Bump actions/checkout from 4 to 7 #4
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| schedule: | |
| # Weekly (Mon 06:00 UTC) so pip-audit catches newly disclosed CVEs even | |
| # without a code change. | |
| - cron: "0 6 * * 1" | |
| jobs: | |
| lint: | |
| name: Ruff (lint + format) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install ruff | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e ".[dev]" | |
| - name: Ruff lint | |
| run: ruff check . | |
| # Report-only for now: `ruff format` would restyle a large part of the | |
| # tree. Run `ruff format` once and commit it, then remove | |
| # `continue-on-error` to make formatting a blocking gate. | |
| - name: Ruff format (check only) | |
| continue-on-error: true | |
| run: ruff format --check . | |
| typecheck: | |
| name: Pyright | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install package + pyright | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e ".[dev]" | |
| # Report-only for now: the codebase has pre-existing type findings. | |
| # Remove `continue-on-error` to make Pyright a blocking gate once | |
| # `pyright` reports zero errors. | |
| - name: Pyright | |
| continue-on-error: true | |
| run: pyright | |
| test: | |
| name: Tests (py${{ matrix.python-version }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.11", "3.12", "3.13"] | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e . "coverage[toml]>=7.0" | |
| - name: Run tests with coverage | |
| run: coverage run -m unittest discover -s tests -v | |
| # `coverage report` enforces `fail_under` from pyproject.toml (90%), | |
| # so an insufficiently-tested change fails this job. | |
| - name: Coverage report (enforces fail_under) | |
| run: coverage report | |
| - name: Coverage XML | |
| if: always() | |
| run: coverage xml | |
| - name: Upload coverage report | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: coverage-${{ matrix.python-version }} | |
| path: coverage.xml | |
| if-no-files-found: ignore | |
| package: | |
| name: Build wheel, install & CLI smoke test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Build sdist + wheel | |
| run: | | |
| python -m pip install --upgrade pip build | |
| python -m build | |
| - name: Install the built wheel into a clean venv | |
| run: | | |
| python -m venv /tmp/wheeltest | |
| # Install ONLY from the built wheel (no source tree / editable install) | |
| /tmp/wheeltest/bin/pip install --upgrade pip | |
| /tmp/wheeltest/bin/pip install dist/*.whl | |
| - name: CLI smoke test | |
| # Run from a neutral directory: if we ran inside the checkout, the | |
| # source `python_agent_harness/` tree would shadow the installed wheel | |
| # on sys.path and we'd be testing the source, not the built artifact. | |
| working-directory: /tmp | |
| run: | | |
| set -euxo pipefail | |
| BIN=/tmp/wheeltest/bin/python-agent-harness | |
| # Console script is installed and importable | |
| "$BIN" --help | |
| # Config subcommand runs without any API key / network | |
| "$BIN" config | |
| # Module entry point works too | |
| /tmp/wheeltest/bin/python -m python_agent_harness --help | |
| # Import resolves to the INSTALLED wheel + bundled prompts shipped | |
| /tmp/wheeltest/bin/python - <<'PY' | |
| import importlib.resources as r | |
| import python_agent_harness | |
| loc = python_agent_harness.__file__ | |
| assert "site-packages" in loc, f"imported source, not wheel: {loc}" | |
| agent = r.files("python_agent_harness").joinpath("prompts/agent.md") | |
| assert agent.is_file(), "bundled prompt missing from wheel" | |
| print("wheel import OK:", loc) | |
| print("bundled prompt OK:", agent) | |
| PY | |
| - name: Upload distributions | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: dist | |
| path: dist/* | |
| audit: | |
| name: pip-audit (dependency CVEs) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install pip-audit | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install "pip-audit>=2.7" | |
| # Audit the PROJECT's dependency closure resolved from pyproject.toml | |
| # (rich, httpx, prompt_toolkit + transitives) — NOT the whole runner | |
| # environment, which would flag unrelated tooling like pip/setuptools. | |
| # Record accepted/unfixable advisories with `--ignore-vuln <ID>`. | |
| - name: pip-audit | |
| run: pip-audit . --strict --progress-spinner=off |