SBA OHA on protests: naics_code filter, five OHA fields, conformance mapping #63
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Linting | |
| # Lint gate runs on every PR and push to main. | |
| # | |
| # - ruff format + ruff check are HARD gates (block the PR). | |
| # - mypy is a HARD gate: the package type-checks cleanly under strict mypy. | |
| # (The earlier ~28-error burn-down is complete.) | |
| # - The SDK filter/shape conformance check is a HARD gate: it runs against the | |
| # vendored contract at contracts/filter_shape_contract.json on every run (no | |
| # secrets needed, works on forks). A second, token-gated step compares the | |
| # vendored contract against the tango repo's HEAD and emits a staleness | |
| # notice (never a failure — tango HEAD may carry unreleased changes). | |
| # Refresh the vendored contract with scripts/refresh_contract.py. | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| branches: [ main ] | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v8.1.0 | |
| with: | |
| version: "latest" | |
| - name: Set up Python | |
| run: uv python install 3.12 | |
| - name: Install dependencies | |
| run: uv sync --all-extras | |
| - name: Check formatting with ruff | |
| run: uv run ruff format --check tango/ | |
| - name: Lint with ruff | |
| run: uv run ruff check tango/ | |
| - name: Type check with mypy | |
| run: uv run mypy tango/ | |
| conformance: | |
| # Hard gate against the vendored contract (contracts/filter_shape_contract.json). | |
| # Runs unconditionally — no secrets required, so forks and tokenless runs | |
| # get the full check instead of a silent skip. | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v8.1.0 | |
| with: | |
| version: "latest" | |
| - name: Set up Python | |
| run: uv python install 3.12 | |
| - name: Install dependencies | |
| run: uv sync --all-extras | |
| - name: Check SDK filter/shape conformance (vendored contract) | |
| run: uv run python scripts/check_filter_shape_conformance.py | |
| # --- Staleness notice (best-effort, never fails the job) --------------- | |
| - name: Determine token availability | |
| id: gate | |
| env: | |
| TANGO_API_REPO_ACCESS_TOKEN: ${{ secrets.TANGO_API_REPO_ACCESS_TOKEN }} | |
| run: | | |
| if [ -n "$TANGO_API_REPO_ACCESS_TOKEN" ]; then | |
| echo "ready=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "ready=false" >> "$GITHUB_OUTPUT" | |
| echo "::notice::Contract staleness check skipped — TANGO_API_REPO_ACCESS_TOKEN not configured." | |
| fi | |
| - name: Checkout tango API repo (contract source) | |
| if: steps.gate.outputs.ready == 'true' | |
| uses: actions/checkout@v6 | |
| with: | |
| repository: makegov/tango | |
| path: tango-api | |
| token: ${{ secrets.TANGO_API_REPO_ACCESS_TOKEN }} | |
| - name: Compare vendored contract against tango HEAD | |
| if: steps.gate.outputs.ready == 'true' | |
| run: | | |
| if ! diff -q contracts/filter_shape_contract.json tango-api/contracts/filter_shape_contract.json >/dev/null; then | |
| echo "::warning::Vendored contract differs from makegov/tango HEAD. Refresh with: uv run python scripts/refresh_contract.py" | |
| else | |
| echo "Vendored contract matches makegov/tango HEAD." | |
| fi |