Skip to content

Commit fde4aa5

Browse files
dannywillemsdannywillems
committed
Adopt the common CI and tooling setup
Bring the client in line with the shared Python CI+tooling standard: - Dependencies: bump all runtime and dev floors to their latest releases (l9format stays pinned at 2.0.1); add hypothesis, cyclonedx-bom, nox, zizmor, mkdocs-material, and mkdocstrings. - Ruff: expand the rule set (S, ASYNC, PT, PTH, PIE, RET, ARG, ERA, RUF, PL) and fix every finding rather than ignoring it, including adding request timeouts in the sync client and tightening the examples and tests. Only pytest asserts (S101) stay exempt in tests. - mypy: enable strict; the library passes with zero errors. Test functions are exempt from requiring annotations (standard pytest convention). - Coverage: pytest-cov with branch coverage and a 70% gate (make coverage). - Makefile: add coverage, test-all (nox), audit, zizmor, sbom, and docs targets; check now runs coverage. - Workflows: replace the ad-hoc CI with the standard ci.yml, and add zizmor.yml, sbom.yml, and shellcheck.yaml. Every workflow is hardened to pass zizmor: SHA-pinned actions, least-privilege permissions, persist-credentials false, and github context passed through env vars. Secret scanning uses TruffleHog. - Docs: a mkdocs-material + mkdocstrings site (make docs).
1 parent 6c3a946 commit fde4aa5

27 files changed

Lines changed: 671 additions & 266 deletions

‎.github/workflows/actions.yml‎

Lines changed: 0 additions & 57 deletions
This file was deleted.

‎.github/workflows/changelog.yaml‎

Lines changed: 13 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,22 @@
1-
name: CHANGELOG related checks per pull requests
1+
name: CHANGELOG related checks per pull request
2+
23
on:
34
pull_request:
4-
types: [assigned, opened, synchronize, reopened, labeled, unlabeled]
5-
branches:
6-
- main
7-
merge_group:
8-
types: [checks_requested]
5+
branches: [main, master]
96

10-
jobs:
11-
check-changelog:
12-
name: Check changelog action
13-
runs-on: ubuntu-latest
14-
steps:
15-
- uses: actions/checkout@v7
16-
- uses: tarides/changelog-check-action@v4
17-
with:
18-
changelog: CHANGELOG.md
7+
permissions:
8+
contents: read
199

20-
check-changelog-commit:
21-
name: Check changelog is in dedicated commit
10+
jobs:
11+
changelog-check:
2212
runs-on: ubuntu-latest
2313
steps:
24-
- uses: actions/checkout@v7
14+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2515
with:
2616
fetch-depth: 0
27-
- name: Verify CHANGELOG.md changes are in own commit
28-
run: >
29-
.github/scripts/check-changelog-commit.sh
30-
"${{ github.event.pull_request.base.sha }}"
17+
persist-credentials: false
3118

32-
shellcheck:
33-
name: Shellcheck
34-
runs-on: ubuntu-latest
35-
steps:
36-
- uses: actions/checkout@v7
37-
- name: Install shellcheck
38-
run: sudo apt-get install -y shellcheck
39-
- name: Run shellcheck
40-
run: make lint-shell
19+
- name: Check changelog commits
20+
env:
21+
BASE_REF: ${{ github.base_ref }}
22+
run: .github/scripts/check-changelog-commit.sh "origin/${BASE_REF}"

‎.github/workflows/ci-per-commit.yaml‎

Lines changed: 41 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
name: CI per commit
2+
23
on:
34
push:
45
branches:
@@ -8,24 +9,35 @@ on:
89
branches:
910
- main
1011

