feat(pr): add pull request listing (#37) #133
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| workflow_call: # invoked by release.yml as a gate before publishing | |
| pull_request: | |
| branches: [main] | |
| push: | |
| branches: [main] | |
| # Minimal default permissions; individual jobs can elevate if they need to. | |
| permissions: | |
| contents: read | |
| # Cancel superseded PR runs (push-to-main runs aren't cancelled, see cancel-in-progress). | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.14" | |
| - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 | |
| with: | |
| version-file: pyproject.toml | |
| - run: make lint | |
| test: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| python-version: ["3.14"] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 | |
| with: | |
| version-file: pyproject.toml | |
| # Invoke uv directly instead of `make test` — Windows runners don't have | |
| # make. Keep this command in sync with the `test` target in the Makefile. | |
| - run: uv run --extra dev python -m pytest tests -v | |
| docs-check: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.14" | |
| - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 | |
| with: | |
| version-file: pyproject.toml | |
| - run: make docs-check | |
| # Software-composition analysis: fail the build (and therefore any release, | |
| # since release.yml runs this workflow as a gate) on a known vulnerability of | |
| # medium severity or worse. | |
| scan: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 | |
| with: | |
| version-file: pyproject.toml | |
| # Export the hash-pinned production dependency set from uv.lock into a | |
| # dedicated directory holding only requirements.txt. Scanning that dir | |
| # (rather than the repo root) keeps grype from re-cataloguing uv.lock / | |
| # pyproject.toml — which carry the dev set — so the --no-dev scoping | |
| # actually holds and a dev-only CVE can't block a release. The non-empty | |
| # guard makes the gate fail loudly instead of passing on an empty export. | |
| - name: Export pinned production dependencies | |
| run: | | |
| mkdir -p sca-scope | |
| uv export --frozen --no-emit-project --no-dev --format requirements-txt --output-file sca-scope/requirements.txt | |
| - name: Fail if no dependencies were resolved | |
| run: test "$(grep -c '==' sca-scope/requirements.txt)" -gt 0 | |
| # Primary gate: scan only the exported production set, so a newly disclosed | |
| # CVE blocks the build even when the committed SBOM hasn't been regenerated. | |
| - name: Scan dependency tree | |
| uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0 | |
| with: | |
| path: "sca-scope" | |
| severity-cutoff: medium | |
| fail-build: true | |
| output-format: table | |
| # Independently verify the published SBOM artefact (production scope) is | |
| # itself free of known vulnerabilities — this is the file we attach to the | |
| # release and retain for our records. | |
| - name: Scan published SBOM (.oss-report) | |
| uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0 | |
| with: | |
| sbom: ".oss-report/bom.cyclonedx.json" | |
| severity-cutoff: medium | |
| fail-build: true | |
| output-format: table |