gamgui/.github/workflows/ci.yml at main · goetchstone/gamgui · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
name: CI

on:
  push:
    branches: [main]
  pull_request:

# Every job here only checks out, installs, vendors the GAM binary and runs pytest — nothing writes
# back to the repo, so read-only content access is all GITHUB_TOKEN needs (it is also what the
# fetch_gam.sh api.github.com calls authenticate with, purely to dodge the anonymous 60/hr limit).
permissions:
  contents: read

jobs:
  test:
    name: test (${{ matrix.os }}, py${{ matrix.python }})
    timeout-minutes: 15   # a hung test fails the job fast instead of burning the 6h default
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
        python: ["3.10", "3.12", "3.14"]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-python@v7
        with:
          python-version: ${{ matrix.python }}

      - name: Install (flexible deps from pyproject)
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: Run tests
        # Uses the mock gam binary; needs no vendored GAM7 and no credentials.
        run: pytest -q

  gam-compat:
    name: gam-compat (pinned binary)
    runs-on: macos-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: "3.14"
      - name: Install
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"
      - name: Vendor the pinned GAM7 binary + command reference
        run: ./scripts/fetch_gam.sh
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # authenticate api.github.com -> avoid the 60/hr 403
      - name: Assert the vendored version matches the pin
        run: |
          python - <<'PY'
          import pathlib
          from gamgui.core.gam.commands import EXPECTED_GAM_VERSION
          v = pathlib.Path("gamgui/resources/gam7/VERSION").read_text()
          assert EXPECTED_GAM_VERSION in v, f"vendored VERSION {v!r} != pin {EXPECTED_GAM_VERSION}"
          print("vendored:", v.split(chr(10))[0])
          PY
      - name: Command-contract test against the REAL reference
        run: pytest -q tests/test_command_contract.py

  gam-latest-preview:
    # Non-blocking early warning: would the NEWEST GAM rename/remove a command we use? Does not change the pin.
    name: gam-compat (latest, non-blocking)
    runs-on: macos-latest
    continue-on-error: true
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: "3.14"
      - name: Install
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"
      - name: Vendor the LATEST GAM7 (preview only)
        # --allow-unpinned: a newer-than-pinned asset has no committed checksum by definition. Safe
        # only because this job is a throwaway preview — never add it to the gam-compat job above.
        run: ./scripts/fetch_gam.sh --tag latest --allow-unpinned
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # authenticate api.github.com -> avoid the 60/hr 403
      - name: Command-token contract against latest (early warning)
        run: pytest -q tests/test_command_contract.py -k tokens