ci_tests.yml

name: CI - Tests

on:
  pull_request:
  push:
    branches:
      - 'master'

jobs:
  test-template:
    runs-on: ubuntu-latest
    name: Build cookiecutter template and run standard tests

    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13"]

    steps:
    - name: Checkout ${{ github.repository }}
      uses: actions/checkout@v7

    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@v6
      with:
        python-version: ${{ matrix.python-version }}

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -U setuptools wheel
        pip install -r .github/utils/requirements.txt

    - name: Set up git
      run: |
        git config --global user.name "TEAM 4.0[bot]"
        git config --global user.email "Team4.0@SINTEF.no"

    - name: Run cookiecutter
      run: cookiecutter --no-input --config-file .github/utils/cookiecutter_values.yaml .

    - name: Register all template strategies
      run: |
        sed -i 's|# \"oteapi|\"oteapi|' oteapi-ci/pyproject.toml
        cat oteapi-ci/pyproject.toml

    - name: Install template
      run: pip install -e oteapi-ci[dev]

    # There should be no warnings, so we're treating warnings as errors
    - name: Run pytest
      run: pytest -vv --pythonwarnings="error"
      working-directory: ./oteapi-ci

    - name: Run pre-commit
      run: pre-commit run --all-files
      working-directory: ./oteapi-ci

    - name: Prepare for pip-audit
      run: pip-compile --output-file=${{ runner.temp }}/requirements.txt --all-extras --allow-unsafe ${{ github.workspace }}/oteapi-ci/pyproject.toml

    - name: Run pip-audit
      uses: pypa/gh-action-pip-audit@v1.1.0
      with:
        inputs: ${{ runner.temp }}/requirements.txt
        # CVE-2025-69872: DiskCache 5.6.3
        #   DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default.
        #   An attacker with write access to the cache directory can achieve arbitrary code execution
        #   when a victim application reads from the cache.
        # CVE-2026-4539: pygments 2.19.2
        #   A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the
        #   function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in
        #   inefficient regular expression complexity. The attack is only possible with local access.
        ignore-vulns: |
          CVE-2025-69872
          CVE-2026-4539

    - name: Build docs
      run: mkdocs build --strict
      working-directory: ./oteapi-ci

    - name: Build source distribution
      run: flit build
      working-directory: ./oteapi-ci

  pip-audit:
    # Do not use SINTEF/ci-cd, since it requires the root repository to be installable
    # as a package.
    runs-on: ubuntu-latest
    name: pip-audit

    steps:
    - name: Checkout repository
      uses: actions/checkout@v7

    - name: Set up Python 3.10
      uses: actions/setup-python@v6
      with:
        python-version: "3.10"

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -U setuptools wheel

    - name: Run pip-audit
      uses: pypa/gh-action-pip-audit@v1.1.0
      with:
        inputs: ${{ github.workspace }}/requirements.txt ${{ github.workspace }}/.github/utils/requirements.txt
        # CVE-2026-4539: pygments 2.19.2
        #   A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the
        #   function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in
        #   inefficient regular expression complexity. The attack is only possible with local access.
        ignore-vulns: |
          CVE-2026-4539