gcore-python/.github/workflows/ci.yml at main · G-Core/gcore-python · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
name: CI
on:
  # Keep push limited to `main` so a branch SHA gets exactly one check run,
  # from the `pull_request` event. Two runs for one SHA let a required check
  # pass on the skipped one (actions/runner#1085).
  push:
    branches:
      - main
  pull_request:
    branches-ignore:
      - 'stl-preview-head/**'
      - 'stl-preview-base/**'
  # stlc-config dispatches this for preview branches, which never get a pull
  # request here, so a preview SHA still gets exactly one run
  workflow_dispatch: {}

jobs:
  lint:
    timeout-minutes: 10
    name: lint
    runs-on: ubuntu-latest
    # Metadata-only commits land straight on `main` and change no code.
    if: github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata'
    steps:
      # v7 adds current checkout fixes while the full SHA keeps the runner dependency immutable.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install verified uv before Rye bootstrap (eMudhra trust store fix)
        # make Rye use the fixed trust store while installing its own environment
        run: |
          set -euo pipefail
          url="https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/uv-x86_64-unknown-linux-gnu.tar.gz"
          curl --proto '=https' --tlsv1.2 -fsSL -o /tmp/uv.tar.gz "$url"
          echo "${UV_SHA256}  /tmp/uv.tar.gz" | sha256sum -c -
          mkdir -p "$HOME/.rye/uv/0.6.3" /tmp/uv-extract
          tar -xzf /tmp/uv.tar.gz -C /tmp/uv-extract --strip-components=1
          install -m 0755 /tmp/uv-extract/uv "$HOME/.rye/uv/0.6.3/uv"
          "$HOME/.rye/uv/0.6.3/uv" --version
        env:
          UV_VERSION: '0.13.5'
          UV_SHA256: 'f68d291c75783122dad58ab77def0e13f3233f358731db5d6d7e8715603b928f'

      - name: Install Rye
        run: |
          curl -sSf https://rye.astral.sh/get | bash
          echo "$HOME/.rye/shims" >> $GITHUB_PATH
        env:
          RYE_VERSION: '0.44.0'
          RYE_INSTALL_OPTION: '--yes'

      - name: Replace Rye's bundled uv (eMudhra trust store fix)
        run: |
          set -euo pipefail
          shopt -s nullglob
          bundled_uvs=("$HOME"/.rye/uv/*/uv)
          [ "${#bundled_uvs[@]}" -gt 0 ] || { echo "No Rye-bundled uv found"; exit 1; }
          for bin in "${bundled_uvs[@]}"; do
            install -m 0755 /tmp/uv-extract/uv "$bin"
            "$bin" --version
          done

      - name: Install dependencies
        run: rye sync --all-features

      - name: Run lints
        run: ./scripts/lint

  build:
    # Metadata-only commits land straight on `main` and change no code.
    if: github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata'
    timeout-minutes: 10
    name: build
    permissions:
      contents: read
      id-token: write
    runs-on: ubuntu-latest
    steps:
      # v7 adds current checkout fixes while the full SHA keeps the runner dependency immutable.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install verified uv before Rye bootstrap (eMudhra trust store fix)
        # make Rye use the fixed trust store while installing its own environment
        run: |
          set -euo pipefail
          url="https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/uv-x86_64-unknown-linux-gnu.tar.gz"
          curl --proto '=https' --tlsv1.2 -fsSL -o /tmp/uv.tar.gz "$url"
          echo "${UV_SHA256}  /tmp/uv.tar.gz" | sha256sum -c -
          mkdir -p "$HOME/.rye/uv/0.6.3" /tmp/uv-extract
          tar -xzf /tmp/uv.tar.gz -C /tmp/uv-extract --strip-components=1
          install -m 0755 /tmp/uv-extract/uv "$HOME/.rye/uv/0.6.3/uv"
          "$HOME/.rye/uv/0.6.3/uv" --version
        env:
          UV_VERSION: '0.13.5'
          UV_SHA256: 'f68d291c75783122dad58ab77def0e13f3233f358731db5d6d7e8715603b928f'

      - name: Install Rye
        run: |
          curl -sSf https://rye.astral.sh/get | bash
          echo "$HOME/.rye/shims" >> $GITHUB_PATH
        env:
          RYE_VERSION: '0.44.0'
          RYE_INSTALL_OPTION: '--yes'

      - name: Replace Rye's bundled uv (eMudhra trust store fix)
        run: |
          set -euo pipefail
          shopt -s nullglob
          bundled_uvs=("$HOME"/.rye/uv/*/uv)
          [ "${#bundled_uvs[@]}" -gt 0 ] || { echo "No Rye-bundled uv found"; exit 1; }
          for bin in "${bundled_uvs[@]}"; do
            install -m 0755 /tmp/uv-extract/uv "$bin"
            "$bin" --version
          done

      - name: Install dependencies
        run: rye sync --all-features

      - name: Run build
        run: rye build

  # The generator only emits this job when the spec has a hosted URL, which stlc
  # does not set. scripts/mock serves the embedded spec, so the job runs without one.
  test:
    timeout-minutes: 10
    name: test
    runs-on: ubuntu-latest
    # Metadata-only commits land straight on `main` and change no code.
    if: github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata'
    steps:
      # v7 adds current checkout fixes while the full SHA keeps the runner dependency immutable.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install verified uv before Rye bootstrap (eMudhra trust store fix)
        # make Rye use the fixed trust store while installing its own environment
        run: |
          set -euo pipefail
          url="https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/uv-x86_64-unknown-linux-gnu.tar.gz"
          curl --proto '=https' --tlsv1.2 -fsSL -o /tmp/uv.tar.gz "$url"
          echo "${UV_SHA256}  /tmp/uv.tar.gz" | sha256sum -c -
          mkdir -p "$HOME/.rye/uv/0.6.3" /tmp/uv-extract
          tar -xzf /tmp/uv.tar.gz -C /tmp/uv-extract --strip-components=1
          install -m 0755 /tmp/uv-extract/uv "$HOME/.rye/uv/0.6.3/uv"
          "$HOME/.rye/uv/0.6.3/uv" --version
        env:
          UV_VERSION: '0.13.5'
          UV_SHA256: 'f68d291c75783122dad58ab77def0e13f3233f358731db5d6d7e8715603b928f'

      - name: Install Rye
        run: |
          curl -sSf https://rye.astral.sh/get | bash
          echo "$HOME/.rye/shims" >> $GITHUB_PATH
        env:
          RYE_VERSION: '0.44.0'
          RYE_INSTALL_OPTION: '--yes'

      - name: Replace Rye's bundled uv (eMudhra trust store fix)
        run: |
          set -euo pipefail
          shopt -s nullglob
          bundled_uvs=("$HOME"/.rye/uv/*/uv)
          [ "${#bundled_uvs[@]}" -gt 0 ] || { echo "No Rye-bundled uv found"; exit 1; }
          for bin in "${bundled_uvs[@]}"; do
            install -m 0755 /tmp/uv-extract/uv "$bin"
            "$bin" --version
          done

      - name: Bootstrap
        run: ./scripts/bootstrap

      - name: Run tests
        run: ./scripts/test