harden warm pool lifecycle before release #418

Workflow file for this run

	name: CI

	on:
	push:
	branches: [main, feat/, ci/]
	pull_request:
	branches: [main]
	workflow_dispatch:

	permissions:
	contents: read

	env:
	PYTHON_VERSION: "3.11"

	jobs:
	lint:
	name: Lint & static analysis
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: ${{ env.PYTHON_VERSION }}

	- name: Install pre-commit
	run: pip install pre-commit

	- name: Run ruff linter
	run: pre-commit run ruff --all-files

	- name: Run ruff formatter
	run: pre-commit run ruff-format --all-files

	- name: Run mypy
	run: pre-commit run mypy --all-files

	import-boundaries:
	name: Import boundary checks
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: ${{ env.PYTHON_VERSION }}

	- name: Install dependencies
	run: \|
	pip install uv
	uv pip install --system -e ".[test]"

	- name: Run import-linter
	run: make lint-imports

	security-audit:
	name: Dependency security audit
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: ${{ env.PYTHON_VERSION }}

	- name: Install dependencies
	run: \|
	pip install uv
	uv pip install --system ".[test]"

	- name: Run pip-audit
	run: \|
	# Generate pinned requirements from installed deps, excluding goldfish
	# (not on PyPI yet). pip-audit -r mode only audits the file.
	uv pip freeze --system \| grep -vi "^goldfish[ =@]" > /tmp/audit-requirements.txt
	pip-audit --strict --desc -r /tmp/audit-requirements.txt --no-deps

	unit-tests:
	name: Unit tests
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: ${{ env.PYTHON_VERSION }}

	- name: Cache dependencies
	uses: actions/cache@v4
	with:
	path: ~/.cache/uv
	key: ${{ runner.os }}-uv-${{ env.PYTHON_VERSION }}-${{ hashFiles('pyproject.toml') }}
	restore-keys: \|
	${{ runner.os }}-uv-${{ env.PYTHON_VERSION }}-

	- name: Install dependencies
	run: \|
	pip install uv
	uv pip install --system -e ".[test]"

	- name: Run unit tests with coverage
	run: make test-unit

	- name: Upload coverage
	uses: codecov/codecov-action@v4
	with:
	file: ./coverage.xml
	flags: unit
	token: ${{ secrets.CODECOV_TOKEN }}
	fail_ci_if_error: false

	rust-tests:
	name: Rust SDK tests
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Set up Rust
	uses: dtolnay/rust-toolchain@stable

	- name: Cache cargo
	uses: actions/cache@v4
	with:
	path: \|
	~/.cargo/bin/
	~/.cargo/registry/index/
	~/.cargo/registry/cache/
	~/.cargo/git/db/
	goldfish-rust/target/
	key: ${{ runner.os }}-cargo-${{ hashFiles('goldfish-rust/Cargo.lock') }}
	restore-keys: \|
	${{ runner.os }}-cargo-

	- name: Run Rust tests
	working-directory: goldfish-rust
	run: cargo test

	integration-tests:
	name: Integration tests
	needs: [unit-tests, rust-tests]
	runs-on: ubuntu-latest
	if: >
	github.ref == 'refs/heads/main' \|\|
	startsWith(github.ref, 'refs/heads/feat/') \|\|
	github.event.pull_request.head.repo.full_name == github.repository
	steps:
	- uses: actions/checkout@v4

	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: ${{ env.PYTHON_VERSION }}

	- name: Configure git for tests
	run: \|
	git config --global user.email "test@example.com"
	git config --global user.name "Test User"

	- name: Install dependencies
	run: \|
	pip install uv
	uv pip install --system -e ".[test]"

	- name: Run integration tests
	run: pytest tests/integration -v --tb=short -m "not requires_docker"
	timeout-minutes: 10

	# Final gate - ensures all jobs pass before merge
	gate:
	name: CI gate
	if: always()
	needs: [lint, import-boundaries, security-audit, unit-tests, rust-tests, integration-tests]
	runs-on: ubuntu-latest
	steps:
	- name: Check results
	run: \|
	failed=""
	for job in lint import-boundaries security-audit unit-tests rust-tests integration-tests; do
	case "$job" in
	lint) result="${{ needs.lint.result }}" ;;
	import-boundaries) result="${{ needs.import-boundaries.result }}" ;;
	security-audit) result="${{ needs.security-audit.result }}" ;;
	unit-tests) result="${{ needs.unit-tests.result }}" ;;
	rust-tests) result="${{ needs.rust-tests.result }}" ;;
	integration-tests) result="${{ needs.integration-tests.result }}" ;;
	esac
	if [[ "$result" != "success" && "$result" != "skipped" ]]; then
	echo "FAIL: $job = $result"
	failed="true"
	else
	echo "OK: $job = $result"
	fi
	done
	if [[ -n "$failed" ]]; then
	echo ""
	echo "One or more CI jobs failed"
	exit 1
	fi
	echo ""
	echo "All CI checks passed"

Navigation Menu

harden warm pool lifecycle before release #418

Workflow file

harden warm pool lifecycle before release #418

Uh oh!

Workflow file for this run