Fix PII result copy regression (#89) #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI Rust Python Package Plugins | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "Makefile" | |
| - "Cargo.toml" | |
| - "Cargo.lock" | |
| - ".cargo/**" | |
| - ".config/nextest.toml" | |
| - "deny.toml" | |
| - "crates/**" | |
| - "README.md" | |
| - "DEVELOPING.md" | |
| - "TESTING.md" | |
| - "plugins/rust/python-package/**" | |
| - "plugins/tests/**" | |
| - "tools/**" | |
| - ".github/workflows/ci-rust-python-package.yaml" | |
| - ".github/workflows/release-rust-python-package.yaml" | |
| pull_request: | |
| branches: [main] | |
| paths: | |
| - "Makefile" | |
| - "Cargo.toml" | |
| - "Cargo.lock" | |
| - ".cargo/**" | |
| - ".config/nextest.toml" | |
| - "deny.toml" | |
| - "crates/**" | |
| - "README.md" | |
| - "DEVELOPING.md" | |
| - "TESTING.md" | |
| - "plugins/rust/python-package/**" | |
| - "plugins/tests/**" | |
| - "tools/**" | |
| - ".github/workflows/ci-rust-python-package.yaml" | |
| - ".github/workflows/release-rust-python-package.yaml" | |
| workflow_dispatch: | |
| concurrency: | |
| group: ci-rust-python-package-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.head_ref || github.ref_name }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| jobs: | |
| validate-and-detect: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| plugins: ${{ steps.detect.outputs.plugins }} | |
| has_plugins: ${{ steps.detect.outputs.has_plugins }} | |
| plugin_count: ${{ steps.detect.outputs.plugin_count }} | |
| cargo_packages: ${{ steps.detect.outputs.cargo_packages }} | |
| mutation_cargo_packages: ${{ steps.detect.outputs.mutation_cargo_packages }} | |
| mutation_jobs: ${{ steps.detect.outputs.mutation_jobs }} | |
| has_mutation_cargo_packages: ${{ steps.detect.outputs.has_mutation_cargo_packages }} | |
| release_validation_tags: ${{ steps.detect.outputs.release_validation_tags }} | |
| has_release_validation_tags: ${{ steps.detect.outputs.has_release_validation_tags }} | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 | |
| with: | |
| python-version: "3.12" | |
| - id: detect | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| if [[ "${GITHUB_EVENT_NAME}" == "pull_request" ]]; then | |
| selection="$(python3 tools/plugin_catalog.py ci-selection . diff "${{ github.event.pull_request.base.sha }}" "${{ github.event.pull_request.head.sha }}")" | |
| elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then | |
| selection="$(python3 tools/plugin_catalog.py ci-selection . all '' '')" | |
| elif [[ "${{ github.event.before }}" == "0000000000000000000000000000000000000000" ]]; then | |
| selection="$(python3 tools/plugin_catalog.py ci-selection . all '' '')" | |
| else | |
| selection="$(python3 tools/plugin_catalog.py ci-selection . diff "${{ github.event.before }}" "${{ github.sha }}")" | |
| fi | |
| selection="$(printf '%s' "${selection}" | python3 tools/validate_ci_selection.py)" | |
| plugins="$(printf '%s' "${selection}" | python3 -c 'import json, sys; print(json.dumps(json.load(sys.stdin)["plugins"]))')" | |
| has_plugins="$(printf '%s' "${selection}" | python3 -c 'import json, sys; print(str(json.load(sys.stdin)["has_plugins"]).lower())')" | |
| plugin_count="$(printf '%s' "${selection}" | python3 -c 'import json, sys; print(json.load(sys.stdin)["plugin_count"])')" | |
| cargo_packages="$(printf '%s' "${selection}" | python3 -c 'import json, sys; print(json.dumps(json.load(sys.stdin)["cargo_packages"]))')" | |