12+
permissions:
13+
contents: read
14+
1115
jobs:
1216
check-label:
13-
name: Check for ci:per-commit label
17+
name: Check ci:per-commit label
1418
runs-on: ubuntu-latest
19+
permissions:
20+
pull-requests: read
1521
outputs:
1622
has_label: ${{ steps.check.outputs.has_label }}
1723
steps:
18-
- uses: actions/checkout@v7
24+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
25+
with:
26+
persist-credentials: false
1927
- name: Check for label
2028
id: check
2129
env:
2230
GH_TOKEN: ${{ github.token }}
31+
EVENT_NAME: ${{ github.event_name }}
32+
REPOSITORY: ${{ github.repository }}
33+
SHA: ${{ github.sha }}
34+
LABELS: ${{ toJSON(github.event.pull_request.labels.*.name) }}
2335
run: |
2436
.github/scripts/check-ci-per-commit-label.sh \
25-
"${{ github.event_name }}" \
26-
"${{ github.repository }}" \
27-
"${{ github.sha }}" \
28-
'${{ toJSON(github.event.pull_request.labels.*.name) }}' \
37+
"$EVENT_NAME" \
38+
"$REPOSITORY" \
39+
"$SHA" \
40+
"$LABELS" \
2941
>> "$GITHUB_OUTPUT"
3042
3143
ci-per-commit:
@@ -34,32 +46,40 @@ jobs:
3446
if: needs.check-label.outputs.has_label == 'true'
3547
runs-on: ubuntu-latest
3648
steps:
37-
- uses: actions/checkout@v7
49+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
3850
with:
3951
fetch-depth: 0
52+
persist-credentials: false
53+
4054
- name: Install uv
41-
uses: astral-sh/setup-uv@v7
55+
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
56+
57+
- name: Set up Python
58+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
4259
with:
4360
python-version: "3.13"
44-
- name: Install GNU sed (macOS)
45-
if: runner.os == 'macOS'
46-
run: brew install gnu-sed
61+
4762
- name: Determine commit range
4863
id: range
4964
env:
50-
GH_TOKEN: ${{ github.token }}
65+
EVENT_NAME: ${{ github.event_name }}
66+
PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
67+
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
68+
PUSH_BEFORE: ${{ github.event.before }}
69+
PUSH_SHA: ${{ github.sha }}
5170
run: |
52-
if [ "${{ github.event_name }}" = "pull_request" ]; then
53-
BASE="${{ github.event.pull_request.base.sha }}"
54-
HEAD="${{ github.event.pull_request.head.sha }}"
71+
if [ "$EVENT_NAME" = "pull_request" ]; then
72+
BASE="$PR_BASE_SHA"
73+
HEAD="$PR_HEAD_SHA"
5574
else
56-
BASE="${{ github.event.before }}"
57-
HEAD="${{ github.sha }}"
75+
BASE="$PUSH_BEFORE"
76+
HEAD="$PUSH_SHA"
5877
fi
5978
echo "base=${BASE}" >> "$GITHUB_OUTPUT"
6079
echo "head=${HEAD}" >> "$GITHUB_OUTPUT"
80+
6181
- name: Run CI on each commit
62-
run: |
63-
.github/scripts/run-ci-per-commit.sh \
64-
"${{ steps.range.outputs.base }}" \
65-
"${{ steps.range.outputs.head }}"
82+
env:
83+
BASE: ${{ steps.range.outputs.base }}
84+
HEAD: ${{ steps.range.outputs.head }}
85+
run: .github/scripts/run-ci-per-commit.sh "$BASE" "$HEAD"

‎.github/workflows/ci.yml‎

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [main, master]
6+
pull_request:
7+
branches: [main, master]
8+
9+
permissions:
10+
contents: read
11+
12+
jobs:
13+
lint:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
17+
with:
18+
persist-credentials: false
19+
20+
- name: Install uv
21+
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
22+
23+
- name: Set up Python
24+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
25+
with:
26+
python-version: "3.13"
27+
28+
- name: Install dependencies
29+
run: make setup
30+
31+
- name: Check formatting
32+
run: make check-format
33+
34+
- name: Lint
35+
run: make lint
36+
37+
- name: Check trailing whitespace
38+
run: make check-trailing-whitespace
39+
40+
typecheck:
41+
runs-on: ubuntu-latest
42+
steps:
43+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
44+
with:
45+
persist-credentials: false
46+
47+
- name: Install uv
48+
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
49+
50+
- name: Set up Python
51+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
52+
with:
53+
python-version: "3.13"
54+
55+
- name: Install dependencies
56+
run: make setup
57+
58+
- name: Type check
59+
run: make typecheck
60+
61+
test:
62+
runs-on: ubuntu-latest
63+
needs: [lint, typecheck]
64+
strategy:
65+
matrix:
66+
python-version: ["3.11", "3.12", "3.13", "3.14"]
67+
steps:
68+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
69+
with:
70+
persist-credentials: false
71+
72+
- name: Install uv
73+
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
74+
75+
- name: Set up Python ${{ matrix.python-version }}
76+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
77+
with:
78+
python-version: ${{ matrix.python-version }}
79+
80+
- name: Install dependencies
81+
run: make setup
82+
83+
- name: Run tests
84+
run: make test
85+
86+
coverage:
87+
runs-on: ubuntu-latest
88+
needs: [lint, typecheck]
89+
steps:
90+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
91+
with:
92+
persist-credentials: false
93+
94+
- name: Install uv
95+
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
96+
97+
- name: Set up Python
98+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
99+
with:
100+
python-version: "3.13"
101+
102+
- name: Install dependencies
103+
run: make setup
104+
105+
- name: Run tests with coverage
106+
run: make coverage
107+
108+
- name: Upload coverage report
109+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
110+
with:
111+
name: coverage
112+
path: coverage.xml
113+
114+
audit:
115+
runs-on: ubuntu-latest
116+
steps:
117+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
118+
with:
119+
persist-credentials: false
120+
121+
- name: Install uv
122+
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
123+
124+
- name: Set up Python
125+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
126+
with:
127+
python-version: "3.13"
128+
129+
- name: Install dependencies
130+
run: make setup
131+
132+
- name: Audit dependencies for known vulnerabilities
133+
run: make audit
134+
135+
secret-scan:
136+
runs-on: ubuntu-latest
137+
steps:
138+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
139+
with:
140+
fetch-depth: 0
141+
persist-credentials: false
142+
143+
- name: Scan for secrets (TruffleHog)
144+
uses: trufflesecurity/trufflehog@6f3c981e7b77f235fd2702dd74af25fc4b72bf11 # v3.96.0
145+
with:
146+
extra_args: --only-verified

0 commit comments

Comments
 (0)