git-nested/.github/workflows/test.yml at main · readncode/git-nested · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
name: Run Tests

on:
  push:
    branches: [main]
  pull_request:
    branches: ['**']
  # daily on main (scheduled runs always use the default branch), so a
  # breaking change in a dependency, runner image or upstream download shows
  # up even on a day without any commit
  schedule:
    - cron: '0 18 * * *'
      timezone: Europe/Berlin
  # by hand for any branch: 'Run workflow' in the Actions tab, or
  # `gh workflow run test.yml --ref <branch>`
  workflow_dispatch:

# One run per branch/PR at a time. On a PR a newer push cancels the run in
# progress: only the newest commit's results matter there, and waiting for a
# superseded run would hold its checks back by the length of a whole run. On
# main every run finishes, so each merged commit keeps its full results (a
# newer push waits; only the newest waiting run is kept).
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  # Builds the standalone executable with the very script the release uses
  # (scripts/create-python-exe.sh), so a change that breaks the freeze -- a new
  # import, a moved data file -- fails here rather than on release day. All
  # three targets, because a break is usually a break on one of them only. The
  # script smoke-tests each binary it produces; release-binary.yml additionally
  # runs the Linux one across distros before attaching it to a release.
  binary:
    strategy:
      fail-fast: false
      matrix:
        include:
          # Intel macOS is deliberately absent: those runners are gone, and
          # the arm64 binary is what a current Mac needs.
          - target: linux
            runs-on: ubuntu-26.04
            container: almalinux:8
          - target: macos
            runs-on: macos-latest
            container: ''
          - target: windows
            runs-on: windows-latest
            container: ''
    uses: ./.github/workflows/build-binary.yml
    with:
      artifact: git-nested-binary-ci-${{ matrix.target }}
      runs-on: ${{ matrix.runs-on }}
      container: ${{ matrix.container }}

  # ... and then runs the full pytest suite through the Linux executable, so a
  # binary that builds but does not work still fails the PR. Linux only: the
  # suite is the same suite either way, and what it is checking here is that
  # freezing did not drop anything -- a per-platform answer the smoke test in
  # create-python-exe.sh already gives for the other two.
  binary-test:
    needs: binary
    uses: ./.github/workflows/test-binary.yml
    with:
      artifact: git-nested-binary-ci-linux

  test:
    runs-on: ${{ matrix.os }}
    # The steps are written for bash; on windows-latest the default would be
    # PowerShell. Git for Windows ships bash on every runner.
    defaults:
      run:
        shell: bash
    strategy:
      # One OS failing must not cancel the others: a Windows-only break should
      # still show whether Linux and macOS pass.
      fail-fast: false
      matrix:
        os: [ubuntu-26.04, macos-latest, windows-latest]
        python-version: ['3.10', '3.11', '3.12', '3.13', '3.14']

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          # SonarCloud's blame-based analysis (new-code detection, issue
          # authorship) needs real history, not the default shallow, tagless
          # checkout.
          fetch-depth: 0
      - name: Install uv
        uses: astral-sh/setup-uv@v10.3.3
        with:
          python-version: ${{ matrix.python-version }}
          enable-cache: true
      - name: Setup project
        run: uv sync --frozen
      - name: git config
        run: |
          git config --global user.email "you@example.com";
          git config --global user.name "Your Name";
          git config --global init.defaultBranch "master";
          git config --global --add safe.directory "$PWD";
          git config --global --add safe.directory "$PWD.git";
      - name: Run poe all
        run: uv run poe all
      - name: Upload coverage reports to Codecov
        if: matrix.os == 'ubuntu-26.04' && matrix.python-version == '3.14'
        uses: codecov/codecov-action@v7
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
      - name: Upload test results to Codecov
        if: ${{ !cancelled() }}
        uses: codecov/codecov-action@v7
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          report_type: test_results
          files: junit.xml
      - name: SonarCloud Scan
        if: matrix.os == 'ubuntu-26.04' && matrix.python-version == '3.14'
        uses: SonarSource/sonarqube-scan-action@v8
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}