tests/.github/workflows/check.yml at main · opentdf/tests · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
name: Lint and similar things for test

on:
  pull_request:
    types: [opened, synchronize, reopened]
  push:
    branches:
      - main
jobs:
  scriptcheck:
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: 🦪 ✔ 🧼🧼🧼
        run: >-
          docker run --rm -v "$PWD:/mnt" --workdir "/mnt" "koalaman/shellcheck:v0.8.0" --color=always \
              $(find . -type f -exec grep -m1 -l -E '^#!.*sh.*' {} \; | grep -v '/.git/')
      - name: Check shell script formatting with shfmt
        run: docker run --rm -v "$PWD:/mnt" --workdir "/mnt" mvdan/shfmt:v3 -d .
      - name: Install uv
        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
        with:
          enable-cache: false
          # requires-python is only a floor, so without a pin uv takes the
          # newest CPython -- whose wheels lag behind, which breaks the
          # --no-build step below the day it is released.
          python-version: "3.15"
      - name: Install dependencies
        run: uv sync --extra dev
        working-directory: xtest
      - name: Lint xtest python
        run: |
          uv run ruff check .
          uv run ruff format --check .
          uv run pyright
        working-directory: xtest
      # Offline tests for the harnesses whose own correctness gates a nightly
      # job: the benchmark statistics, measurement and CLI command builders,
      # the encryption fixture cache, and the ZIP64 central-directory parser.
      # No platform and no SDK builds required, so the part that has to be
      # *correct* is checked on every PR rather than only when the nightly runs.
      #
      # --frozen --no-build: resolve nothing and build nothing, so a
      # dependency cannot slip in an unlocked version or a setup script on a
      # runner that already has everything installed from the step above.
      - name: Test xtest offline harnesses
        run: >-
          uv run --frozen --no-build pytest --no-header -q
          test_bench_stats.py test_bench_measure.py test_bench_runner.py
          test_bench_arms.py test_bench_config.py test_bench_report.py
          test_sdk_commands.py test_tdfs_units.py test_encryption_units.py
          test_sizes_units.py test_zip64_units.py test_assertions_units.py
          test_zip_conformance_units.py
        working-directory: xtest
      - name: Lint and test otdf-local
        run: |
          uv sync
          uv run ruff check .
          uv run ruff format --check .
          uv run pyright
          uv run pytest --maxfail=1 --disable-warnings -v --tb=short -m "not integration"
        working-directory: otdf-local
      - name: Lint and test otdf-sdk-mgr
        run: |
          uv sync
          uv run ruff check .
          uv run ruff format --check .
          uv run pyright
          uv run pytest --maxfail=1 --disable-warnings -v --tb=short -m "not integration"
        working-directory: otdf-sdk-mgr