Skip to content

fix(build): resolve relative paths and preserve zip execute bits (#217) #739

fix(build): resolve relative paths and preserve zip execute bits (#217)

fix(build): resolve relative paths and preserve zip execute bits (#217) #739

Workflow file for this run

name: CI
on:
push:
branches: [master, main]
tags: ["v*"]
pull_request:
branches: [master, main]
workflow_dispatch:
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
permissions:
contents: read
jobs:
lint:
name: Lint (ruff)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Setup uv
uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
with:
enable-cache: true
- name: Setup Python
run: uv python install 3.12
- name: Sync deps
run: uv sync --extra dev
- name: Ruff check
run: uv run ruff check src tests
- name: Ruff format check
run: uv run ruff format --check src tests
- name: Verify skill reference is fresh
run: uv run python scripts/gen_and_check.py check scripts/gen-skill-ref.py src/rdc/_skills/references/commands-quick-ref.md
- name: Verify commands data is fresh
run: uv run python scripts/gen_and_check.py check scripts/gen-commands.py docs-astro/src/data/commands.json
security:
name: Dependency audit
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
with:
enable-cache: true
- run: uv python install 3.12
- run: uv sync --extra dev
# CVE-2026-4539: no fixed pygments release yet (last_affected=2.19.2); ignore until upstream ships a patch
- run: uv run --with pip-audit pip-audit --ignore-vuln CVE-2026-4539
validate-aur:
name: Validate AUR PKGBUILD
runs-on: ubuntu-latest
container: archlinux:latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Install makedepends from PKGBUILD
run: |
deps=$(sed -n '/^makedepends=(/,/)/p' aur/PKGBUILD \
| grep -oP "'[^']+'" | tr -d "'" | tr '\n' ' ')
pacman -Syu --noconfirm base-devel $deps
- name: Build wheel (no-isolation, same as PKGBUILD)
run: python -m build --wheel --no-isolation
env:
SETUPTOOLS_SCM_PRETEND_VERSION: "0.0.0"
typecheck:
name: Type check (mypy)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Setup uv
uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
with:
enable-cache: true
- name: Setup Python
run: uv python install 3.12
- name: Sync deps
run: uv sync --extra dev
- name: Mypy
run: uv run mypy src
test:
name: Test (py${{ matrix.python-version }}, ${{ matrix.os }})
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
python-version: ["3.10", "3.12", "3.14"]
os: [ubuntu-latest, windows-latest]
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Setup uv
uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
with:
enable-cache: true
- name: Setup Python
run: uv python install ${{ matrix.python-version }}
- name: Sync deps
run: uv sync --extra dev --python ${{ matrix.python-version }}
- name: Pytest + coverage
run: uv run --python ${{ matrix.python-version }} pytest tests/unit -v --cov=rdc --cov-report=term-missing --cov-fail-under=80
- name: Verify generated files are fresh
if: runner.os == 'Linux'
run: uv run --python ${{ matrix.python-version }} python scripts/gen_and_check.py check scripts/gen-skill-ref.py src/rdc/_skills/references/commands-quick-ref.md
# macOS runners cost ~10x vs Linux — only run on manual dispatch or tag releases
test-macos:
name: Test (py3.12, macos-latest)
if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')
runs-on: macos-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Setup uv
uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
with:
enable-cache: true
- name: Setup Python
run: uv python install 3.12
- name: Sync deps
run: uv sync --extra dev --python 3.12
- name: Pytest + coverage
run: uv run --python 3.12 pytest tests/unit -v --cov=rdc --cov-report=term-missing --cov-fail-under=80
build-and-verify:
name: Build & verify (py${{ matrix.python-version }})
needs: [lint, typecheck, test]
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
python-version: ["3.10", "3.12", "3.14"]
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Setup uv
uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
with:
enable-cache: true
- name: Setup Python
run: uv python install ${{ matrix.python-version }}
- name: Build
run: uv build --python ${{ matrix.python-version }}
- name: Twine check
run: uvx twine check dist/*
- name: Check wheel contents
run: uvx check-wheel-contents dist/*.whl
- name: Create clean test venv
run: uv venv /tmp/test-env --python ${{ matrix.python-version }}
- name: Install wheel in clean venv
run: uv pip install dist/*.whl --python /tmp/test-env/bin/python
- name: Smoke test version
run: /tmp/test-env/bin/rdc --version
- name: Smoke test help
run: /tmp/test-env/bin/rdc --help
- name: Smoke test import
run: /tmp/test-env/bin/python -c "from rdc.cli import main"
- name: Upload dist artifacts
if: matrix.python-version == '3.12'
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
with:
name: dist
path: dist/
release:
name: Publish to PyPI + GitHub Release
if: startsWith(github.ref, 'refs/tags/v')
needs: [build-and-verify, test-macos]
runs-on: ubuntu-latest
environment: pypi
permissions:
id-token: write
contents: write
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0
- name: Download dist artifacts
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
with:
name: dist
path: dist/
- name: Publish to PyPI
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
- name: Create GitHub Release
uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
with:
files: dist/*
generate_release_notes: true