standup-bot/.github/workflows/tests.yml at main · SemTiOne/standup-bot · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
name: CI

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  lint:
    name: Lint & Format Check
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
          python-version: "3.12"
      - name: Install ruff
        run: pip install "ruff>=0.4.4,<1.0.0"
      - name: Lint
        run: ruff check standup/ tests/ setup.py
      - name: Format check
        run: ruff format --check standup/ tests/ setup.py

  type-check:
    name: Type Check
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
          python-version: "3.12"
      - name: Install mypy and stubs
        run: pip install "mypy>=1.10.0,<2.0.0" types-requests
      - name: Run mypy
        run: mypy standup/ --ignore-missing-imports --python-version 3.10

  security-scan:
    name: Security Scan
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
          python-version: "3.12"
      - name: Install bandit
        run: pip install "bandit>=1.7.8,<2.0.0"
      - name: Run bandit
        run: bandit -r standup/ -ll

  dependency-audit:
    name: Dependency Audit
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
          python-version: "3.12"
      - name: Install pip-audit
        run: pip install "pip-audit>=2.7.3,<3.0.0"
      - name: Audit dependencies
        run: pip-audit -r requirements.txt

  pre-commit:
    name: Pre-commit
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
          python-version: "3.12"
      - name: Install pre-commit
        run: pip install pre-commit
      - name: Run pre-commit hooks
        run: pre-commit run --all-files

  test:
    name: Tests (${{ matrix.os }}, Python ${{ matrix.python-version }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 20
    needs: [lint, type-check, security-scan, dependency-audit, pre-commit]
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"
      - name: Run tests with coverage
        run: pytest tests/ -v --tb=short --cov=standup --cov-report=xml --cov-report=term-missing --cov-fail-under=85 --junitxml=junit.xml -o junit_family=legacy
      - name: Upload coverage
        if: matrix.python-version == '3.12' && !cancelled()
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
        with:
          files: ./coverage.xml
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: false
      - name: Upload test results to Codecov
        if: matrix.python-version == '3.12' && !cancelled()
        uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3
        with:
          token: ${{ secrets.CODECOV_TOKEN }}

  required-checks:
    name: Required Checks
    runs-on: ubuntu-latest
    timeout-minutes: 5
    needs: [lint, type-check, security-scan, dependency-audit, pre-commit, test]
    if: always()
    steps:
      - name: Aggregate results
        env:
          RESULTS: ${{ toJSON(needs) }}
        run: >
          python -c "import json, os, sys;
          r = json.loads(os.environ['RESULTS']);
          bad = [k for k, v in r.items() if v['result'] not in ('success', 'skipped')];
          sys.exit('failed: ' + ','.join(bad)) if bad else print('all required checks passed')"