docs: insert real Zenodo DOIs (concept 10.5281/zenodo.20172508, versi… #6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| lint: | |
| name: Lint (ruff + pre-commit) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| cache: "pip" | |
| - name: Install dev tooling | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e ".[dev]" | |
| - name: Ruff lint | |
| run: ruff check . | |
| - name: Ruff format check | |
| run: ruff format --check . | |
| - name: Pre-commit hooks | |
| run: pre-commit run --all-files --show-diff-on-failure | |
| test: | |
| name: Tests (py${{ matrix.python }} on ${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| needs: lint | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| python: ["3.11", "3.12", "3.13"] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ matrix.python }} | |
| cache: "pip" | |
| - name: Install package | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e ".[dev]" | |
| - name: Run pytest with coverage | |
| run: pytest --cov=src --cov-report=xml --cov-report=term -q | |
| - name: Upload coverage to Codecov | |
| if: matrix.os == 'ubuntu-latest' && matrix.python == '3.12' | |
| uses: codecov/codecov-action@v4 | |
| with: | |
| files: coverage.xml | |
| fail_ci_if_error: false | |
| env: | |
| CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} | |
| benchmarks: | |
| name: Analytical benchmarks | |
| runs-on: ubuntu-latest | |
| needs: lint | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| cache: "pip" | |
| - name: Install package | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e ".[dev]" | |
| - name: Run benchmarks | |
| run: python validation/benchmarks.py | |
| pipeline-smoke: | |
| name: Full pipeline smoke test | |
| runs-on: ubuntu-latest | |
| needs: [test, benchmarks] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| cache: "pip" | |
| - name: Install package | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e ".[dev]" | |
| - name: Run pipeline (run_all.py) | |
| run: python run_all.py | |
| - name: Verify assets generated | |
| run: | | |
| test -f assets/figures/panel_ab_fields.png | |
| test -f assets/figures/panel_c_mc_distribution.png | |
| test -f assets/figures/panel_d_sensitivity.png | |
| test -f assets/figures/panel_e_surrogate.png | |
| test -f assets/figures/panel_f_iso_risk.png | |
| test -f assets/figures/panel_g_fad.png | |
| test -f assets/figures/panel_h_inverse.png | |
| test -f assets/animations/cui_moisture_front.gif | |
| test -f assets/audit_chain.json | |
| - name: Verify audit chain integrity | |
| run: | | |
| python -c " | |
| import json | |
| with open('assets/audit_chain.json') as f: | |
| entries = json.load(f) | |
| assert len(entries) >= 2, f'Expected >=2 entries, got {len(entries)}' | |
| assert entries[0]['prev_hash'] == '0' * 64 | |
| assert all(e['entry_hash'] for e in entries) | |
| print(f'Audit chain OK: {len(entries)} entries') | |
| " | |
| - name: Upload pipeline artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: pipeline-outputs-${{ github.sha }} | |
| path: | | |
| assets/figures/*.png | |
| assets/animations/*.gif | |
| assets/audit_chain.json | |
| retention-days: 30 | |
| security: | |
| name: Security scan (pip-audit) | |
| runs-on: ubuntu-latest | |
| needs: lint | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| cache: "pip" | |
| - name: Install package + pip-audit | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e . | |
| pip install pip-audit | |
| - name: Audit dependencies | |
| run: pip-audit --strict | |
| continue-on-error: true | |
| ci-pass: | |
| name: All checks passed | |
| runs-on: ubuntu-latest | |
| needs: [lint, test, benchmarks, pipeline-smoke, security] | |
| steps: | |
| - run: echo "All CI jobs succeeded." |