geopins-python/.github/workflows/ci.yml at develop · tonkintaylor/geopins-python · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
name: CI
permissions:
  contents: read
on:
  workflow_dispatch:
  push:
    branches: ["master", "develop"]
    paths-ignore:
      - "docs/**"
      - "**/*.md"
      - "mkdocs.yml"
  pull_request:
    branches: ["master", "develop"]
    paths-ignore:
      - "docs/**"
      - "**/*.md"
      - "mkdocs.yml"
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
jobs:
  tests:
    name: Run Tests and Checks
    runs-on: ${{ matrix.os }}
    env:
      PYTHONIOENCODING: utf-8
    steps:
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Set up uv
        uses: astral-sh/setup-uv@f94ec6bedd8674c4426838e6b50417d36b6ab231 # v5.3.1
        with:
          version: "0.7.13" # Sync with pyproject.toml
          enable-cache: true

      - name: Setup Python
        run: |
          uv python pin ${PYTHON_VERSION}
          uv python install
        env:
          PYTHON_VERSION: ${{ matrix.python-version }}

      - name: Run Prek
        if: matrix.checks
        run: |
          uv run --frozen prek run --all-files

      - name: Run pyright
        if: matrix.checks
        run: |
          uv run pyright

      - name: Run zizmor
        if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.13'
        run: |
          uv run zizmor --no-progress --pedantic .github/
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Run pytest
        uses: pavelzw/pytest-action@510c5e90c360a185039bea56ce8b3e7e51a16507 # v2.2.0
        if: matrix.pytest
        with:
          custom-pytest: uv run pytest
          custom-arguments: --cov --junitxml=junit.xml -o junit_family=legacy --cov-report=xml
        env:
          MPLBACKEND: Agg # https://github.com/orgs/community/discussions/26434

      - name: Create test reports directory
        if: matrix.pytest && matrix.os == 'ubuntu-latest' && matrix.python-version == '3.10' && matrix.resolution == 'highest'
        run: mkdir -p ./test-reports

      - name: Upload coverage reports
        if: matrix.pytest && matrix.os == 'ubuntu-latest' && matrix.python-version == '3.10' && matrix.resolution == 'highest'
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: coverage-reports
          path: test-reports/coverage.xml

    strategy:
      matrix:
        os: ["ubuntu-latest", "macos-latest", "windows-latest"]
        python-version: ["3.10", "3.11", "3.12", "3.13"]
        resolution: ["highest"]
        checks: [true]
        pytest: [true]
        include:
          - os: "ubuntu-latest"
            python-version: "3.10"
            resolution: "lowest-direct"
            checks: false
            pytest: true

  code-analysis:
    name: Analyse Code Quality
    runs-on: ubuntu-latest
    needs: tests
    permissions:
      pull-requests: write # SonarQube needs to post comments on PRs
    if: always() && needs.tests.result == 'success'

    steps:
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0 # Shallow clones should be disabled for better relevancy of analysis
          persist-credentials: false

      - name: Download coverage reports
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: coverage-reports
          path: test-reports/
        continue-on-error: true

      - name: Create SonarQube properties
        run: |
          cat > sonar-project.properties << EOF
          sonar.projectKey=${SONAR_PROJECT_KEY}
          sonar.language=py
          sonar.python.version=3.10
          sonar.sources=./src
          sonar.tests=./tests
          sonar.python.coverage.reportPaths=./test-reports/coverage.xml
          sonar.exclusions=**/Dockerfile,**/notebooks/**,**/scripts/**
          sonar.verbose=false
          EOF
        env:
          SONAR_PROJECT_KEY: ${{ vars.SONAR_PROJECT_KEY }}

      - name: Run SonarQube analysis
        uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6.0.0
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }}