Add zizmor and harden GitHub Actions workflows #7766
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Tests | |
| on: | |
| pull_request: | |
| merge_group: | |
| push: | |
| branches: [main, test] | |
| env: | |
| FORCE_COLOR: 1 | |
| permissions: | |
| contents: read | |
| jobs: | |
| packaging: | |
| name: Python packaging | |
| uses: tskit-dev/.github/.github/workflows/python-packaging.yml@v19 | |
| with: | |
| pyproject-directory: python | |
| cli-test-cmd: tskit --help | |
| test-c: | |
| name: C tests | |
| uses: tskit-dev/.github/.github/workflows/c-tests.yml@v19 | |
| with: | |
| library-directory: c | |
| secrets: | |
| CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} | |
| test-python-c: | |
| name: Python-C tests | |
| uses: tskit-dev/.github/.github/workflows/python-c-tests.yml@v19 | |
| with: | |
| tests: python/tests/test_python_c.py python/tests/test_dict_encoding.py | |
| pyproject-directory: python | |
| secrets: | |
| CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} | |
| test: | |
| name: Python | |
| uses: tskit-dev/.github/.github/workflows/python-tests.yml@v19 | |
| with: | |
| os: ${{ matrix.os }} | |
| python-version: ${{ matrix.python }} | |
| pyproject-directory: python | |
| coverage-directory: python/tskit | |
| secrets: | |
| CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} | |
| strategy: | |
| matrix: | |
| python: [ 3.11, 3.13 ] | |
| os: [ macos-latest, ubuntu-24.04, windows-latest ] | |
| msys2: | |
| runs-on: windows-latest | |
| strategy: | |
| matrix: | |
| include: | |
| - { sys: mingw32, env: i686 } | |
| - { sys: mingw64, env: x86_64 } | |
| name: Windows (${{ matrix.sys }}, ${{ matrix.env }}) | |
| defaults: | |
| run: | |
| shell: msys2 {0} | |
| steps: | |
| - name: Cancel Previous Runs | |
| uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1 | |
| with: | |
| access_token: ${{ github.token }} | |
| - name: 'Checkout' | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Setup MSYS2 ${{matrix.sys}} | |
| uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0 | |
| with: | |
| msystem: ${{matrix.sys}} | |
| update: true | |
| install: >- | |
| git | |
| mingw-w64-${{matrix.env}}-toolchain | |
| mingw-w64-${{matrix.env}}-ninja | |
| mingw-w64-${{matrix.env}}-meson | |
| mingw-w64-${{matrix.env}}-cunit | |
| - name: Build | |
| working-directory: c | |
| run: | | |
| meson build -Dbuild_examples=false | |
| ninja -C build | |
| - name: Run tests | |
| working-directory: c | |
| run: | | |
| ninja -C build test | |
| bespoke-python-test: | |
| name: Bespoke Python tests | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Cancel Previous Runs | |
| uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1 | |
| with: | |
| access_token: ${{ github.token }} | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - name: Install uv and set the python version | |
| uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 | |
| with: | |
| python-version: 3.11 | |
| version: "0.10.0" | |
| - name: Install Python dependencies | |
| working-directory: python | |
| run: uv sync --locked --group test --no-default-groups | |
| - name: Minidom test | |
| working-directory: python | |
| # Importing either IPython or pytest causes import of xml.dom.minidom | |
| # So to actually test that tskit imports it, we need a minimal test | |
| run: | | |
| uv run --locked --group test --no-default-groups \ | |
| python -c "import tskit;tskit.Tree.generate_star(5).tree_sequence.draw_svg(path='test.svg')" | |
| - name: Run JIT code coverage | |
| run: | | |
| NUMBA_DISABLE_JIT=1 uv run --locked --project=python --no-default-groups\ | |
| pytest --cov=python/tskit --cov-report=xml --cov-branch \ | |
| python/tests/test_jit.py | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| fail_ci_if_error: true | |
| files: coverage.xml | |
| disable_search: true | |
| verbose: true | |
| flags: python-tests-no-jit | |
| - name: Build example LWT interface code and test | |
| working-directory: python/lwt_interface/ | |
| run: | | |
| make allchecks | |
| uv run --project=../ --group=test pytest -vs | |
| - name: Build cython example LWT interface code and run | |
| working-directory: python/lwt_interface/cython_example | |
| run: make | |
| bespoke-c-test: | |
| name: Bespoke C tests | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Cancel Previous Runs | |
| uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1 | |
| with: | |
| access_token: ${{ github.token }} | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - name: Install system deps | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libcunit1-dev ninja-build clang | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 | |
| with: | |
| version: "0.10.0" | |
| - name: Install uv deps | |
| run: | | |
| uv tool install meson==1.10.1 | |
| - name: Configure code | |
| run: CFLAGS=-D_TSK_BIG_TABLES CPPFLAGS=-D_TSK_BIG_TABLES meson setup build-bt c/ | |
| - name: Compile | |
| run: ninja -C build-bt | |
| - name: Run tests | |
| run: ninja -C build-bt test | |
| - name: Test building with meson subproject | |
| run: | | |
| meson build-subproject c/tests/meson-subproject | |
| ninja -C build-subproject | |
| ./build-subproject/example | |
| - name: Install shared library and hand-compile program. | |
| run: | | |
| meson build-install c --prefix=/usr | |
| sudo ninja -C build-install install | |
| clang c/examples/api_structure.c -I c/subprojects/kastore -o api_structure -ltskit | |
| ./api_structure | |
| - name: Run example make file | |
| run: | | |
| make -C c/examples | |