cometapi-python/.github/workflows/ci.yml at main · cometapi-dev/cometapi-python · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
name: CI

on:
  pull_request:
  push:
    branches:
      - main
  schedule:
    - cron: "23 4 * * 1"

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  UV_VERSION: 0.11.8

jobs:
  quality:
    name: Offline quality and workflow checks
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Check out the candidate
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.14"
      - name: Install the pinned uv frontend
        run: python -m pip install --disable-pip-version-check "uv==$UV_VERSION"
      - name: Check lock consistency
        run: uv lock --check
      - name: Reproduce the locked environment
        run: uv sync --locked
      - name: Lint
        run: uv run ruff check src tests scripts
      - name: Check formatting
        run: uv run ruff format --check src tests scripts
      - name: Type check
        run: uv run pyright
      - name: Run offline unit and contract tests
        run: uv run pytest -m "not live"
      - name: Select latest OpenAI within the supported major
        run: uv pip install --python .venv/bin/python --upgrade "openai>=2.45.0,<3.0.0"
      - name: Run latest-within-major tests without resyncing the lock
        run: uv run --no-sync pytest -m "not live"
      - name: Check version agreement and durable public content
        run: uv run python scripts/check_version.py --require-changelog --require-public-preview-docs
      - name: Scan for credentials and scope mistakes
        run: uv run python scripts/check_secrets.py
      - name: Validate workflow syntax with checksum-pinned actionlint
        run: uv run python scripts/run_actionlint.py
      - name: Verify release-workflow trust semantics
        run: uv run python scripts/check_workflows.py

  locked-runtime:
    name: Locked dependencies / Python ${{ matrix.python-version }}
    runs-on: ubuntu-latest
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
    steps:
      - name: Check out the candidate
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install the pinned uv frontend
        run: python -m pip install --disable-pip-version-check "uv==$UV_VERSION"
      - name: Reproduce the locked environment
        run: uv sync --locked
      - name: Run offline tests
        run: uv run pytest -m "not live"

  minimum-openai:
    name: Minimum OpenAI / Python 3.10
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Check out the candidate
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.10"
      - name: Install the pinned uv frontend
        run: python -m pip install --disable-pip-version-check "uv==$UV_VERSION"
      - name: Create the development environment
        run: uv sync --locked
      - name: Select the minimum supported OpenAI dependency
        run: uv pip install --python .venv/bin/python "openai==2.45.0"
      - name: Run offline tests without resyncing the lock
        run: uv run --no-sync pytest -m "not live"

  package:
    name: Build, inspect, and clean-install exact artifacts
    needs: [quality, locked-runtime, minimum-openai]
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - name: Check out the candidate
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.14"
      - name: Install the pinned uv frontend
        run: python -m pip install --disable-pip-version-check "uv==$UV_VERSION"
      - name: Reproduce the locked environment
        run: uv sync --locked
      - name: Build wheel and source distribution
        run: uv build
      - name: Check package metadata rendering
        run: uv run twine check dist/*
      - name: Inspect artifact identity and shape
        run: uv run python scripts/check_artifacts.py dist/*
      - name: Install and smoke-test each exact artifact
        run: uv run python scripts/check_clean_install.py dist/*
      - name: Record immutable artifact digests
        run: sha256sum dist/* > artifact-sha256.txt
      - name: Retain verified artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: python-distributions
          path: |
            dist/*
            artifact-sha256.txt
          if-no-files-found: error
          retention-days: 7

  standalone:
    name: Standalone copied-checkout verification
    needs: package
    runs-on: ubuntu-latest
    timeout-minutes: 35
    steps:
      - name: Check out the candidate
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.14"
      - name: Install the pinned uv frontend
        run: python -m pip install --disable-pip-version-check "uv==$UV_VERSION"
      - name: Verify from a copied standalone repository
        run: python scripts/check_repository_independence.py
      - name: Download the verified package artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: python-distributions
          path: verified-artifacts
      - name: Recheck retained artifact digests
        working-directory: verified-artifacts
        run: sha256sum --check artifact-sha256.txt