fix(build): resolve relative paths and preserve zip execute bits (#217) #739
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [master, main] | |
| tags: ["v*"] | |
| pull_request: | |
| branches: [master, main] | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| lint: | |
| name: Lint (ruff) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: Setup uv | |
| uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0 | |
| with: | |
| enable-cache: true | |
| - name: Setup Python | |
| run: uv python install 3.12 | |
| - name: Sync deps | |
| run: uv sync --extra dev | |
| - name: Ruff check | |
| run: uv run ruff check src tests | |
| - name: Ruff format check | |
| run: uv run ruff format --check src tests | |
| - name: Verify skill reference is fresh | |
| run: uv run python scripts/gen_and_check.py check scripts/gen-skill-ref.py src/rdc/_skills/references/commands-quick-ref.md | |
| - name: Verify commands data is fresh | |
| run: uv run python scripts/gen_and_check.py check scripts/gen-commands.py docs-astro/src/data/commands.json | |
| security: | |
| name: Dependency audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0 | |
| with: | |
| enable-cache: true | |
| - run: uv python install 3.12 | |
| - run: uv sync --extra dev | |
| # CVE-2026-4539: no fixed pygments release yet (last_affected=2.19.2); ignore until upstream ships a patch | |
| - run: uv run --with pip-audit pip-audit --ignore-vuln CVE-2026-4539 | |
| validate-aur: | |
| name: Validate AUR PKGBUILD | |
| runs-on: ubuntu-latest | |
| container: archlinux:latest | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: Install makedepends from PKGBUILD | |
| run: | | |
| deps=$(sed -n '/^makedepends=(/,/)/p' aur/PKGBUILD \ | |
| | grep -oP "'[^']+'" | tr -d "'" | tr '\n' ' ') | |
| pacman -Syu --noconfirm base-devel $deps | |
| - name: Build wheel (no-isolation, same as PKGBUILD) | |
| run: python -m build --wheel --no-isolation | |
| env: | |
| SETUPTOOLS_SCM_PRETEND_VERSION: "0.0.0" | |
| typecheck: | |
| name: Type check (mypy) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: Setup uv | |
| uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0 | |
| with: | |
| enable-cache: true | |
| - name: Setup Python | |
| run: uv python install 3.12 | |
| - name: Sync deps | |
| run: uv sync --extra dev | |
| - name: Mypy | |
| run: uv run mypy src | |
| test: | |
| name: Test (py${{ matrix.python-version }}, ${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.10", "3.12", "3.14"] | |
| os: [ubuntu-latest, windows-latest] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: Setup uv | |
| uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0 | |
| with: | |
| enable-cache: true | |
| - name: Setup Python | |
| run: uv python install ${{ matrix.python-version }} | |
| - name: Sync deps | |
| run: uv sync --extra dev --python ${{ matrix.python-version }} | |
| - name: Pytest + coverage | |
| run: uv run --python ${{ matrix.python-version }} pytest tests/unit -v --cov=rdc --cov-report=term-missing --cov-fail-under=80 | |
| - name: Verify generated files are fresh | |
| if: runner.os == 'Linux' | |
| run: uv run --python ${{ matrix.python-version }} python scripts/gen_and_check.py check scripts/gen-skill-ref.py src/rdc/_skills/references/commands-quick-ref.md | |
| # macOS runners cost ~10x vs Linux — only run on manual dispatch or tag releases | |
| test-macos: | |
| name: Test (py3.12, macos-latest) | |
| if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v') | |
| runs-on: macos-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: Setup uv | |
| uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0 | |
| with: | |
| enable-cache: true | |
| - name: Setup Python | |
| run: uv python install 3.12 | |
| - name: Sync deps | |
| run: uv sync --extra dev --python 3.12 | |
| - name: Pytest + coverage | |
| run: uv run --python 3.12 pytest tests/unit -v --cov=rdc --cov-report=term-missing --cov-fail-under=80 | |
| build-and-verify: | |
| name: Build & verify (py${{ matrix.python-version }}) | |
| needs: [lint, typecheck, test] | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.10", "3.12", "3.14"] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: Setup uv | |
| uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0 | |
| with: | |
| enable-cache: true | |
| - name: Setup Python | |
| run: uv python install ${{ matrix.python-version }} | |
| - name: Build | |
| run: uv build --python ${{ matrix.python-version }} | |
| - name: Twine check | |
| run: uvx twine check dist/* | |
| - name: Check wheel contents | |
| run: uvx check-wheel-contents dist/*.whl | |
| - name: Create clean test venv | |
| run: uv venv /tmp/test-env --python ${{ matrix.python-version }} | |
| - name: Install wheel in clean venv | |
| run: uv pip install dist/*.whl --python /tmp/test-env/bin/python | |
| - name: Smoke test version | |
| run: /tmp/test-env/bin/rdc --version | |
| - name: Smoke test help | |
| run: /tmp/test-env/bin/rdc --help | |
| - name: Smoke test import | |
| run: /tmp/test-env/bin/python -c "from rdc.cli import main" | |
| - name: Upload dist artifacts | |
| if: matrix.python-version == '3.12' | |
| uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1 | |
| with: | |
| name: dist | |
| path: dist/ | |
| release: | |
| name: Publish to PyPI + GitHub Release | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| needs: [build-and-verify, test-macos] | |
| runs-on: ubuntu-latest | |
| environment: pypi | |
| permissions: | |
| id-token: write | |
| contents: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| fetch-depth: 0 | |
| - name: Download dist artifacts | |
| uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 | |
| with: | |
| name: dist | |
| path: dist/ | |
| - name: Publish to PyPI | |
| uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0 | |
| - name: Create GitHub Release | |
| uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0 | |
| with: | |
| files: dist/* | |
| generate_release_notes: true |