Skip to content

Commit 59de279

Browse files
isthatdebbiejclaude
isthatdebbiej
and
claude
committed
build: add pyproject.toml with hatch-vcs and CI/CD workflows
Add pyproject.toml with opentelemetry-api as sole core dependency, optional extras (sdk, instruments, carriers), and hatch-vcs for git-tag-based versioning targeting Python 3.9+. Add GitHub Actions workflows: - ci.yml: lint, typecheck, test matrix (3.9-3.13), build, DCO check - release.yml: PyPI trusted publishing via OIDC on tag push - codeql.yml: weekly CodeQL security analysis - scorecard.yml: OpenSSF Scorecard compliance - repolinter.yml: LF AI & Data repo structure validation Signed-off-by: deborahjacob-botanu <deborahjacob@botanu.ai> Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
1 parent fb9d08c commit 59de279

File tree

6 files changed

+473
-0
lines changed

6 files changed

+473
-0
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
# SPDX-FileCopyrightText: 2026 The Botanu Authors
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
name: CI
5+
6+
on:
7+
push:
8+
branches: [main, developer-deborah]
9+
pull_request:
10+
branches: [main]
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
# -------------------------------------------------------------------
17+
# Lint & format check
18+
# -------------------------------------------------------------------
19+
lint:
20+
runs-on: ubuntu-latest
21+
steps:
22+
- uses: actions/checkout@v4
23+
- uses: actions/setup-python@v5
24+
with:
25+
python-version: "3.12"
26+
- run: pip install ruff
27+
- run: ruff check src/ tests/
28+
- run: ruff format --check src/ tests/
29+
30+
# -------------------------------------------------------------------
31+
# Type checking
32+
# -------------------------------------------------------------------
33+
typecheck:
34+
runs-on: ubuntu-latest
35+
steps:
36+
- uses: actions/checkout@v4
37+
- uses: actions/setup-python@v5
38+
with:
39+
python-version: "3.12"
40+
- run: pip install -e ".[dev]"
41+
- run: mypy src/botanu/
42+
43+
# -------------------------------------------------------------------
44+
# Test matrix — Python 3.9 → 3.13
45+
# -------------------------------------------------------------------
46+
test:
47+
runs-on: ubuntu-latest
48+
strategy:
49+
fail-fast: false
50+
matrix:
51+
python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
52+
steps:
53+
- uses: actions/checkout@v4
54+
with:
55+
fetch-depth: 0 # hatch-vcs needs full history
56+
57+
- uses: actions/setup-python@v5
58+
with:
59+
python-version: ${{ matrix.python-version }}
60+
61+
- name: Install dependencies
62+
run: pip install -e ".[dev]"
63+
64+
- name: Run tests with coverage
65+
run: pytest --cov=botanu --cov-report=xml --cov-report=term-missing
66+
67+
- name: Upload coverage
68+
if: matrix.python-version == '3.12'
69+
uses: codecov/codecov-action@v4
70+
with:
71+
file: coverage.xml
72+
fail_ci_if_error: false
73+
74+
# -------------------------------------------------------------------
75+
# Build verification — ensure the package builds cleanly
76+
# -------------------------------------------------------------------
77+
build:
78+
runs-on: ubuntu-latest
79+
steps:
80+
- uses: actions/checkout@v4
81+
with:
82+
fetch-depth: 0
83+
- uses: actions/setup-python@v5
84+
with:
85+
python-version: "3.12"
86+
- run: pip install build
87+
- run: python -m build
88+
- uses: actions/upload-artifact@v4
89+
with:
90+
name: dist
91+
path: dist/
92+
93+
# -------------------------------------------------------------------
94+
# DCO sign-off check (required by Linux Foundation)
95+
# -------------------------------------------------------------------
96+
dco:
97+
runs-on: ubuntu-latest
98+
if: github.event_name == 'pull_request'
99+
steps:
100+
- uses: actions/checkout@v4
101+
with:
102+
fetch-depth: 0
103+
- name: DCO check
104+
uses: dcoapp/app@v1

