Complete Public Preview pre-visibility validation #15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| schedule: | |
| - cron: "23 4 * * 1" | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| UV_VERSION: 0.11.8 | |
| jobs: | |
| quality: | |
| name: Offline quality and workflow checks | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - name: Check out the candidate | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.14" | |
| - name: Install the pinned uv frontend | |
| run: python -m pip install --disable-pip-version-check "uv==$UV_VERSION" | |
| - name: Check lock consistency | |
| run: uv lock --check | |
| - name: Reproduce the locked environment | |
| run: uv sync --locked | |
| - name: Lint | |
| run: uv run ruff check src tests scripts | |
| - name: Check formatting | |
| run: uv run ruff format --check src tests scripts | |
| - name: Type check | |
| run: uv run pyright | |
| - name: Run offline unit and contract tests | |
| run: uv run pytest -m "not live" | |
| - name: Check release version agreement | |
| run: uv run python scripts/check_version.py --expected 0.1.0a1 --require-changelog | |
| - name: Check canonical public content and identity | |
| run: uv run python scripts/check_version.py --require-public-preview-docs | |
| - name: Scan for credentials and scope mistakes | |
| run: uv run python scripts/check_secrets.py | |
| - name: Validate workflow syntax with checksum-pinned actionlint | |
| run: uv run python scripts/run_actionlint.py | |
| - name: Verify release-workflow trust semantics | |
| run: uv run python scripts/check_workflows.py | |
| locked-runtime: | |
| name: Locked dependencies / Python ${{ matrix.python-version }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"] | |
| steps: | |
| - name: Check out the candidate | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install the pinned uv frontend | |
| run: python -m pip install --disable-pip-version-check "uv==$UV_VERSION" | |
| - name: Reproduce the locked environment | |
| run: uv sync --locked | |
| - name: Run offline tests | |
| run: uv run pytest -m "not live" | |
| minimum-openai: | |
| name: Minimum OpenAI / Python 3.10 | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - name: Check out the candidate | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.10" | |
| - name: Install the pinned uv frontend | |
| run: python -m pip install --disable-pip-version-check "uv==$UV_VERSION" | |
| - name: Create the development environment | |
| run: uv sync --locked | |
| - name: Select the minimum supported OpenAI dependency | |
| run: uv pip install --python .venv/bin/python "openai==2.45.0" | |
| - name: Run offline tests without resyncing the lock | |
| run: uv run --no-sync pytest -m "not live" | |
| latest-openai: | |
| name: Latest OpenAI within major canary | |
| if: github.event_name == 'schedule' || github.actor == 'dependabot[bot]' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - name: Check out the candidate | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.14" | |
| - name: Install the pinned uv frontend | |
| run: python -m pip install --disable-pip-version-check "uv==$UV_VERSION" | |
| - name: Create the development environment | |
| run: uv sync --locked | |
| - name: Select latest OpenAI within the supported major | |
| run: uv pip install --python .venv/bin/python --upgrade "openai>=2.45.0,<3.0.0" | |
| - name: Run canary tests without resyncing the lock | |
| run: uv run --no-sync pytest -m "not live" | |
| package: | |
| name: Build, inspect, and clean-install exact artifacts | |
| needs: [quality, locked-runtime, minimum-openai] | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 25 | |
| steps: | |
| - name: Check out the candidate | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.14" | |
| - name: Install the pinned uv frontend | |
| run: python -m pip install --disable-pip-version-check "uv==$UV_VERSION" | |
| - name: Reproduce the locked environment | |
| run: uv sync --locked | |
| - name: Build wheel and source distribution | |
| run: uv build | |
| - name: Check package metadata rendering | |
| run: uv run twine check dist/* | |
| - name: Inspect artifact identity and shape | |
| run: uv run python scripts/check_artifacts.py dist/* | |
| - name: Install and smoke-test each exact artifact | |
| run: uv run python scripts/check_clean_install.py dist/* | |
| - name: Record immutable artifact digests | |
| run: sha256sum dist/* > artifact-sha256.txt | |
| - name: Retain verified artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: python-distributions | |
| path: | | |
| dist/* | |
| artifact-sha256.txt | |
| if-no-files-found: error | |
| retention-days: 7 | |
| standalone: | |
| name: Standalone copied-checkout verification | |
| needs: package | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 35 | |
| steps: | |
| - name: Check out the candidate | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.14" | |
| - name: Install the pinned uv frontend | |
| run: python -m pip install --disable-pip-version-check "uv==$UV_VERSION" | |
| - name: Verify from a copied standalone repository | |
| run: python scripts/check_repository_independence.py | |
| - name: Download the verified package artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: python-distributions | |
| path: verified-artifacts | |
| - name: Recheck retained artifact digests | |
| working-directory: verified-artifacts | |
| run: sha256sum --check artifact-sha256.txt |