980fc2dddd
Some checks failed
check / gate (push) Failing after 7s
The first real CI run wedged for 14 minutes. Not a network problem, not the isolation work — catthehacker/ubuntu:act-22.04 ships Python 3.10.12 while this project declares requires-python >=3.12, and pip answered that by backtracking through the entire release history of every dependency looking for something 3.10-compatible. At 100% CPU, with -q hiding every line of it, and it would have churned until the runner's 30m timeout. A version mismatch presenting as a hang rather than an error is worth a test, so there is one: the workflow's python image must satisfy pyproject's requires-python, checked by parsing both rather than by eyeballing them. Also: every job now has timeout-minutes. A wedged step should be a red check in minutes, not an occupied runner for half an hour. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
88 lines
3.2 KiB
YAML
88 lines
3.2 KiB
YAML
# The gate, running on our own hardware (G7.3).
|
|
#
|
|
# This is the dogfood: windy-git verifies itself before anything else migrates.
|
|
#
|
|
# `runs-on: veron-1` is a label this runner actually provides. NEVER
|
|
# `ubuntu-latest` (G7.5) — a self-hosted runner has no such label, so a workflow
|
|
# naming it queues forever and presents as a hung CI system rather than a typo.
|
|
|
|
name: check
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
jobs:
|
|
gate:
|
|
runs-on: veron-1
|
|
# Run IN a Python 3.12 image rather than trusting the runner image's
|
|
# toolchain. The first real CI run wedged here: catthehacker/ubuntu:act-22.04
|
|
# ships Python 3.10.12, this project declares requires-python >=3.12, and pip
|
|
# answered that by backtracking through the entire release history of every
|
|
# dependency looking for something 3.10-compatible. It churned for 14 minutes
|
|
# at 100% CPU with `-q` hiding all of it, and would have churned until the
|
|
# runner timeout. A version mismatch presenting as a hang, not an error.
|
|
container:
|
|
image: python:3.12-bookworm
|
|
# And a hard ceiling, so a wedged step is a red check in minutes rather than
|
|
# an occupied runner for half an hour.
|
|
timeout-minutes: 12
|
|
services:
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
env:
|
|
POSTGRES_USER: windygit
|
|
POSTGRES_PASSWORD: windygit
|
|
POSTGRES_DB: windygit
|
|
options: >-
|
|
--health-cmd "pg_isready -U windygit"
|
|
--health-interval 5s
|
|
--health-retries 10
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: install
|
|
run: |
|
|
python3 --version
|
|
python3 -m venv .venv
|
|
.venv/bin/pip install -q --upgrade pip
|
|
.venv/bin/pip install -e ".[dev]"
|
|
|
|
- name: lint
|
|
run: .venv/bin/ruff check api scripts
|
|
|
|
- name: vocabulary audit (D-9)
|
|
run: python3 scripts/vocab_audit.py
|
|
|
|
- name: tests
|
|
run: .venv/bin/pytest -q
|
|
|
|
# G0.4 — a migration nobody has run is a migration nobody can trust. This
|
|
# is the step that caught two bugs review did not: SQLAlchemy Enum
|
|
# persisting .name instead of .value, and create_table re-emitting
|
|
# CREATE TYPE without checkfirst.
|
|
- name: migration round-trip (upgrade -> downgrade -> upgrade)
|
|
env:
|
|
DATABASE_URL: postgresql://windygit:windygit@postgres:5432/windygit
|
|
run: |
|
|
.venv/bin/alembic upgrade head
|
|
.venv/bin/alembic downgrade base
|
|
.venv/bin/alembic upgrade head
|
|
|
|
# I-12 — the honesty check. Nine sibling services cannot name the commit
|
|
# they are running; one reports another repo's commit entirely.
|
|
- name: /version must equal HEAD
|
|
run: |
|
|
HEAD_SHA=$(git rev-parse HEAD)
|
|
COMMIT_SHA=deadbeefdeadbeefdeadbeefdeadbeefdeadbeef \
|
|
.venv/bin/python -c "
|
|
import os, sys
|
|
sys.path.insert(0, '.')
|
|
from api.app.buildinfo import get_build_info
|
|
info = get_build_info()
|
|
expected = '$HEAD_SHA'
|
|
assert info.commit_sha == expected, f'{info.commit_sha} != {expected}'
|
|
print('I-12 holds: env override ignored, reported', info.commit_sha[:12])
|
|
"
|