Thank you Doctor Zizmor! #217
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| env: | |
| FORCE_COLOR: "1" # Make tools pretty. | |
| PIP_DISABLE_PIP_VERSION_CHECK: 1 | |
| PIP_NO_PYTHON_VERSION_WARNING: 1 | |
| SETUPTOOLS_SCM_PRETEND_VERSION: "1.0" # avoid warnings about shallow checkout | |
| permissions: {} | |
| jobs: | |
| tests: | |
| name: Tests on ${{ matrix.python-version }} | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: | |
| - "3.9" | |
| - "3.10" | |
| - "3.11" | |
| - "3.12" | |
| - "3.13" | |
| - "pypy-3.9" | |
| - "pypy-3.10" | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| submodules: recursive | |
| persist-credentials: false | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| allow-prereleases: true | |
| cache: pip | |
| - run: python -Im pip install tox | |
| - name: Determine Python version for tox | |
| env: | |
| V: ${{ matrix.python-version }} | |
| run: | | |
| if [[ "$V" = pypy-* ]]; then | |
| V=$(echo $V | tr -d .-) | |
| else | |
| V=py$(echo $V | tr -d .) | |
| fi | |
| echo TOX_PYTHON=$V >>$GITHUB_ENV | |
| - run: python -Im tox run -f $TOX_PYTHON | |
| system-package: | |
| runs-on: ubuntu-latest | |
| name: Install and test with system package of Argon2 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version-file: .python-version-default | |
| cache: pip | |
| - name: Install dependencies | |
| run: | | |
| sudo apt-get install libargon2-0 libargon2-0-dev | |
| # Ensure we cannot use our own Argon2 by accident. | |
| rm -rf extras | |
| - run: python -Im pip install tox | |
| - run: python -Im tox run -e system-argon2 | |
| package: | |
| name: Build & verify package | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| submodules: recursive | |
| persist-credentials: false | |
| - uses: hynek/build-and-inspect-python-package@v2 | |
| id: baipp | |
| - uses: actions/setup-python@v5 | |
| with: | |
| cache: pip | |
| python-version: "3.x" # use the one that baipp used | |
| # Smoke-check the wheel against argon2-cffi. | |
| - run: python -Im pip install $DIST/*.whl | |
| env: | |
| DIST: ${{ steps.baipp.outputs.dist }} | |
| - run: python -Im pip install --no-deps git+https://github.com/hynek/argon2-cffi.git | |
| - run: python -Im argon2 -n 1 -t 1 -m 8 -p 1 | |
| install-dev: | |
| name: Verify dev env | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, windows-latest, macos-latest] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| submodules: recursive | |
| persist-credentials: false | |
| - uses: actions/setup-python@v5 | |
| with: | |
| cache: pip | |
| python-version-file: .python-version-default | |
| - run: python -Im pip install -e .[dev] | |
| - name: Import package | |
| run: python -c 'from _argon2_cffi_bindings import ffi, lib; print(lib.ARGON2_VERSION_NUMBER)' | |
| - run: otool -L src/_argon2_cffi_bindings/_ffi.abi3.so | |
| if: startsWith(matrix.os , 'macos') | |
| - run: ldd src/_argon2_cffi_bindings/_ffi.abi3.so | |
| if: startsWith(matrix.os , 'ubuntu') | |
| cog-check: | |
| name: Ensure cogified files are up-to-date | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| submodules: recursive | |
| persist-credentials: false | |
| - uses: actions/setup-python@v5 | |
| with: | |
| cache: pip | |
| python-version: "3.x" | |
| - run: python -Im pip install tox | |
| - run: python -Im tox run -e cog-check | |
| required-checks-pass: | |
| name: Ensure everything required is passing for branch protection | |
| if: always() | |
| needs: | |
| - tests | |
| - install-dev | |
| - package | |
| - system-package | |
| - cog-check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Decide whether the needed jobs succeeded or failed | |
| uses: re-actors/alls-green@release/v1 | |
| with: | |
| jobs: ${{ toJSON(needs) }} |