fix(ci): use renamed package in coverage flag, smoke step, bandit scope #21
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [master, main] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| name: test (Python ${{ matrix.python-version }} / ${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.9", "3.10", "3.11", "3.12"] | |
| os: [ubuntu-latest] | |
| include: | |
| - python-version: "3.12" | |
| os: macos-latest | |
| - python-version: "3.12" | |
| os: windows-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| cache: pip | |
| - name: Install | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e .[dev] | |
| - name: Test | |
| run: pytest -v --cov=aemo_mdff_reader --cov-report=term-missing --cov-report=xml | |
| - name: Wheel install + import smoke | |
| if: matrix.python-version == '3.12' && runner.os == 'Linux' | |
| run: | | |
| python -m pip install --upgrade pip build | |
| python -m build --wheel | |
| python -m venv /tmp/smoke | |
| /tmp/smoke/bin/pip install dist/*.whl | |
| /tmp/smoke/bin/python -c "import aemo_mdff_reader; print(aemo_mdff_reader.__version__)" | |
| /tmp/smoke/bin/aemo-mdff-reader --version | |
| lint: | |
| name: ruff | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| cache: pip | |
| - run: | | |
| python -m pip install --upgrade pip | |
| pip install ruff | |
| - run: ruff check . | |
| - run: ruff format --check . | |
| typecheck: | |
| name: mypy --strict | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| cache: pip | |
| - run: | | |
| python -m pip install --upgrade pip | |
| pip install -e .[dev] | |
| - run: mypy | |
| security: | |
| name: security (pip-audit + bandit) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| cache: pip | |
| - run: | | |
| # Pre-upgrade build tooling so we audit the latest CVE-clean | |
| # baseline (otherwise we may flag CVEs in setup-python's bundled | |
| # pip / setuptools rather than anything we introduced). | |
| python -m pip install --upgrade pip setuptools wheel | |
| pip install pip-audit bandit | |
| - name: Audit our declared dependencies for known CVEs | |
| # We have no required runtime deps; this audits dev extras + tooling. | |
| run: pip-audit --skip-editable | |
| - name: Bandit static security analysis | |
| # The legacy aemo_mdff_reader.sql module is opt-in (extras_require=mysql) | |
| # and not refactored in v2 — exclude it from this scan, same as mypy | |
| # and ruff. We scan the new core (parser, types, reader, cli). | |
| run: bandit -r aemo_mdff_reader -ll --exclude aemo_mdff_reader/sql | |
| build: | |
| name: build sdist + wheel | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - run: python -m pip install --upgrade pip build twine | |
| - run: python -m build | |
| - run: twine check --strict dist/* | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: dist | |
| path: dist/ |