template-python-package/.github/workflows/checks.yml at ac48ba8a799f91d8a4b9b234af7b2da83aa642c5 · seedcase-project/template-python-package · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
name: Checks

on: pull_request

permissions: read-all

jobs:
  check-template:
    runs-on: ubuntu-latest
    steps:
      # This is a useful security step to check for unexpected outbound calls from the runner,
      # which could indicate a compromised token or runner.
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up uv
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
        with:
          enable-cache: true

      - name: Install justfile
        run: uv tool install rust-just

      # Set this user so that the checks create Git commits.
      - name: Set bot user
        run: |
          git config --global user.name "github-actions[bot]"
          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - name: Check template creation
        run: just test-all

  check-typos:
    runs-on: ubuntu-latest
    steps:
      # This is a useful security step to check for unexpected outbound calls from the runner,
      # which could indicate a compromised token or runner.
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Spell check repo
        uses: crate-ci/typos@cf5f1c29a8ac336af8568821ec41919923b05a83 # v1.45.1

  check-website-build:
    runs-on: ubuntu-latest
    steps:
      # This is a useful security step to check for unexpected outbound calls from the runner,
      # which could indicate a compromised token or runner.
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Quarto
        uses: quarto-dev/quarto-actions/setup@8a96df13519ee81fd526f2dfca5962811136661b # v2.2.0

      # Check that the website builds, but don't publish it
      - name: Render Quarto Project
        uses: quarto-dev/quarto-actions/render@8a96df13519ee81fd526f2dfca5962811136661b # v2.2.0

  # Dependency Review Action
  #
  # This Action will scan dependency manifest files that change as part of a Pull Request,
  # surfacing known-vulnerable versions of the packages declared or updated in the PR.
  # Once installed, if the workflow run is marked as required,
  # PRs introducing known-vulnerable packages will be blocked from merging.
  #
  # Source repository: https://github.com/actions/dependency-review-action
  check-dependencies:
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: "Checkout Repository"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: "Dependency Review"
        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2