harness-python-react/.github/workflows/ci.yml at main · constk/harness-python-react · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
name: CI

# Action SHAs are pinned, not floating tags. To bump:
#   gh api repos/<owner>/<repo>/commits/<tag> --jq .sha
# (use /commits/<tag>, NOT /git/refs/tags/<tag> — annotated tags would
# return the tag-object SHA, which Actions can't resolve.)
# Update the comment on the right with the new tag for traceability.

on:
  push:
    branches: [develop, main]
  pull_request:
    branches: [develop, main]

jobs:
  lint:
    name: Lint & Format
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
        with:
          python-version: "3.14"
      - run: uv sync --frozen --extra dev
      - run: uv run ruff check .
      - run: uv run ruff format --check .

  typecheck:
    name: Type Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
        with:
          python-version: "3.14"
      - run: uv sync --frozen --extra dev
      - run: uv run mypy --strict src/ tests/

  test-unit:
    name: Unit tests
    runs-on: ubuntu-latest
    # Pure in-process tests — completes fast so PR authors get quick feedback.
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
        with:
          python-version: "3.14"
      - run: uv sync --frozen --extra dev
      - run: uv run pytest tests/ -v -m "not integration" -o "addopts="

  coverage:
    name: Coverage
    runs-on: ubuntu-latest
    # Enforces [tool.coverage.report].fail_under from pyproject.toml (75%).
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
        with:
          python-version: "3.14"
      - run: uv sync --frozen --extra dev
      - run: uv run pytest tests/ --cov=src --cov-report=term-missing

  architecture:
    name: Architecture (import-linter)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
        with:
          python-version: "3.14"
      - run: uv sync --frozen --extra dev
      - run: uv run lint-imports

  pre-commit:
    name: Pre-commit
    runs-on: ubuntu-latest
    # Runs every hook against all files — ensures a developer who forgot
    # `uv run pre-commit install` can't leak unformatted code or a stray
    # secret past the first defence layer.
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
        with:
          python-version: "3.14"
      - run: uv sync --frozen --extra dev
      - run: uv run pre-commit run --all-files --show-diff-on-failure

  file-length:
    name: File length
    runs-on: ubuntu-latest
    # CLAUDE.md: "no file over 300 lines, no function over ~50 lines". Ruff
    # PLR0915 / PLR0912 enforce the function-half (run by `Lint & Format`);
    # this job enforces the file-half. No exemption mechanism — pre-existing
    # offenders should be split before this job lands, not allowlisted.
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
        with:
          python-version: "3.14"
      - run: python .github/scripts/check_file_length.py

  version-bump:
    name: Version bump check
    runs-on: ubuntu-latest
    # Every non-`release:` PR bumps [project] version in pyproject.toml AND
    # the matching [[package]] block in uv.lock. Closes the bump-miss class
    # that the 75 % coverage gate cannot detect on its own.
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
        with:
          fetch-depth: 0  # full history so `git show origin/<base>:` resolves
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
        with:
          python-version: "3.14"
      - run: python .github/scripts/check_version_bump.py

  action-pinning:
    name: Action pinning audit
    runs-on: ubuntu-latest
    # Validates every `uses:` line in .github/workflows/ + .github/actions/
    # against the policy in docs/DEVELOPMENT.md#action-pinning-policy.
    # First-party = major tag; astral-sh/setup-uv = patch tag; third-party
    # = SHA + trailing `# vN.M.P` comment.
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
        with:
          python-version: "3.14"
      - run: python .github/scripts/check_action_pins.py

  tests-required:
    name: Tests required
    runs-on: ubuntu-latest
    # `feat:` / `fix:` PRs that touch `src/` must touch `tests/` too.
    # Per docs/DEVELOPMENT.md Testing Policy. Other prefixes get a warn-only
    # `::warning::` if src/ is touched without tests/.
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
        with:
          fetch-depth: 0  # full history so the diff resolves
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
        with:
          python-version: "3.14"
      - run: python .github/scripts/check_tests_present.py

  aspirational-tickets:
    name: Aspirational ticket cite
    runs-on: ubuntu-latest
    # docs/INVARIANTS.md: every `*Aspirational` / `**Aspirational**` marker
    # line cites a `#NNN` ticket; closed cites warn (or fail under
    # ASPIRATIONAL_STRICT=1). GITHUB_TOKEN enables ticket-state lookup.
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
        with:
          python-version: "3.14"
      - env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: python .github/scripts/check_aspirational_tickets.py

  src-readmes:
    name: src/ README audit
    runs-on: ubuntu-latest
    # CLAUDE.md: every `src/` package documents its purpose + key
    # interfaces. The audit checks shape (presence + min 200 bytes) and
    # structure (`## Key interfaces` heading). No exemption mechanism.
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
        with:
          python-version: "3.14"
      - run: python .github/scripts/check_src_readmes.py

  frontend-build:
    name: Frontend Build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6
        with:
          node-version: "24"
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      - run: cd frontend && npm ci && npm run build

  frontend-quality:
    name: Frontend Quality
    runs-on: ubuntu-latest
    # Lint + format + tsc + vitest. Mirrors the strict posture the backend
    # enjoys (ruff + mypy + pytest); the Frontend Build job above validates
    # the bundler output, this one validates source quality.
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6
        with:
          node-version: "24"
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      - run: cd frontend && npm ci
      - run: cd frontend && npm run lint
      - run: cd frontend && npm run format:check
      - run: cd frontend && npm run check
      - run: cd frontend && npm run test

  branch-protection-sync:
    name: Branch-protection contexts sync
    runs-on: ubuntu-latest
    # Guards against the "new CI job silently not required" drift. Fails when
    # .github/branch-protection/*.json contexts arrays disagree with the
    # actual workflow jobs on disk.
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
        with:
          python-version: "3.14"
      - run: uv sync --frozen --extra dev
      - run: uv run python .github/scripts/check_required_contexts.py

  commit-type-sync:
    name: Commit-type sync
    runs-on: ubuntu-latest
    # Guards against [tool.commitizen].customize.schema_pattern in pyproject
    # drifting from the `types` list in .github/workflows/pr-title.yml.
    # Adding a type in one but not the other would mean commits pass locally
    # while PR titles fail in CI (or vice versa).
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
        with:
          python-version: "3.14"
      - run: uv sync --frozen --extra dev
      - run: uv run python .github/scripts/check_commit_types.py

  # Frontend jobs (Frontend Build, Frontend Quality) are added by ticket #21
  # when frontend/package.json lands.