mirror of
https://github.com/PR0M3TH3AN/SeedPass.git
synced 2026-10-27 07:52:03 +00:00
thePR0M3TH3ANandClaude Opus 5
e9d49d10bc
Two GitHub-side changes, both about not wasting runs. PATH FILTERS. tests.yml (nine jobs across three OSes and three Pythons) and python-ci.yml (four) both triggered on every push and every pull request with no path restriction, so editing a markdown file spent thirteen jobs. They now trigger on the Python implementation and the files that pin its environment. ts-parity keeps triggering on src/** as well as js/**, deliberately: Python is the reference implementation the port is validated against, so a change there can break parity even when no TypeScript moved. THE SBOM STEP IS GONE. It invoked `@cyclonedx/cyclonedx-npm@latest --package-lock-only`, which is the NPM tool and reads package-lock.json — a file this pnpm workspace does not have and never will. It could not have worked on any run. It then swallowed the failure with `|| echo "non-fatal"` and uploaded with `if-no-files-found: warn`, two independent layers stopping it from going red, and its log said "No files were found with the provided path" every time. Removed rather than pinned. Pinning the version of a tool that cannot read this repository's lockfile fixes the wrong problem, and a security check that cannot fail is the same anti-pattern as the pwsh exit-code bug fixed earlier today — worse than absent, because it is trusted. `pnpm audit --audit-level moderate` stays and does fail on findings. A real bill of materials wants a pnpm-native generator, tracked in TODO.md. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01Vtx94nXDmNgXEeThUZP4QN
77 lines
2.7 KiB
YAML
77 lines
2.7 KiB
YAML
name: Tests
|
|
|
|
on:
|
|
push:
|
|
branches: ["**"]
|
|
paths:
|
|
# The Python implementation and everything that pins its environment.
|
|
# It is the reference implementation the TypeScript port is validated
|
|
# against, so it still has to be tested — but a docs edit or a change
|
|
# under js/ has no business firing 9 jobs.
|
|
- "src/**"
|
|
- "scripts/**"
|
|
- "pyproject.toml"
|
|
- "poetry.lock"
|
|
- "requirements.lock"
|
|
- "conftest.py"
|
|
- ".github/workflows/tests.yml"
|
|
pull_request:
|
|
branches: ["**"]
|
|
paths:
|
|
# The Python implementation and everything that pins its environment.
|
|
# It is the reference implementation the TypeScript port is validated
|
|
# against, so it still has to be tested — but a docs edit or a change
|
|
# under js/ has no business firing 9 jobs.
|
|
- "src/**"
|
|
- "scripts/**"
|
|
- "pyproject.toml"
|
|
- "poetry.lock"
|
|
- "requirements.lock"
|
|
- "conftest.py"
|
|
- ".github/workflows/tests.yml"
|
|
|
|
jobs:
|
|
test:
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os: [ubuntu-latest, macos-latest, windows-latest]
|
|
python-version: ["3.10", "3.11", "3.12"]
|
|
runs-on: ${{ matrix.os }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: ${{ matrix.python-version }}
|
|
cache: pip
|
|
- name: Install Poetry
|
|
run: pipx install poetry
|
|
- name: Install dependencies
|
|
run: poetry install --no-interaction --no-ansi
|
|
- name: Check formatting
|
|
run: poetry run black --check .
|
|
- name: Run security audit
|
|
run: |
|
|
poetry run pip-audit || echo "::warning::pip-audit found vulnerabilities"
|
|
shell: bash
|
|
- name: TUI v2 check smoke
|
|
run: poetry run seedpass tui2 --check
|
|
- name: Run deterministic regression tests
|
|
run: poetry run pytest -q src/tests/test_deterministic_artifact_regression.py
|
|
- name: Run tests with coverage
|
|
# `shell: bash` is load-bearing, not tidiness. Without it Windows runs
|
|
# this block under pwsh, where only the LAST command decides whether
|
|
# the step failed -- so `coverage xml` succeeding hid pytest failing,
|
|
# and this job reported success on Windows while reading
|
|
# "2 failed, 1114 passed". A check that cannot go red is worse than no
|
|
# check, because it is trusted.
|
|
shell: bash
|
|
run: |
|
|
poetry run coverage run -m pytest
|
|
poetry run coverage xml
|
|
- name: Upload coverage report
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: coverage-${{ matrix.os }}-py${{ matrix.python-version }}
|
|
path: coverage.xml
|