test(setup): assert stalled preflight outcome #172
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main, district-main] | |
| pull_request: | |
| branches: [district-main] | |
| workflow_dispatch: {} | |
| # Every job here only checks out, installs, vendors the GAM binary and runs pytest — nothing writes | |
| # back to the repo, so read-only content access is all GITHUB_TOKEN needs (it is also what the | |
| # fetch_gam.sh api.github.com calls authenticate with, purely to dodge the anonymous 60/hr limit). | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| name: test (${{ matrix.os }}, py${{ matrix.python }}) | |
| timeout-minutes: 20 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| python: ["3.10", "3.12", "3.14"] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: ${{ matrix.python }} | |
| - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 | |
| with: | |
| version: "0.11.7" | |
| - name: Sync locked environment | |
| run: uv sync --frozen --python "$(which python)" --extra dev | |
| - name: Run offline suite | |
| run: .venv/bin/pytest -q | |
| windows-test: | |
| name: Windows test (py${{ matrix.python }}) | |
| runs-on: windows-latest | |
| timeout-minutes: 25 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python: ["3.10", "3.12", "3.14"] | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: ${{ matrix.python }} | |
| - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 | |
| with: | |
| version: "0.11.7" | |
| - name: Sync locked environment | |
| shell: pwsh | |
| run: uv sync --frozen --python (Get-Command python).Source --extra dev | |
| - name: Run offline suite with Windows ACL checks | |
| shell: pwsh | |
| run: .venv\Scripts\pytest.exe -q | |
| gam-compat: | |
| name: gam-compat (pinned binary) | |
| runs-on: macos-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: "3.14" | |
| - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 | |
| with: | |
| version: "0.11.7" | |
| - name: Sync locked environment | |
| run: uv sync --frozen --python "$(which python)" --extra dev | |
| - name: Vendor pinned GAM7 | |
| run: ./scripts/fetch_gam.sh | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Verify pin and command contract | |
| run: | | |
| .venv/bin/python - <<'PY' | |
| import pathlib | |
| from gamgui.core.gam.commands import EXPECTED_GAM_VERSION | |
| version = pathlib.Path("gamgui/resources/gam7/VERSION").read_text() | |
| assert EXPECTED_GAM_VERSION in version | |
| PY | |
| .venv/bin/pytest -q tests/test_command_contract.py | |
| gam-latest-preview: | |
| name: gam-compat (latest preview) | |
| runs-on: macos-latest | |
| continue-on-error: true | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: "3.14" | |
| - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 | |
| with: | |
| version: "0.11.7" | |
| - name: Sync locked environment | |
| run: uv sync --frozen --python "$(which python)" --extra dev | |
| - name: Test latest GAM7 command tokens | |
| run: | | |
| LATEST="$(gh api repos/GAM-team/GAM/releases/latest --jq .tag_name)" | |
| .venv/bin/python scripts/bump_gam.py --tag "$LATEST" | |
| .venv/bin/pytest -q tests/test_command_contract.py tests/test_bump_gam.py | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| macos-build-smoke: | |
| name: macOS application build smoke (${{ matrix.profile }}) | |
| runs-on: macos-latest | |
| timeout-minutes: 30 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| profile: [core, classroom-oneroster] | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: "3.12" | |
| - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 | |
| with: | |
| version: "0.11.7" | |
| - name: Build application | |
| run: | | |
| make setup PYTHON="$(which python)" | |
| make gam | |
| make app PROFILE="${{ matrix.profile }}" | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Offline bundle self-test | |
| run: dist/GamGUI.app/Contents/MacOS/GamGUI --self-test --json | |
| macos-build-smoke-required: | |
| name: macOS application build smoke | |
| if: ${{ always() }} | |
| needs: macos-build-smoke | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Require every application profile build | |
| env: | |
| MATRIX_RESULT: ${{ needs.macos-build-smoke.result }} | |
| run: test "$MATRIX_RESULT" = "success" | |
