-type == 'security' | |
| run: | | |
| # Bookworm glibc is 2.36; pip does not expand manylinux tags downwards, so list each one. | |
| plats=(--platform manylinux2014_aarch64) | |
| for m in $(seq 17 36); do plats+=(--platform "manylinux_2_${m}_aarch64"); done | |
| pip install --dry-run --quiet --ignore-installed --only-binary :all: "${plats[@]}" \ | |
| --python-version 3.11 --implementation cp --abi cp311 \ | |
| -r <(grep -v '^sdbus' scripts/requirements.txt) | |
| - name: Run ${{ matrix.test-type }} | |
| env: | |
| TEST_TYPE: ${{ matrix.test-type }} | |
| run: | | |
| case "$TEST_TYPE" in | |
| ruff) | |
| rc=0 | |
| ruff check --output-format=github --target-version=py311 --config=pyproject.toml 2>&1 | tee ruff-output.txt || rc=1 | |
| ruff format --diff --target-version=py311 --config=pyproject.toml 2>&1 | tee -a ruff-output.txt || rc=1 | |
| exit $rc | |
| ;; | |
| pylint) | |
| pylint -j"$(nproc)" --recursive=y BlocksScreen/ 2>&1 | tee pylint-output.txt | |
| ;; | |
| pytest) | |
| pytest tests/ --doctest-modules --junitxml=junit/test-results.xml --cov=BlocksScreen/ --cov-report=xml --cov-report=html 2>&1 | tee pytest-output.txt | |
| ;; | |
| docstrcov) | |
| docstr-coverage BlocksScreen/ --exclude '.*/BlocksScreen/lib/ui/.*?$' --fail-under=80 --skip-magic --skip-init --skip-private --skip-property 2>&1 | tee docstrcov-output.txt | |
| ;; | |
| security) | |
| bandit -c pyproject.toml -r . 2>&1 | tee security-output.txt | |
| ;; | |
| esac | |
| - name: Upload ${{ matrix.test-type }} report | |
| if: always() | |
| uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 | |
| with: | |
| name: ${{ matrix.test-type }}-results | |
| path: | | |
| *-output.txt | |
| junit/ | |
| coverage.xml | |
| htmlcov/ | |
| if-no-files-found: ignore |