template-python-package/.github/workflows/checks.yml at f1ca652fb8c06e3ba975bc1176855f58c19e5775 · seedcase-project/template-python-package · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
name: Checks

on: pull_request

permissions: read-all

jobs:
  check-template:
    runs-on: ubuntu-latest
    steps:
      # This is a useful security step to check for unexpected outbound calls from the runner,
      # which could indicate a compromised token or runner.
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up uv
        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true

      - name: Install justfile
        run: uv tool install rust-just

      # Set this user so that the checks create Git commits.
      - name: Set bot user
        run: |
          git config --global user.name "github-actions[bot]"
          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - name: Check template creation
        run: just test-all

  check-typos:
    runs-on: ubuntu-latest
    steps:
      # This is a useful security step to check for unexpected outbound calls from the runner,
      # which could indicate a compromised token or runner.
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Spell check repo
        uses: crate-ci/typos@bee27e3a4fd1ea2111cf90ab89cd076c870fce14 # v1.48.0
        with:
          config: .config/typos.toml

  check-website-build:
    runs-on: ubuntu-latest
    steps:
      # This is a useful security step to check for unexpected outbound calls from the runner,
      # which could indicate a compromised token or runner.
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Quarto
        uses: quarto-dev/quarto-actions/setup@8a96df13519ee81fd526f2dfca5962811136661b # v2.2.0

      # Check that the website builds, but don't publish it
      - name: Render Quarto Project
        uses: quarto-dev/quarto-actions/render@8a96df13519ee81fd526f2dfca5962811136661b # v2.2.0

  # Dependency Review Action
  #
  # This Action will scan dependency manifest files that change as part of a Pull Request,
  # surfacing known-vulnerable versions of the packages declared or updated in the PR.
  # Once installed, if the workflow run is marked as required,
  # PRs introducing known-vulnerable packages will be blocked from merging.
  #
  # Source repository: https://github.com/actions/dependency-review-action
  check-dependencies:
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: "Checkout Repository"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: "Dependency Review"
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0