| windows-build-smoke: | |
| name: Windows application build smoke (${{ matrix.profile }}) | |
| runs-on: windows-latest | |
| timeout-minutes: 40 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| profile: [core, classroom-oneroster] | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: "3.12" | |
| - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 | |
| with: | |
| version: "0.11.7" | |
| - name: Sync locked build environment | |
| shell: pwsh | |
| run: uv sync --frozen --python (Get-Command python).Source --extra dev --extra desktop --extra build | |
| - name: Enroll ephemeral runner signing identity | |
| shell: pwsh | |
| run: | | |
| $identity = & .\scripts\windows_local_signing.ps1 -Action Enroll -CiEphemeralCertificate | ConvertFrom-Json | |
| "WINDOWS_SIGNER_SHA=$($identity.certificate_sha256)" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append | |
| - name: Build, sign, verify, and self-test validation-only bundle | |
| shell: pwsh | |
| run: .\scripts\build_windows_release.ps1 -Profile "${{ matrix.profile }}" -ExpectedSha "${{ github.sha }}" -CertificateSha256 $env:WINDOWS_SIGNER_SHA -CiEphemeralCertificate | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Upload validation-only bundle | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | |
| with: | |
| name: validation-only-windows-${{ matrix.profile }}-${{ github.sha }} | |
| path: | | |
| dist/GamGUI-0.0.1-windows-x86_64-${{ matrix.profile }}.zip | |
| dist/GamGUI-0.0.1-windows-x86_64-${{ matrix.profile }}.zip.sha256 | |
| if-no-files-found: error | |
| - name: Remove ephemeral runner signing identity | |
| if: ${{ always() }} | |
| shell: pwsh | |
| run: | | |
| if ($env:WINDOWS_SIGNER_SHA) { | |
| .\scripts\windows_local_signing.ps1 -Action Remove -CertificateSha256 $env:WINDOWS_SIGNER_SHA | |
| } | |
| windows-build-smoke-required: | |
| name: Windows application build smoke | |
| if: ${{ always() }} | |
| needs: windows-build-smoke | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Require every Windows application profile build | |
| env: | |
| MATRIX_RESULT: ${{ needs.windows-build-smoke.result }} | |
| run: test "$MATRIX_RESULT" = "success" | |
| dispatch-post-merge-validation: | |
| name: dispatch exact-SHA validation | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/district-main' | |
| needs: [test, windows-test, gam-compat, gam-latest-preview, macos-build-smoke-required, windows-build-smoke-required] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: write | |
| contents: read | |
| steps: | |
| - name: Validate and dispatch the exact district-main SHA | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| SHA: ${{ github.sha }} | |
| run: gh workflow run post-merge-validation.yml --repo "$GITHUB_REPOSITORY" --ref district-main -f sha="$SHA" | |
| report-automation-failure: | |
| name: report automated integration failure | |
| if: >- | |
| ${{ always() && github.event_name == 'workflow_dispatch' && | |
| startsWith(github.ref_name, 'automation/') && ( | |
| needs.test.result != 'success' || | |
| needs.windows-test.result != 'success' || | |
| needs.gam-compat.result != 'success' || | |
| needs.macos-build-smoke-required.result != 'success' || | |
| needs.windows-build-smoke-required.result != 'success' | |
| ) }} | |
| needs: [test, windows-test, gam-compat, gam-latest-preview, macos-build-smoke-required, windows-build-smoke-required] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| issues: write | |
| contents: read | |
| steps: | |
| - name: Open or update integration failure issue | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| BRANCH: ${{ github.ref_name }} | |
| SHA: ${{ github.sha }} | |
| RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | |
| run: | | |
| TITLE="Automated integration blocked" | |
| BODY="Required checks failed for \`$BRANCH\` at \`$SHA\`. Nothing was merged. Run: $RUN_URL" | |
| NUMBER="$(gh issue list --repo "$GITHUB_REPOSITORY" --state open --search "$TITLE in:title" --json number --jq '.[0].number // empty')" | |
| if [ -n "$NUMBER" ]; then | |
| gh issue comment "$NUMBER" --repo "$GITHUB_REPOSITORY" --body "$BODY" | |
| else | |
| gh issue create --repo "$GITHUB_REPOSITORY" --title "$TITLE" --body "$BODY" | |
| fi |