python-tuf/.github/workflows/_test.yml at develop · theupdateframework/python-tuf · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
on:
  workflow_call:
  # Permissions inherited from caller workflow

permissions: {}

jobs:
  lint-test:
    name: Lint Test
    runs-on: ubuntu-latest

    steps:
      - name: Checkout TUF
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Python (oldest supported version)
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.10"
          cache: 'pip'
          cache-dependency-path: |
            requirements/*.txt
            pyproject.toml

      - name: Install dependencies
        run: |
          python3 -m pip install --constraint requirements/build.txt tox coveralls

      - name: Run tox
        env:
          RUFF_OUTPUT_FORMAT: github
        run: tox -e lint

  tests:
    name: Tests
    needs: lint-test
    strategy:
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
        os: [ubuntu-latest]
        include:
          - python-version: "3.x"
            os: macos-latest
          - python-version: "3.x"
            os: windows-latest

    runs-on: ${{ matrix.os }}

    steps:
      - name: Checkout TUF
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ matrix.python-version }}
          cache: 'pip'
          cache-dependency-path: |
            requirements/*.txt
            pyproject.toml

      - name: Install dependencies
        run: |
          python3 -m pip install --constraint requirements/build.txt tox coveralls

      - name: Run tox (non-Windows)
        if: runner.os != 'Windows'
        run: tox -e py

      - name: Run tox on Windows (unprivileged user without Developer Mode)
        if: runner.os == 'Windows'
        shell: powershell
        run: |
          # Disable Developer Mode in registry
          Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" -Name "AllowDevelopmentWithoutDevLicense" -Value 0 -ErrorAction SilentlyContinue

          # Create a non-admin local user
          $secpasswd = ConvertTo-SecureString "Password123!" -AsPlainText -Force
          $user = New-LocalUser -Name "testuser" -Password $secpasswd -FullName "Test User" -ErrorAction SilentlyContinue

          # Grant testuser permission to workspace directory and ancestors
          $curr = Get-Item $pwd
          while ($curr -ne $null) {
              $acl = Get-Acl $curr.FullName
              $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("testuser", "FullControl", "ContainerInherit,ObjectInherit", "None", "Allow")
              $acl.AddAccessRule($rule)
              Set-Acl $curr.FullName $acl
              $curr = $curr.Parent
          }

          # Run tox as unprivileged user
          $cred = New-Object System.Management.Automation.PSCredential ("testuser", $secpasswd)
          $process = Start-Process -FilePath "tox" -ArgumentList "-e py" -Credential $cred -NoNewWindow -Wait -PassThru
          if ($process.ExitCode -ne 0) {
              exit $process.ExitCode
          }

      - name: Publish on coveralls.io
        # A failure to publish coverage results on coveralls should not
        # be a reason for a job failure.
        continue-on-error: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          COVERALLS_FLAG_NAME: ${{ runner.os }} / Python ${{ matrix.python-version }}
          COVERALLS_PARALLEL: true
        run: |
          coveralls --service=github

  all-tests-pass:
    name: All tests passed
    needs: [lint-test, tests]
    runs-on: ubuntu-latest
    steps:
      - run: echo "All test jobs have completed successfully."

  coveralls-fin:
    # Always run when all 'tests' jobs have finished even if they failed
    # TODO: Replace always() with a 'at least one job succeeded' expression
    if: always()
    needs: tests
    runs-on: ubuntu-latest
    steps:
      - name: Add requirements file to make setup-python happy
        run: touch requirements.txt

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: '3.x'
          cache: 'pip'

      - name: Install dependencies
        run: |
          python3 -m pip install coveralls

      - name: Finalize publishing on coveralls.io
        continue-on-error: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: coveralls --finish