Ci: Add GitHub Actions workflow for tests + packaging gate 0.0.44#82
Merged
Conversation
Closes the iter15 test-engineer minor finding (no CI workflow runs the suite or the packaging gate). Now meaningful with the post-iter20 100% green baseline. Two jobs: - unit-tests: matrix across Python 3.11 / 3.12 / 3.13 (the project's classifier set). Installs via uv to match local dev workflow. Runs 'pytest tests/' which the addopts default filters down to the fast unit lane (skipping packaging, isaac, unreal_live markers). - packaging-gate: only runs on main + PRs to main since the uv-build-per-test pattern is the slowest job. Overrides the addopts default by passing '-m packaging' last (pytest takes the LAST -m). Security: the workflow only references trusted inputs (matrix.python-version, github.ref, github.event_name) and never interpolates user-controlled fields (issue title, PR body, commit messages, head ref) into run: blocks. The risky-input avoidance is documented inline at the top of the file.
Code-reviewer found a HIGH (lockfile bypass) + 2 MEDIUM (double-runs, missing permissions) on the iter22 CI workflow: - HIGH: 'uv pip install --system -e .[dev]' bypasses the tracked uv.lock entirely, so CI resolves transitive deps fresh from PyPI on every run. A transitive-dep break would silently flip CI red unrelated to the PR. Switched to 'uv sync --extra dev' which reads uv.lock and pins all transitive versions to what local dev resolves. Test runs now use 'uv run pytest' to invoke pytest inside the synced project venv. Both jobs (unit-tests + packaging-gate) updated. - MEDIUM: a contributor pushing to a feature branch with an open PR triggered both push + pull_request events, doubling the matrix run. Added a 'concurrency' group keyed on workflow + ref with 'cancel-in-progress: true' — the stale push run is canceled the moment the PR event fires for the same ref. - MEDIUM: GITHUB_TOKEN inherited the repo's default permissions (often write). Added top-level 'permissions: contents: read' since this is a read-only test workflow with no deployments, releases, or comments. Plus 1 LOW addressed inline: - Added a one-sentence note to the packaging-gate comment that a packaging-breaking change pushed to a feature branch without a PR will not be caught until the PR is created (the 'main + PRs' conditional intentionally trades that case for slowest-job cost). - Removed the misleading 'CLAUDE.md tracks the canonical count' parenthetical — the count drifts as tests are added; pytest's own output is the canonical reference. Two LOW items deferred to iter23+: - SHA-pinning of action versions (actions/checkout@v4 etc) — best practice for public repos but over-engineering for v0.0.x. - Lint/type-check job (black/isort/flake8/mypy) — bigger scope improvement worth its own PR.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes the iter15 test-engineer minor finding (no CI workflow runs
the suite or packaging gate). Now meaningful with the post-iter20
100% green baseline.
Changes
.github/workflows/ci.yml(new):(the project's classifier set). Installs via
uv pip install --system -e ".[dev]"to match local dev workflow. Runspytest tests/which the addopts default filters down tothe fast unit lane (skipping packaging, isaac, unreal_live).
the uv-build-per-test pattern is the slowest job. Overrides
the addopts default with
-m packaging(pytest takes theLAST -m).
Security
The workflow only references trusted inputs
(
matrix.python-version,github.ref,github.event_name)and never interpolates user-controlled fields (issue title, PR
body, commit messages, head ref) into
run:blocks. Therisky-input avoidance is documented inline at the top of the file.
How to Test
The PR push itself is the test — both jobs should appear under
"Checks" and run green.
Checklist
Testing
pytest tests/baseline confirmed (495 passed,0 failed, 6 skipped, 3 deselected).
pytest tests/packaging/ -m packagingbaselineconfirmed (3 passed in ~1.2s).
Compatibility
4-file version bump.
only runs in GitHub Actions.
Documentation
packaging gate is conditional, and the security posture.