ci: route shell tests through the shared python-ci reusable#123
Merged
Conversation
The shell-tests job was the last one in ci.yml with step-level action uses (actions/checkout + an inline run block). It now calls netresearch/.github python-ci.yml, so every job in ci.yml is a reusable workflow call and actions live only inside reusables. The two bash suites run via python-ci's test step; test_reconcile_dryrun.sh drives `python3 audit.py`, so the caller installs the project (packaging, PyYAML) on Python 3.14 instead of relying on the runner's system interpreter. Workflow-level permissions are now empty, with the grant declared on each calling job. Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned Files
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
ci.ymlnow contains zero step-level action uses — every job is a call to a shared reusable workflow in netresearch/.github. The only job left with inline steps wasshell-tests(actions/checkout+ arun:block); it now callspython-ci.yml, whose test step executes the caller-supplied command withbash -cfrom the repo root.app-ci,docsandintegration-e2ewere already reusable calls and are untouched.Behaviour comparison —
shell-testspython-ci.yml@main)runs-on: ubuntu-latestos-versionsdefault'["ubuntu-latest"]'actions/checkout@3d3c42e(v7)actions/checkout@3d3c42e(v7), same SHA, pluspersist-credentials: falsebash tests/test_guide_multi_install.shthenbash tests/test_reconcile_dryrun.shin one `run:test-cmd: bash tests/test_guide_multi_install.sh && bash tests/test_reconcile_dryrun.shworking-directorydefault.bash -edefaults.run.shell: bash, command run viabash -crun-lint: false,run-type-check: falsepython3(3.12 onubuntu-24.04)actions/setup-python3.14 +pip install -e .contents: readcontents: read, reusable job declarescontents: readtimeout-minutesdefault 15upload-coverage-*defaultfalseif:)run-tests: truekeeps it runningpython-ci.yml'sworkflow_callinputs,secrets, per-jobpermissions(contents: read) and steps were read from source onmainbefore mapping. No input needed by this job is missing, and nothing the old job did is dropped.Accepted, intentional deltas
test_reconcile_dryrun.shrunspython3 audit.py --helpand greps the output.cli_auditimportspackagingandPyYAML, which happened to be present in the runner's system interpreter; asetup-pythoninterpreter is clean, so the caller installs the project explicitly. 3.14 is used becausepyproject.tomldeclaresrequires-python = ">=3.14"(and the rest of this workflow already tests 3.14). This makes the environment deterministic rather than dependent on runner image contents — strictly stronger than before.step-security/harden-runner(egress-policyaudit) andpersist-credentials: falseon checkout.permissions: {}replacescontents: read. Every job in this file declares its ownpermissions:block, so the effective token per job is unchanged; this matches the caller pattern already used independency-review.ymlandauto-merge-deps.yml.Shell TeststoShell Tests / Python 3.14 (ubuntu-latest).mainhas no required status checks configured, so no branch-protection update is needed.Deliberately NOT migrated
release.yml— out of scope for this PR. Migrating it needs extensions topython-release.ymlthat do not exist yet; migrating it now would drop behaviour.dependency-review.yml,auto-merge-deps.yml— already pure reusable callers with no step-level actions.Validation
actionlint .github/workflows/ci.yml— clean.grep "uses:" .github/workflows/ci.ymlreturns only the fournetresearch/.github/.github/workflows/*.yml@mainreusable calls; no step-leveluses:remains.