‎.github/workflows/codeql.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# SPDX-FileCopyrightText: 2026 The Botanu Authors
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
name: CodeQL
5+
6+
on:
7+
push:
8+
branches: [main]
9+
pull_request:
10+
branches: [main]
11+
schedule:
12+
- cron: "23 4 * * 1" # Weekly Monday 04:23 UTC
13+
14+
permissions:
15+
contents: read
16+
17+
jobs:
18+
analyze:
19+
runs-on: ubuntu-latest
20+
permissions:
21+
security-events: write
22+
strategy:
23+
fail-fast: false
24+
matrix:
25+
language: [python]
26+
steps:
27+
- uses: actions/checkout@v4
28+
29+
- name: Initialize CodeQL
30+
uses: github/codeql-action/init@v3
31+
with:
32+
languages: ${{ matrix.language }}
33+
34+
- name: Autobuild
35+
uses: github/codeql-action/autobuild@v3
36+
37+
- name: Perform CodeQL Analysis
38+
uses: github/codeql-action/analyze@v3
39+
with:
40+
category: "/language:${{ matrix.language }}"

‎.github/workflows/release.yml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
# SPDX-FileCopyrightText: 2026 The Botanu Authors
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
name: Release to PyPI
5+
6+
on:
7+
push:
8+
tags:
9+
- "v*"
10+
11+
permissions:
12+
contents: read
13+
14+
jobs:
15+
build:
16+
runs-on: ubuntu-latest
17+
steps:
18+
- uses: actions/checkout@v4
19+
with:
20+
fetch-depth: 0 # hatch-vcs needs full history
21+
22+
- uses: actions/setup-python@v5
23+
with:
24+
python-version: "3.12"
25+
26+
- name: Install build tools
27+
run: pip install build
28+
29+
- name: Build sdist and wheel
30+
run: python -m build
31+
32+
- uses: actions/upload-artifact@v4
33+
with:
34+
name: dist
35+
path: dist/
36+
37+
# -------------------------------------------------------------------
38+
# Publish to PyPI via Trusted Publishing (OIDC — no API tokens)
39+
# Requires PyPI project to be configured for GitHub OIDC:
40+
# https://docs.pypi.org/trusted-publishers/
41+
# -------------------------------------------------------------------
42+
publish-pypi:
43+
needs: build
44+
runs-on: ubuntu-latest
45+
environment:
46+
name: pypi
47+
url: https://pypi.org/p/botanu
48+
permissions:
49+
id-token: write # required for OIDC trusted publishing
50+
steps:
51+
- uses: actions/download-artifact@v4
52+
with:
53+
name: dist
54+
path: dist/
55+
56+
- name: Publish to PyPI
57+
uses: pypa/gh-action-pypi-publish@release/v1
58+
59+
# -------------------------------------------------------------------
60+
# Create GitHub Release with auto-generated notes
61+
# -------------------------------------------------------------------
62+
github-release:
63+
needs: publish-pypi
64+
runs-on: ubuntu-latest
65+
permissions:
66+
contents: write
67+
steps:
68+
- uses: actions/checkout@v4
69+
with:
70+
fetch-depth: 0
71+
72+
- uses: actions/download-artifact@v4
73+
with:
74+
name: dist
75+
path: dist/
76+
77+
- name: Create GitHub Release
78+
env:
79+
GH_TOKEN: ${{ github.token }}
80+
run: gh release create "${{ github.ref_name }}" dist/* --generate-notes

‎.github/workflows/repolinter.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# SPDX-FileCopyrightText: 2026 The Botanu Authors
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
name: Repolinter
5+
6+
on:
7+
push:
8+
branches: [main]
9+
pull_request:
10+
branches: [main]
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
lint:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- uses: actions/checkout@v4
20+
21+
- name: Run Repolinter
22+
uses: todogroup/repolinter-action@v1
23+
with:
24+
config_url: https://raw.githubusercontent.com/lfai/foundation/main/repolinter.json

‎.github/workflows/scorecard.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# SPDX-FileCopyrightText: 2026 The Botanu Authors
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
name: OpenSSF Scorecard
5+
6+
on:
7+
push:
8+
branches: [main]
9+
schedule:
10+
- cron: "30 1 * * 1" # Weekly Monday 01:30 UTC
11+
12+
permissions: read-all
13+
14+
jobs:
15+
analysis:
16+
runs-on: ubuntu-latest
17+
permissions:
18+
security-events: write # upload SARIF
19+
id-token: write # publish results
20+
steps:
21+
- uses: actions/checkout@v4
22+
with:
23+
persist-credentials: false
24+
25+
- name: Run OpenSSF Scorecard
26+
uses: ossf/scorecard-action@v2
27+
with:
28+
results_file: results.sarif
29+
results_format: sarif
30+
publish_results: true
31+
32+
- name: Upload SARIF to GitHub Security tab
33+
uses: github/codeql-action/upload-sarif@v3
34+
with:
35+
sarif_file: results.sarif

0 commit comments

Comments
 (0)