Audit remediation: quality gates with teeth, pinned toolchain, content and runtime fixes #174
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Verify | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: verify-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| verify: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: astral-sh/setup-uv@v5 | |
| with: | |
| enable-cache: false | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.13' | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '22' | |
| - name: Install dependencies | |
| run: uv sync --all-groups | |
| - name: Pin Wrangler for local Worker runtime | |
| run: npm install --global wrangler@4.90.0 | |
| - name: Start local Worker for browser checks | |
| run: | | |
| uv run --group workers pywrangler dev --port 9696 > /tmp/pythonbyexample-ci.log 2>&1 & | |
| for i in $(seq 1 180); do | |
| if grep -q 'Ready on http://localhost:9696' /tmp/pythonbyexample-ci.log; then | |
| exit 0 | |
| fi | |
| if grep -E 'failed to start|FileNotFoundError|Traceback|Address already' /tmp/pythonbyexample-ci.log; then | |
| cat /tmp/pythonbyexample-ci.log | |
| exit 1 | |
| fi | |
| sleep 1 | |
| done | |
| cat /tmp/pythonbyexample-ci.log | |
| exit 1 | |
| - name: Verify | |
| env: | |
| CHROME_PATH: /usr/bin/google-chrome | |
| run: | | |
| make verify | |
| scripts/format_examples.py --check | |
| make verify-python-version VERSION=3.13 | |
| git diff --check |