chore(deps): bump ruff in /requirements in the ci-requirements group … #242
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| name: test (Python ${{ matrix.python-version }} / ${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.12"] | |
| os: [ubuntu-latest] | |
| include: | |
| - python-version: "3.12" | |
| os: macos-latest | |
| - python-version: "3.12" | |
| os: windows-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| cache: pip | |
| - name: Install dev deps (hash-pinned) and the package itself (editable) | |
| # ``--require-hashes`` satisfies Scorecard's PinnedDependenciesID | |
| # check and protects CI against a compromised PyPI mirror. See | |
| # ``requirements/`` and ``CONTRIBUTING.md`` for how to refresh | |
| # the lock files. | |
| run: | | |
| pip install --require-hashes --no-deps -r requirements/dev.txt | |
| pip install --no-deps -e . | |
| - name: Test | |
| run: pytest -v --cov=aemo_mdff_reader --cov-report=term-missing --cov-report=xml | |
| - name: Wheel install + import smoke | |
| if: matrix.python-version == '3.12' && runner.os == 'Linux' | |
| run: | | |
| pip install --require-hashes --no-deps -r requirements/build.txt | |
| python -m build --wheel | |
| python -m venv /tmp/smoke | |
| /tmp/smoke/bin/pip install dist/*.whl | |
| /tmp/smoke/bin/python -c "import aemo_mdff_reader; print(aemo_mdff_reader.__version__)" | |
| /tmp/smoke/bin/aemo-mdff-reader --version | |
| lint: | |
| name: ruff | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.12" | |
| cache: pip | |
| - run: pip install --require-hashes --no-deps -r requirements/lint.txt | |
| - run: ruff check . | |
| - run: ruff format --check . | |
| typecheck: | |
| name: mypy --strict | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.12" | |
| cache: pip | |
| - run: | | |
| pip install --require-hashes --no-deps -r requirements/dev.txt | |
| pip install --no-deps -e . | |
| - run: mypy | |
| security: | |
| name: security (pip-audit + bandit) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.12" | |
| cache: pip | |
| - run: pip install --require-hashes --no-deps -r requirements/audit.txt | |
| - name: Audit our declared dependencies for known CVEs | |
| # We have no required runtime deps; this audits dev extras + tooling. | |
| run: pip-audit --skip-editable | |
| - name: Bandit static security analysis | |
| run: bandit -r aemo_mdff_reader -ll | |
| build: | |
| name: build sdist + wheel | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.12" | |
| - run: pip install --require-hashes --no-deps -r requirements/build.txt | |
| - run: python -m build | |
| - run: twine check --strict dist/* | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: dist | |
| path: dist/ |