ci: set least-privilege GITHUB_TOKEN permissions (#8) #30
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [master] | |
| tags: ["v*"] | |
| pull_request: | |
| branches: [master] | |
| permissions: | |
| contents: read | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 | |
| with: | |
| python-version: "3.14" | |
| - name: Install linters | |
| run: pip install ruff cython-lint | |
| - name: Lint Python with ruff | |
| run: ruff check . --ignore SIM103 | |
| - name: Lint advisories (non-blocking) | |
| run: ruff check . --select SIM103 || true | |
| - name: Lint Cython | |
| run: > | |
| cython-lint | |
| pydgq/solver/*.pyx pydgq/solver/*.pxd | |
| pydgq/utils/discontify.pyx | |
| pydgq/examples/example_kernel.pyx pydgq/examples/example_kernel.pxd | |
| || true | |
| test: | |
| needs: lint | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # Full Python matrix on Linux; newest Python only on macOS and Windows. | |
| # Rationale: this `test` job exists for fast feedback ahead of the | |
| # `build-wheels` job, which runs `cibuildwheel` with CIBW_TEST_COMMAND | |
| # on every (Python × OS) combination anyway. Duplicating the full | |
| # 12-job matrix here would re-find the same issues in parallel. | |
| # Trimming keeps broad Linux coverage (where most contributors | |
| # develop), smoke-tests macOS and Windows on the newest Python, and | |
| # leaves cibuildwheel as the comprehensive backstop for ABI/build | |
| # regressions on older Pythons across all three OSes. | |
| os: [ubuntu-latest] | |
| python-version: ["3.11", "3.12", "3.13", "3.14"] | |
| include: | |
| - os: macos-latest | |
| python-version: "3.14" | |
| - os: windows-latest | |
| python-version: "3.14" | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install build and test dependencies | |
| run: pip install meson-python meson ninja Cython numpy pylu pytest | |
| - name: Install package | |
| run: pip install --no-build-isolation -e . | |
| - name: Run tests | |
| run: pytest tests/ -v | |
| build-wheels: | |
| needs: test | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - uses: pypa/cibuildwheel@f03ac7617d6cff873ccf24cc0d567ef5ba5a9e6d # v4.0.0 | |
| env: | |
| CIBW_BUILD: "cp311-* cp312-* cp313-* cp314-*" | |
| CIBW_SKIP: "*-win32 *-manylinux_i686 *-musllinux*" | |
| CIBW_TEST_REQUIRES: pytest numpy pylu | |
| CIBW_TEST_COMMAND: pytest {project}/tests/ -v | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: wheels-${{ matrix.os }} | |
| path: wheelhouse/*.whl | |
| sdist: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 | |
| with: | |
| python-version: "3.14" | |
| - run: pip install build | |
| - run: python -m build --sdist | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: sdist | |
| path: dist/*.tar.gz | |
| publish: | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| needs: [build-wheels, sdist] | |
| runs-on: ubuntu-latest | |
| environment: pypi | |
| permissions: | |
| id-token: write | |
| steps: | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| path: dist/ | |
| merge-multiple: true | |
| - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0 | |
| with: | |
| packages-dir: dist/ |