Harden experiment transport and evidence precision #56
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: quality | |
| on: | |
| push: | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, windows-latest, macos-latest] | |
| python-version: ["3.10", "3.13"] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| cache: pip | |
| - name: Install | |
| run: python -m pip install --upgrade pip && python -m pip install -e ".[dev]" | |
| - name: Lint | |
| run: python -m ruff check mrma tests | |
| - name: Test | |
| run: python -m pytest | |
| - name: Compile | |
| run: python -m compileall -q mrma | |
| - name: CLI smoke | |
| run: mrma --version | |
| evidence-quality: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: "3.13" | |
| cache: pip | |
| - run: python -m pip install --upgrade pip && python -m pip install -e ".[dev]" | |
| - name: Type check experiment core | |
| run: >- | |
| python -m mypy | |
| mrma/core/compare.py | |
| mrma/core/experiment.py | |
| mrma/core/http_client.py | |
| mrma/core/http_semantics.py | |
| mrma/core/privacy.py | |
| mrma/core/sender.py | |
| - name: Coverage | |
| run: >- | |
| python -m pytest | |
| --cov=mrma.core.compare | |
| --cov=mrma.core.experiment | |
| --cov=mrma.core.http_client | |
| --cov=mrma.core.http_semantics | |
| --cov=mrma.core.privacy | |
| --cov=mrma.core.sender | |
| --cov-report=term-missing | |
| --cov-fail-under=85 | |
| runtime-audit: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.10", "3.13"] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| cache: pip | |
| - name: Audit published runtime dependency floor | |
| run: | | |
| python -m pip install --upgrade pip pip-audit | |
| python -m pip_audit --requirement requirements-audit.txt | |
| distribution: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: "3.13" | |
| cache: pip | |
| - run: python -m pip install --upgrade pip twine | |
| - name: Install hash-locked build toolchain | |
| run: >- | |
| python -m pip install --only-binary=:all: | |
| --require-hashes -r requirements-build.txt | |
| - name: Build wheel and source distribution | |
| run: python -m build --no-isolation | |
| - name: Validate distribution metadata | |
| run: python -m twine check dist/* | |
| - name: Validate hash-locked container dependencies | |
| run: >- | |
| python -m pip install --dry-run --only-binary=:all: | |
| --require-hashes -r requirements-container.txt | |
| - name: Install built wheel in a clean environment | |
| run: | | |
| python -m venv /tmp/mrma-wheel | |
| /tmp/mrma-wheel/bin/python -m pip install --upgrade pip | |
| /tmp/mrma-wheel/bin/python -m pip install dist/*.whl | |
| /tmp/mrma-wheel/bin/python -m pip check | |
| cd /tmp | |
| /tmp/mrma-wheel/bin/mrma --version | |
| /tmp/mrma-wheel/bin/python -c "from importlib.resources import files; root=files('mrma.schemas'); assert all(root.joinpath(f'experiment-v{v}.schema.json').is_file() for v in (2,3,4,5)); assert 'site-packages' in str(root)" | |
| container: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Build pinned container | |
| run: docker build --tag mrma:ci . | |
| - name: Smoke test non-root image | |
| run: | | |
| test "$(docker image inspect mrma:ci --format '{{.Config.User}}')" = "mrma" | |
| docker run --rm mrma:ci --version |