mirror of
https://github.com/nprasad2077/MNIST.git
synced 2026-11-04 09:15:29 +00:00
nprasad2077
2d2f7dd007
Lint notebooks (ruff), secret scan (gitleaks), dependency audit (pip-audit), workflow lint (actionlint) and notebook hygiene check, with a results table in the job summary. Fork PRs are skipped since the repo is public and the runner is self-hosted. Also removes an unused TensorDataset import from notebook 04.
105 lines
3.3 KiB
YAML
105 lines
3.3 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main, dev, actions]
|
|
pull_request:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ci-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
# Public repo + self-hosted runner: never run fork PRs on this machine.
|
|
env:
|
|
RUFF_VERSION: "0.15.0"
|
|
|
|
jobs:
|
|
lint-notebooks:
|
|
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
|
|
runs-on: self-hosted
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
persist-credentials: false
|
|
- run: uvx "ruff@${RUFF_VERSION}" check --output-format=github notebooks/
|
|
|
|
format-notebooks:
|
|
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
|
|
runs-on: self-hosted
|
|
continue-on-error: true # advisory: notebooks were never formatted
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
persist-credentials: false
|
|
- run: uvx "ruff@${RUFF_VERSION}" format --check notebooks/
|
|
|
|
secret-scan:
|
|
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
|
|
runs-on: self-hosted
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
- run: gitleaks detect --source . --redact --verbose
|
|
|
|
dep-audit:
|
|
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
|
|
runs-on: self-hosted
|
|
continue-on-error: true # advisory: pins are stale; Dependabot tracks bumps
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
persist-credentials: false
|
|
# Audit the pins only; installing requirements.txt fails on pywinpty.
|
|
- run: uvx pip-audit -r requirements.txt --no-deps --disable-pip
|
|
|
|
workflow-lint:
|
|
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
|
|
runs-on: self-hosted
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
persist-credentials: false
|
|
- run: actionlint
|
|
|
|
notebook-hygiene:
|
|
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
|
|
runs-on: self-hosted
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
persist-credentials: false
|
|
- run: uv run --python 3.11 --no-project python .github/scripts/notebook_hygiene.py
|
|
|
|
summary:
|
|
if: always()
|
|
needs: [lint-notebooks, format-notebooks, secret-scan, dep-audit, workflow-lint, notebook-hygiene]
|
|
runs-on: self-hosted
|
|
steps:
|
|
- name: Write job summary
|
|
env:
|
|
RESULTS: ${{ toJSON(needs) }}
|
|
EVENT: ${{ github.event_name }}
|
|
REF_NAME: ${{ github.ref_name }}
|
|
ACTOR: ${{ github.actor }}
|
|
RUNNER_DESC: ${{ runner.name }} (${{ runner.os }}/${{ runner.arch }})
|
|
run: |
|
|
{
|
|
echo "## CI results"
|
|
echo
|
|
echo "| Job | Result |"
|
|
echo "|---|---|"
|
|
echo "$RESULTS" | jq -r 'to_entries[] | "| \(.key) | \(.value.result) |"'
|
|
echo
|
|
echo "- **Trigger:** $EVENT"
|
|
echo "- **Ref:** $REF_NAME @ ${GITHUB_SHA::7}"
|
|
echo "- **Actor:** $ACTOR"
|
|
echo "- **Runner:** $RUNNER_DESC"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|