Phasmid/.github/workflows/ci.yml at main · 01rabbit/Phasmid · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
name: CI

on:
  pull_request:
  push:
  workflow_dispatch:

jobs:
  test-and-static-checks:
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.10"

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -r requirements.txt
          python -m pip install -r requirements-dev.txt

      - name: Run formatting with black
        run: python -m black src tests scripts

      - name: Verify formatting with black
        run: python -m black --check src tests scripts

      - name: Lint with ruff
        run: python -m ruff check src tests scripts

      - name: Type check with mypy
        run: python -m mypy src

      - name: Compile Python sources
        run: python -m compileall -q src tests scripts

      - name: Run Python security scanner
        run: python -m bandit -r src -q --severity-level medium --confidence-level high

      - name: Run dependency vulnerability audit
        run: python -m pip_audit -r requirements.txt

      - name: Run unit tests with coverage and enforce threshold
        run: |
          python -m coverage erase
          python -m coverage run --source=src -m unittest discover -s tests
          python -m coverage run --append --source=src -m unittest discover -s tests_optional
          python -m coverage report -m
          python -m coverage report --fail-under=70

      - name: Check claims coverage
        run: |
          python scripts/check_claims_coverage.py \
            --claims-file docs/CLAIMS.md \
            --tests-dir tests \
            --output /tmp/phasmid-release/claims_coverage.json \
            --max-unverified 8

      - name: Generate release review artifacts
        run: python scripts/generate_release_artifacts.py --output-dir /tmp/phasmid-release --archive

      - name: Upload release review artifacts
        uses: actions/upload-artifact@v4
        with:
          name: phasmid-release-review
          path: /tmp/phasmid-release

  optional-test-profile:
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.10"

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -r requirements.txt
          python -m pip install -r requirements-dev.txt

      - name: Run optional test profile
        run: python -m unittest discover -s tests_optional

  reproducible-build:
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.10"

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -r requirements.txt
          python -m pip install -r requirements-dev.txt

      - name: Build artifacts twice and compare hashes
        run: |
          export SOURCE_DATE_EPOCH=1700000000
          python scripts/generate_release_artifacts.py --output-dir /tmp/repro-a --archive
          python scripts/generate_release_artifacts.py --output-dir /tmp/repro-b --archive
          sha256sum /tmp/repro-a/MANIFEST.sha256 /tmp/repro-a/sbom.cyclonedx.json /tmp/repro-a/release-summary.json /tmp/repro-a/phasmid-release.tar.gz | awk '{print $1}' > /tmp/repro-a.sha
          sha256sum /tmp/repro-b/MANIFEST.sha256 /tmp/repro-b/sbom.cyclonedx.json /tmp/repro-b/release-summary.json /tmp/repro-b/phasmid-release.tar.gz | awk '{print $1}' > /tmp/repro-b.sha
          diff -u /tmp/repro-a.sha /tmp/repro-b.sha

  archive-review-tests:
    if: github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.10"

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -r requirements.txt
          python -m pip install -r requirements-dev.txt

      - name: Run archive-review test profile
        run: python -m unittest discover -s tests_archive_review