github-actions/.github/workflows/python-ci.yml at main · notdodo/github-actions · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
name: Python CI

on:
  workflow_call:
    inputs:
      disable-sudo:
        type: boolean
        default: true
      egress-policy-allowlist:
        type: string
        default: ''
      poetry-version:
        type: string
        default: 'latest'
      python-version:
        type: string
        default: '3.13'
      runs-on:
        type: string
        default: 'ubuntu-latest'
      working-directory:
        type: string
        default: '.'

jobs:
  install-and-checks:
    permissions:
      contents: read
    runs-on: ${{ inputs.runs-on }}
    defaults:
      run:
        working-directory: ${{ inputs.working-directory }}
    steps:
      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
        with:
          disable-sudo-and-containers: ${{ inputs.disable-sudo }}
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            files.pythonhosted.org:443
            github.com:443
            install.python-poetry.org:443
            objects.githubusercontent.com:443
            pypi.org:443
            raw.githubusercontent.com:443
            release-assets.githubusercontent.com:443
            releases.astral.sh:443
            ${{ inputs.egress-policy-allowlist }}
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ inputs.python-version }}

      # ----- Poetry -----
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        if: ${{ hashFiles(format('{0}/poetry.lock', inputs.working-directory)) != '' }}
        with:
          path: ~/.local/bin/
          key: poetry-${{ inputs.poetry-version }}
      - uses: snok/install-poetry@a783c322200f0519c7926aa6faa857c4e23e9263 # v1.4.2
        if: ${{ hashFiles(format('{0}/poetry.lock', inputs.working-directory)) != '' }}
        with:
          version: ${{ inputs.poetry-version }}
          virtualenvs-create: true
          virtualenvs-in-project: true
          installer-parallel: true

      # ----- UV -----
      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
        if: ${{ hashFiles(format('{0}/uv.lock', inputs.working-directory)) != '' }}
        with:
          enable-cache: true
      - id: cache-deps
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ${{ inputs.working-directory }}/.venv
            ${{ inputs.working-directory }}/.mypy_cache
            ~/.local/.cache/uv
          key: python-${{ inputs.python-version }}-venv-${{ hashFiles(format('{0}/poetry.lock', inputs.working-directory), format('{0}/uv.lock', inputs.working-directory)) }}
      - run: poetry sync --no-root
        if: ${{ steps.cache-deps.outputs.cache-hit != 'true' && hashFiles(format('{0}/poetry.lock', inputs.working-directory)) != '' }}
      - run: uv sync --locked --all-extras --dev
        if: ${{ steps.cache-deps.outputs.cache-hit != 'true' && hashFiles(format('{0}/uv.lock', inputs.working-directory)) != '' }}
      - name: Install Task
        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
        with:
          repo-token: ${{ github.token }}
      - name: Linting
        run: |
          task format-check
          task lint
      - name: Type checking
        run: |
          task type-check