Bump docker/login-action from 4.4.0 to 4.6.0 #155
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: quality | |
| on: | |
| push: | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, windows-latest, macos-latest] | |
| python-version: ["3.10", "3.13"] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| cache: pip | |
| - name: Install | |
| run: python -m pip install --upgrade pip && python -m pip install -e ".[dev]" | |
| - name: Lint | |
| run: python -m ruff check mrma tests | |
| - name: Test | |
| run: python -m pytest | |
| - name: Compile | |
| run: python -m compileall -q mrma | |
| - name: CLI smoke | |
| run: mrma --version | |
| evidence-quality: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: "3.13" | |
| cache: pip | |
| - run: python -m pip install --upgrade pip && python -m pip install -e ".[dev]" | |
| - name: Strict type check v0.4 modules | |
| run: >- | |
| python -m mypy --strict | |
| mrma/benchmark.py | |
| mrma/engine | |
| mrma/evidence | |
| mrma/policy | |
| mrma/transport | |
| mrma/workflows | |
| - name: Type check corrected core | |
| run: >- | |
| python -m mypy | |
| mrma/core/compare.py | |
| mrma/core/experiment.py | |
| mrma/core/http_client.py | |
| mrma/core/http_semantics.py | |
| mrma/core/privacy.py | |
| mrma/core/raw_request.py | |
| mrma/core/sender.py | |
| - name: Whole-repository branch coverage | |
| run: >- | |
| python -m pytest | |
| --cov=mrma | |
| --cov-branch | |
| --cov-report=term-missing | |
| --cov-report=json:coverage.json | |
| - name: Enforce corrected-core and v0.4 runtime coverage | |
| run: python tools/check_critical_coverage.py coverage.json --minimum 90 --core-minimum 85 | |
| semantic-mutation: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: "3.13" | |
| cache: pip | |
| - run: python -m pip install --upgrade pip && python -m pip install -e ".[dev]" | |
| - name: Kill committed critical-policy mutation baseline | |
| run: python tools/run_mutation_gate.py --json-output mutation-result.json | |
| benchmark: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: "3.13" | |
| cache: pip | |
| - run: python -m pip install --upgrade pip && python -m pip install -e ".[dev]" | |
| - name: Validate packaged release baseline | |
| run: python -m pytest tests/test_benchmark.py::test_packaged_release_benchmark_is_schema_valid_and_passed | |
| - name: Run loopback benchmark | |
| run: python -c "from mrma.cli import main; main()" benchmark --out-json benchmark-result.json | |
| runtime-audit: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.10", "3.13"] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| cache: pip | |
| - name: Audit published runtime dependency floor | |
| run: | | |
| python -m pip install --upgrade pip pip-audit | |
| python -m pip_audit --requirement requirements-audit.txt | |
| distribution: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: "3.13" | |
| cache: pip | |
| - run: python -m pip install --upgrade pip twine | |
| - name: Install hash-locked build toolchain | |
| run: >- | |
| python -m pip install --only-binary=:all: | |
| --require-hashes -r requirements-build.txt | |
| - name: Build wheel and source distribution | |
| run: python -m build --no-isolation | |
| - name: Validate distribution metadata | |
| run: python -m twine check dist/* | |
| - name: Validate hash-locked container dependencies | |
| run: >- | |
| python -m pip install --dry-run --only-binary=:all: | |
| --require-hashes -r requirements-container.txt | |
| - name: Install built wheel in a clean environment | |
| run: | | |
| python -m venv /tmp/mrma-wheel | |
| /tmp/mrma-wheel/bin/python -m pip install --upgrade pip | |
| /tmp/mrma-wheel/bin/python -m pip install dist/*.whl | |
| /tmp/mrma-wheel/bin/python -m pip check | |
| cd /tmp | |
| /tmp/mrma-wheel/bin/mrma --version | |
| /tmp/mrma-wheel/bin/python -c "from importlib.resources import files; root=files('mrma.schemas'); assert all(root.joinpath(f'experiment-v{v}.schema.json').is_file() for v in (2,3,4,5,6,7,8,9)); assert all(root.joinpath(f'authorization-v{v}.schema.json').is_file() for v in (1,2)); assert all(root.joinpath(f'benchmark-v{v}.schema.json').is_file() for v in (1,2)); assert files('mrma').joinpath('benchmarks', 'release-baseline.json').is_file(); assert 'site-packages' in str(root)" | |
| cd /tmp | |
| /tmp/mrma-wheel/bin/python -c "import json; from importlib.resources import files; from mrma.evidence import validate_benchmark_document; validate_benchmark_document(json.loads(files('mrma').joinpath('benchmarks', 'release-baseline.json').read_text()))" | |
| container: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Build pinned container | |
| run: docker build --tag mrma:ci . | |
| - name: Smoke test non-root image | |
| run: | | |
| test "$(docker image inspect mrma:ci --format '{{.Config.User}}')" = "mrma" | |
| docker run --rm mrma:ci --version |