security: add Dependabot so the SHA-pinned actions get bumped #8
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Engine composition test | |
| # Proves REAL `snakemake --executor spawn` drives a job end-to-end against the | |
| # Substrate AWS emulator — no real AWS, no cost, no workload execution. Real | |
| # `snakemake` run → SpawnExecutor.run_job → real `spawn task run` + real `aws s3` | |
| # staging vs. Substrate → completion record → exit code → job success/failure. | |
| # Substrate serves the completion as a seedable, clock-aware outcome | |
| # (scttfrdmn/substrate#360); unseeded ⇒ exit 0, a seeded nonzero drives failure. | |
| # | |
| # Uses a NO-OUTPUT rule: Snakemake gates a run on its declared `output:` existing | |
| # in storage (wait_for_files), which needs real execution the emulator can't do; | |
| # a rule with no output has no such gate (see #3). | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| env: | |
| # v0.75.0 was the first release with seedable task-completion (substrate#360); | |
| # v0.85.0 keeps that contract byte-identical (verified locally: POST/DELETE | |
| # /v1/spawn/task-completion with the same snake_case payload, and both TESTs | |
| # below pass unchanged) and adds the S3 and error-code fidelity fixes this | |
| # test's staging step exercises (substrate#391, #392, #396, #398, #399, #406). | |
| # v0.85.0 specifically fixes substrate#457 — HeadObject now resolves a | |
| # synthesized completion, so HEAD and GET agree. This test doesn't depend on | |
| # that (spawn's fetchCompletion calls GetObject directly), but `aws s3 cp` on a | |
| # completion record only works from v0.85.0 on, so don't reach for it below a | |
| # pin that has it. | |
| SUBSTRATE_VERSION: v0.85.0 | |
| SPAWN_VERSION: 0.95.0 # spawn release providing `spawn task run` | |
| jobs: | |
| composition: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| - name: Setup Go (for the Substrate emulator) | |
| uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 | |
| with: | |
| go-version: '1.26' | |
| - name: Install + start Substrate | |
| run: | | |
| go install github.com/scttfrdmn/substrate/cmd/substrate@${SUBSTRATE_VERSION} | |
| "$(go env GOPATH)/bin/substrate" server > /tmp/substrate.log 2>&1 & | |
| for i in $(seq 1 30); do | |
| curl -fsS http://localhost:4566/health >/dev/null 2>&1 && { echo "substrate up"; break; } | |
| sleep 1 | |
| done | |
| curl -fsS http://localhost:4566/health | |
| - name: Install the spawn CLI (release binary) | |
| run: | | |
| curl -fsSL -o /tmp/spawn.tgz \ | |
| "https://github.com/spore-host/spawn/releases/download/v${SPAWN_VERSION}/spawn_${SPAWN_VERSION}_linux_amd64.tar.gz" | |
| tar -xzf /tmp/spawn.tgz -C /tmp | |
| sudo install /tmp/spawn /usr/local/bin/spawn | |
| spawn version | head -1 || true | |
| - name: Setup Python | |
| uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: '3.12' | |
| - name: Install snakemake + storage plugin + the spawn executor (built wheel) | |
| run: | | |
| # Snakemake discovers executor plugins by installed DISTRIBUTION; an | |
| # editable install is NOT found (`--executor spawn` → "invalid choice"). | |
| # Build + install the wheel so `snakemake --executor spawn` resolves. | |
| pip install --quiet build | |
| python -m build --wheel | |
| pip install --quiet snakemake snakemake-storage-plugin-s3 dist/*.whl | |
| snakemake --version | |
| - name: Run engine composition test (Substrate, no AWS) | |
| env: | |
| AWS_ENDPOINT_URL: http://localhost:4566 | |
| run: bash tests/composition/composition-test.sh |