lm15-python/.github/workflows/python.yml at main · lm15-dev/lm15-python · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
name: python

on:
  push:
  pull_request:

# The test pipeline only reads the checkout; never grant it more.
permissions:
  contents: read

jobs:
  test:
    # Every supported Python on every desktop/server OS: lm15 is stdlib-only,
    # so the risks are the platform's own (file locks, paths, sockets, signals).
    name: tests (${{ matrix.os }}, Python ${{ matrix.python }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        python: ["3.10", "3.11", "3.12", "3.13", "3.14"]
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ matrix.python }}
          allow-prereleases: true
      - name: Check out pinned contract
        # Tests import the shared cloud vectors during collection.
        run: |
          PIN=$(tr -d '[:space:]' < CONTRACT_PIN)
          [[ "$PIN" =~ ^[0-9a-f]{40}$ ]] || { echo 'Invalid CONTRACT_PIN'; exit 1; }
          git clone --no-checkout https://github.com/lm15-dev/lm15-contract.git ../lm15-contract
          git -C ../lm15-contract checkout --detach "$PIN"
      - name: Install
        run: python -m pip install -e . pytest pytest-asyncio pyyaml
      - name: Tests
        # Warnings are errors: a deprecation in a supported Python fails here
        # before that Python's successor removes the API, and text I/O that
        # does not name its encoding fails on every OS (Windows' default is
        # not UTF-8).
        env:
          PYTHONWARNDEFAULTENCODING: "1"
        run: python -m pytest tests/ -q -W error::DeprecationWarning -W error::EncodingWarning

  contract:
    # The cross-repo gates. The harness sandboxes each shim with Linux's
    # `unshare -rn`, so these run on Linux only.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      - name: Check out pinned contract
        run: |
          PIN=$(tr -d '[:space:]' < CONTRACT_PIN)
          [[ "$PIN" =~ ^[0-9a-f]{40}$ ]] || { echo 'Invalid CONTRACT_PIN'; exit 1; }
          git clone --no-checkout https://github.com/lm15-dev/lm15-contract.git ../lm15-contract
          git -C ../lm15-contract checkout --detach "$PIN"
          if [ ! -e ../lm15-python ]; then
            ln -s "$GITHUB_WORKSPACE" ../lm15-python
          fi
      - name: Install
        run: python -m pip install -e . pytest pytest-asyncio pyyaml
      - name: Conformance (strict)
        run: python conformance/run_all.py --strict
      - name: Contract harness (pinned)
        # Run the lm15-contract vet harness against this checkout at the SHA
        # pinned in CONTRACT_PIN (bump discipline in CONTRIBUTING.md). The
        # contract's shim registry expects the reference at the sibling path
        # ../lm15-python with a .venv.
        run: |
          test -z "$(git -C ../lm15-contract status --porcelain --untracked-files=all)"
          python -m venv .venv && .venv/bin/pip install -q -e .
          python ../lm15-contract/harness/check.py --shim python --direction all
      - name: Vet shim smoke test
        run: python -m pytest tests/test_vet_shim.py -q
      - name: Contract checkout stays clean
        if: always()
        run: |
          test -d ../lm15-contract/.git
          test -z "$(git -C ../lm15-contract status --porcelain --untracked-files=all)"

  typecheck:
    # tools/typecheck.py: the docs' programs type-check with --strict, and
    # lm15's own findings only go down (typecheck/baseline.txt). mypy is
    # pinned with hashes: the baseline's messages are version specific.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      - name: Install pinned mypy and lm15
        run: |
          python -m pip install --require-hashes -r requirements/typecheck.txt
          python -m pip install --no-deps -e .
      - name: Constructor signatures match the dataclasses
        run: python tools/gen_init_signatures.py --check
      - name: Type-check user programs and the package
        run: python tools/typecheck.py