| mutation_cargo_packages="$(printf '%s' "${selection}" | python3 -c 'import json, sys; print(json.dumps(json.load(sys.stdin)["mutation_cargo_packages"]))')" | |
| mutation_jobs="$(printf '%s' "${selection}" | python3 -c 'import json, sys; print(json.dumps(json.load(sys.stdin)["mutation_jobs"]))')" | |
| has_mutation_cargo_packages="$(printf '%s' "${selection}" | python3 -c 'import json, sys; print(str(json.load(sys.stdin)["has_mutation_cargo_packages"]).lower())')" | |
| release_validation_tags="$(printf '%s' "${selection}" | python3 -c 'import json, sys; print(json.dumps(json.load(sys.stdin)["release_validation_tags"]))')" | |
| has_release_validation_tags="$(printf '%s' "${selection}" | python3 -c 'import json, sys; print(str(json.load(sys.stdin)["has_release_validation_tags"]).lower())')" | |
| if [[ "${has_plugins}" == "false" ]]; then | |
| has_plugins_output="false" | |
| else | |
| has_plugins_output="true" | |
| fi | |
| has_mutation_cargo_packages_output="${has_mutation_cargo_packages}" | |
| { | |
| echo "plugins=${plugins}" | |
| echo "plugin_count=${plugin_count}" | |
| echo "cargo_packages=${cargo_packages}" | |
| echo "has_plugins=${has_plugins_output}" | |
| echo "mutation_cargo_packages=${mutation_cargo_packages}" | |
| echo "mutation_jobs=${mutation_jobs}" | |
| echo "has_mutation_cargo_packages=${has_mutation_cargo_packages_output}" | |
| echo "release_validation_tags=${release_validation_tags}" | |
| echo "has_release_validation_tags=${has_release_validation_tags}" | |
| } >> "$GITHUB_OUTPUT" | |
| build-test: | |
| needs: validate-and-detect | |
| if: needs.validate-and-detect.outputs.has_plugins == 'true' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| plugin: ${{ fromJson(needs.validate-and-detect.outputs.plugins) }} | |
| runs-on: ${{ matrix.os }} | |
| defaults: | |
| run: | |
| shell: bash | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 | |
| with: | |
| python-version: "3.12" | |
| - name: Verify Rust toolchain | |
| run: | | |
| rustc --version | |
| cargo --version | |
| - name: Install cargo-nextest | |
| run: | | |
| if [[ "${RUNNER_OS}" == "Linux" ]]; then | |
| mkdir -p "${CARGO_HOME:-$HOME/.cargo}/bin" | |
| curl -LsSf https://get.nexte.st/0.9.133/linux | tar zxf - -C "${CARGO_HOME:-$HOME/.cargo}/bin" | |
| elif [[ "${RUNNER_OS}" == "macOS" ]]; then | |
| mkdir -p "${CARGO_HOME:-$HOME/.cargo}/bin" | |
| if [[ "$(uname -m)" == "arm64" ]]; then | |
| curl -LsSf https://get.nexte.st/0.9.133/mac | tar zxf - -C "${CARGO_HOME:-$HOME/.cargo}/bin" | |
| else | |
| curl -LsSf https://get.nexte.st/0.9.133/mac | tar zxf - -C "${CARGO_HOME:-$HOME/.cargo}/bin" | |
| fi | |
| else | |
| cargo install cargo-nextest --version 0.9.133 --locked | |
| fi | |
| cargo nextest --version | |
| - name: Install uv | |
| run: python -m pip install uv==0.9.30 maturin==1.12.6 | |
| - name: Sync plugin environment | |
| working-directory: plugins/rust/python-package/${{ matrix.plugin }} | |
| run: make sync | |
| - name: Plugin CI build verification | |
| if: matrix.os == 'ubuntu-latest' | |
| working-directory: plugins/rust/python-package/${{ matrix.plugin }} | |
| env: | |
| NEXTEST_PROFILE: ci | |
| run: make ci-build | |
| - name: Plugin CI verification | |
| if: matrix.os != 'ubuntu-latest' | |
| working-directory: plugins/rust/python-package/${{ matrix.plugin }} | |
| env: | |
| NEXTEST_PROFILE: ci | |
| run: make ci | |
| security-policy: | |
| needs: validate-and-detect | |
| if: needs.validate-and-detect.outputs.has_plugins == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| - name: Verify Rust toolchain | |
