FL4Health/.github/workflows/static_code_checks.yaml at main · VectorInstitute/FL4Health · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
# only has to pass for python 3.10
name: Static code checks

on:
  push:
    branches:
      main
  pull_request:
    branches:
      main

jobs:
  run-code-check:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      actions: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Install uv
        uses: astral-sh/setup-uv@v8.2.0
        with:
          version: "0.9.11"
          enable-cache: true

      - name: Set up Python
        uses: actions/setup-python@v6.2.0
        with:
          python-version-file: ".python-version"

      - name: Set up cache
        uses: actions/cache@v5
        id: cached-uv-dependencies
        with:
          path: .venv
          key: venv-${{ runner.os }}-${{ hashFiles('**/uv.lock') }}

      - name: Install dependencies
        run: uv sync --group dev --group test --group codestyle

      - name: Pre-commit Checks
        run: uv run pre-commit run --all-files

      - name: pip-audit (gh-action-pip-audit)
        uses: pypa/gh-action-pip-audit@v1.1.0
        with:
          virtual-environment: .venv/
          # CVE-2026-26007, CVE-2026-34073 are cryptography vulnerability that requires cryptography>=46.0.5, but
          # flwr (flower) requires cryptography<45.0.0, blocking the upgrade.
          # CVE-2026-1839 is a vulnerability in HF transformers, but they've messed up their typing in 5+ so we're
          # deferring this.
          # PYSEC-2025-217 is a transformers vulnerability without a fix yet.
          # PYSEC-2026-73 is a keras vulnerability fixed in 3.13, but this requires upgrade the python version, which
          # we will defer for now.
          ignore-vulns: |
            CVE-2026-26007
            CVE-2026-34073
            CVE-2026-1839
            PYSEC-2025-217
            PYSEC-2026-73


      # Deleting some temporary files and useless folders to free up space
      # Deleting /usr/share/dotnet should clear ~4GB of space.
      # Deleting /usr/local/lib/android should clear ~12GB of space.
      - name: Cleanup space (before cache save)
        run: |
          df -h /dev/root
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android
          df -h /dev/root

      - name: Minimize uv cache
        run: uv cache prune --ci