Repository navigation
chore(release): 3.4.0 #232
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: python-tests | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "socket_basics/**/*.py" | |
| - "tests/**/*.py" | |
| - "tests/fixtures/**" | |
| - "socket_basics/rules/**" | |
| - "pyproject.toml" | |
| - "uv.lock" | |
| - "action.yml" | |
| - "README.md" | |
| - "docs/**/*.md" | |
| - "scripts/check_release_docs.py" | |
| - "scripts/prep_release.py" | |
| - "scripts/sync_release_version.py" | |
| - ".github/workflows/python-tests.yml" | |
| pull_request: | |
| paths: | |
| - "socket_basics/**/*.py" | |
| - "tests/**/*.py" | |
| - "tests/fixtures/**" | |
| - "socket_basics/rules/**" | |
| - "pyproject.toml" | |
| - "uv.lock" | |
| - "action.yml" | |
| - "README.md" | |
| - "docs/**/*.md" | |
| - "scripts/check_release_docs.py" | |
| - "scripts/prep_release.py" | |
| - "scripts/sync_release_version.py" | |
| - ".github/workflows/python-tests.yml" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: python-tests-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 1 | |
| persist-credentials: false | |
| - name: 🐍 Setup Python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.12" | |
| cache: "pip" | |
| - name: 🛠️ Install deps | |
| # `uv sync --locked` installs exactly the versions in uv.lock, so tests | |
| # run against the locked dependency set (not a fresh pip resolution). | |
| run: | | |
| python -m pip install --upgrade pip uv | |
| uv sync --locked --extra dev | |
| - name: 🔎 Install opengrep | |
| # The Java rule regression tests skip when opengrep is not on PATH. | |
| # Install the exact release the images ship (the Dockerfile ARG) so the | |
| # tests exercise the engine users get, and require it below so a broken | |
| # install fails the job instead of quietly skipping the module. | |
| run: | | |
| version="$(sed -n 's/^ARG OPENGREP_VERSION=//p' Dockerfile)" | |
| test -n "$version" | |
| install -d "$RUNNER_TEMP/opengrep" | |
| curl -fsSL --retry 3 -o "$RUNNER_TEMP/opengrep/opengrep" \ | |
| "https://github.com/opengrep/opengrep/releases/download/${version}/opengrep_manylinux_x86" | |
| chmod +x "$RUNNER_TEMP/opengrep/opengrep" | |
| echo "$RUNNER_TEMP/opengrep" >> "$GITHUB_PATH" | |
| "$RUNNER_TEMP/opengrep/opengrep" --version | |
| - name: 🔐 Assert uv.lock is in sync with pyproject.toml | |
| # Catches dependency PRs (Dependabot or maintainer) that change | |
| # pyproject.toml without regenerating the lock, or vice versa. | |
| run: uv lock --locked | |
| - name: 🔒 Assert release version metadata is in sync | |
| run: python3 scripts/sync_release_version.py --check | |
| - name: 📚 Assert current-release docs are in sync | |
| run: python3 scripts/check_release_docs.py --check | |
| - name: 🧪 Run tests | |
| env: | |
| SOCKET_BASICS_REQUIRE_OPENGREP: "1" | |
| run: uv run --no-sync pytest -q tests/ |