| run: | | |
| rustc --version | |
| cargo --version | |
| - name: Install cargo deny | |
| run: cargo install cargo-deny@0.19.0 --locked | |
| - name: Run cargo deny | |
| run: cargo deny check --config deny.toml | |
| mutation-testing: | |
| needs: validate-and-detect | |
| if: github.event_name == 'pull_request' && needs.validate-and-detect.outputs.has_mutation_cargo_packages == 'true' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| mutation_job: ${{ fromJson(needs.validate-and-detect.outputs.mutation_jobs) }} | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| shell: bash | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 | |
| with: | |
| python-version: "3.12" | |
| - name: Verify Rust toolchain | |
| run: | | |
| rustc --version | |
| cargo --version | |
| - name: Install Rust mutation testing tooling | |
| run: | | |
| if [[ "${RUNNER_OS}" == "Linux" ]]; then | |
| mkdir -p "${CARGO_HOME:-$HOME/.cargo}/bin" | |
| curl -LsSf https://get.nexte.st/0.9.133/linux | tar zxf - -C "${CARGO_HOME:-$HOME/.cargo}/bin" | |
| elif [[ "${RUNNER_OS}" == "macOS" ]]; then | |
| mkdir -p "${CARGO_HOME:-$HOME/.cargo}/bin" | |
| if [[ "$(uname -m)" == "arm64" ]]; then | |
| curl -LsSf https://get.nexte.st/0.9.133/mac | tar zxf - -C "${CARGO_HOME:-$HOME/.cargo}/bin" | |
| else | |
| curl -LsSf https://get.nexte.st/0.9.133/mac | tar zxf - -C "${CARGO_HOME:-$HOME/.cargo}/bin" | |
| fi | |
| else | |
| cargo install cargo-nextest --version 0.9.133 --locked | |
| fi | |
| cargo nextest --version | |
| cargo install cargo-mutants --version 27.0.0 --locked | |
| cargo mutants --version | |
| - name: Create mutation diff | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| run: git diff "${BASE_SHA}" -- '*.rs' > cargo-mutants.diff | |
| - name: Run cargo-mutants with nextest | |
| env: | |
| CARGO_PACKAGE: ${{ matrix.mutation_job.cargo_package }} | |
| IN_DIFF: ${{ matrix.mutation_job.in_diff }} | |
| PYO3_PYTHON: python | |
| TEST_PACKAGES: ${{ toJson(matrix.mutation_job.test_packages) }} | |
| run: | | |
| mapfile -t test_packages < <(python3 -c 'import json, os; [print(package) for package in json.loads(os.environ["TEST_PACKAGES"])]') | |
| cargo_args=("-p" "${CARGO_PACKAGE}") | |
| if [[ "${IN_DIFF}" == "true" ]]; then | |
| cargo_args+=("--in-diff" "cargo-mutants.diff") | |
| fi | |
| for package in "${test_packages[@]}"; do | |
| cargo_args+=("--test-package" "${package}") | |
| done | |
| cargo mutants "${cargo_args[@]}" | |
| coverage: | |
| needs: validate-and-detect | |
| if: needs.validate-and-detect.outputs.has_plugins == 'true' | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| shell: bash | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 | |
| with: | |
| python-version: "3.12" | |
| - name: Install Rust coverage tooling | |
| run: | | |
| rustup component add llvm-tools-preview | |
| cargo install cargo-llvm-cov --version 0.8.4 --locked | |
| - name: Install cargo-nextest | |
| run: | | |
| if [[ "${RUNNER_OS}" == "Linux" ]]; then | |
| mkdir -p "${CARGO_HOME:-$HOME/.cargo}/bin" | |
| curl -LsSf https://get.nexte.st/0.9.133/linux | tar zxf - -C "${CARGO_HOME:-$HOME/.cargo}/bin" | |
| elif [[ "${RUNNER_OS}" == "macOS" ]]; then | |
| mkdir -p "${CARGO_HOME:-$HOME/.cargo}/bin" | |
| if [[ "$(uname -m)" == "arm64" ]]; then | |
| curl -LsSf https://get.nexte.st/0.9.133/mac | tar zxf - -C "${CARGO_HOME:-$HOME/.cargo}/bin" | |
| else | |
| curl -LsSf https://get.nexte.st/0.9.133/mac | tar zxf - -C "${CARGO_HOME:-$HOME/.cargo}/bin" | |
| fi | |
| else | |
