wehub-resource-sync
2114ccd278
CI / Lint & Test (Python 3.13) (push) Failing after 2s
CI / Lint & Test (Python 3.14) (push) Failing after 1s
CI / Lint & Test (Python 3.12) (push) Failing after 2s
CI / DCO Check (push) Has been skipped
Scorecard supply-chain security / Scorecard analysis (push) Failing after 2s
97 lines
3.3 KiB
YAML
97 lines
3.3 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
name: CI
|
|
|
|
on:
|
|
pull_request:
|
|
branches: ["main"]
|
|
push:
|
|
branches: ["main"]
|
|
|
|
# Least privilege: these jobs only read the repo; no write scopes are needed.
|
|
permissions:
|
|
contents: read
|
|
|
|
# Cancel superseded runs when new commits are pushed to the same ref.
|
|
concurrency:
|
|
group: ci-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
lint-and-test:
|
|
name: Lint & Test (Python ${{ matrix.python-version }})
|
|
runs-on: ubuntu-latest
|
|
# Windows is excluded: the test suite has known path-separator failures
|
|
# in build_context that are out of scope for this workflow.
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
python-version: ["3.12", "3.13", "3.14"]
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up uv
|
|
# Pinned to a full commit SHA (third-party action); comment tracks the tag.
|
|
uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
|
|
with:
|
|
enable-cache: true
|
|
python-version: ${{ matrix.python-version }}
|
|
|
|
- name: Install dependencies
|
|
run: uv sync --all-extras
|
|
|
|
- name: Lint with ruff
|
|
run: uv run ruff check src/ tests/
|
|
|
|
- name: Check formatting with ruff
|
|
run: uv run ruff format --check src/ tests/
|
|
|
|
- name: Run unit tests with coverage
|
|
run: uv run pytest -m "not integration" --cov=src/skillspector --cov-report=term-missing
|
|
|
|
dco:
|
|
name: DCO Check
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'pull_request'
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Verify DCO sign-off on all commits
|
|
run: |
|
|
BASE=${{ github.event.pull_request.base.sha }}
|
|
HEAD=${{ github.event.pull_request.head.sha }}
|
|
# Iterate SHAs directly rather than piping `git log` into `while read`:
|
|
# `git log` does not print a trailing newline after the final record,
|
|
# so a read-loop silently skips the last commit — and for a one-commit
|
|
# PR (the common case) the body never runs at all, letting an unsigned
|
|
# commit pass. A for-loop over the SHA list checks every commit.
|
|
status=0
|
|
for sha in $(git log --format=%H "${BASE}..${HEAD}"); do
|
|
if ! git log -1 --format="%B" "$sha" | grep -q "^Signed-off-by:"; then
|
|
echo " missing Signed-off-by: $sha $(git log -1 --format=%s "$sha")"
|
|
status=1
|
|
fi
|
|
done
|
|
if [ "$status" -ne 0 ]; then
|
|
echo ""
|
|
echo "Please add a DCO sign-off (git commit -s) to all commits."
|
|
exit 1
|
|
fi
|
|
echo "All commits have DCO sign-off."
|