| cargo install cargo-nextest --version 0.9.133 --locked | |
| fi | |
| cargo nextest --version | |
| - name: Install Python build tooling | |
| run: python -m pip install uv==0.9.30 maturin==1.12.6 | |
| - name: Generate Rust coverage report | |
| env: | |
| CARGO_PACKAGES: ${{ needs.validate-and-detect.outputs.cargo_packages }} | |
| NEXTEST_PROFILE: ci | |
| PLUGINS: ${{ needs.validate-and-detect.outputs.plugins }} | |
| PYO3_PYTHON: python | |
| run: | | |
| mkdir -p coverage | |
| mapfile -t cargo_packages < <(python3 -c 'import json, os; [print(package) for package in json.loads(os.environ["CARGO_PACKAGES"])]') | |
| mapfile -t plugins < <(python3 -c 'import json, os; [print(plugin) for plugin in json.loads(os.environ["PLUGINS"])]') | |
| cargo_args=() | |
| for package in "${cargo_packages[@]}"; do | |
| cargo_args+=("-p" "${package}") | |
| done | |
| cargo llvm-cov clean --workspace | |
| mkdir -p coverage | |
| cargo llvm-cov nextest --no-report "${cargo_args[@]}" -P "${NEXTEST_PROFILE}" | |
| eval "$(cargo llvm-cov show-env --sh)" | |
| export CARGO_TARGET_DIR="${CARGO_LLVM_COV_TARGET_DIR}/llvm-cov-target" | |
| export CARGO_LLVM_COV_BUILD_DIR="${CARGO_TARGET_DIR}" | |
| export LLVM_PROFILE_FILE="${CARGO_TARGET_DIR}/cpex-plugins-%p-%10m.profraw" | |
| mkdir -p "${CARGO_TARGET_DIR}" | |
| for plugin in "${plugins[@]}"; do | |
| (cd "plugins/rust/python-package/${plugin}" && make sync && uv run maturin develop) | |
| done | |
| for plugin in "${plugins[@]}"; do | |
| (cd "plugins/rust/python-package/${plugin}" && make test-integration) | |
| done | |
| env -u CARGO_TARGET_DIR -u CARGO_LLVM_COV_BUILD_DIR -u CARGO_LLVM_COV_TARGET_DIR -u LLVM_PROFILE_FILE cargo llvm-cov report "${cargo_args[@]}" --cobertura --output-path coverage/cobertura.xml | |
| - name: Enforce per-plugin coverage floor | |
| env: | |
| PLUGINS: ${{ needs.validate-and-detect.outputs.plugins }} | |
| run: python3 tools/plugin_catalog.py coverage-check . coverage/cobertura.xml 90.00 "${PLUGINS}" | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe | |
| with: | |
| files: ./coverage/cobertura.xml | |
| flags: rust-python-package-workspace | |
| name: rust-python-package-workspace-coverage | |
| documentation: | |
| needs: validate-and-detect | |
| if: needs.validate-and-detect.outputs.has_plugins == 'true' | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| shell: bash | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| - name: Verify Rust toolchain | |
| run: | | |
| rustc --version | |
| cargo --version | |
| - name: Build Rust documentation | |
| env: | |
| CARGO_PACKAGES: ${{ needs.validate-and-detect.outputs.cargo_packages }} | |
| run: | | |
| mapfile -t cargo_packages < <(python3 -c 'import json, os; [print(package) for package in json.loads(os.environ["CARGO_PACKAGES"])]') | |
| cargo_args=() | |
| for package in "${cargo_packages[@]}"; do | |
| cargo_args+=("-p" "${package}") | |
| done | |
| cargo doc "${cargo_args[@]}" --lib --no-deps --document-private-items | |
| release-validation: | |
| if: github.event_name == 'pull_request' && needs.validate-and-detect.outputs.has_release_validation_tags == 'true' | |
| needs: validate-and-detect | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| tag: ${{ fromJson(needs.validate-and-detect.outputs.release_validation_tags) }} | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| id-token: write | |
| uses: ./.github/workflows/release-rust-python-package.yaml | |
| with: | |
| tag: ${{ matrix.tag }} | |
| repository: testpypi | |
| publish_enabled: false |