eva/.github/workflows/ci.yaml at b0dc36d719a0eb66ce48c6fda2ef7a94f6b00c33 · kaiko-ai/eva · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
---
name: CI

on:
  pull_request:
    branches:
      - "**"

concurrency:
  group: "${{ github.workflow }}-${{ github.ref }}"
  cancel-in-progress: true

permissions: {}

jobs:
  quality:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false
      - name: Setting up PDM
        uses: pdm-project/setup-pdm@94a823180e06fcde4ad29308721954a521c96ed0 # v4
        with:
          python-version: "3.10"
          architecture: x64
      - name: Setting up nox
        uses: wntrblm/nox@a74da2c766d4e656d6105639926c31f3aa4a6ca1 # 2025.02.09
        with:
          python-versions: "3.10"
      - name: Performing lint checks
        run: nox -s lint
      - name: Performing static type checks
        run: nox -s check
  tests:
    strategy:
      matrix:
        os:
          - ubuntu-latest
        python-version:
          - "3.10"
    runs-on: ${{ matrix.os }}
    steps:
      - name: Install OS dependencies
        run: |
          sudo apt update
          sudo apt install -y software-properties-common
          sudo add-apt-repository ppa:openslide/openslide
          sudo apt install -y openslide-tools
      - name: Checkout
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          lfs: true
          persist-credentials: false
      - name: Setting up PDM
        uses: pdm-project/setup-pdm@94a823180e06fcde4ad29308721954a521c96ed0 # v4
        with:
          python-version: ${{ matrix.python-version }}
          architecture: x64
      - name: Setting up nox
        uses: wntrblm/nox@a74da2c766d4e656d6105639926c31f3aa4a6ca1 # 2025.02.09
        with:
          python-versions: ${{ matrix.python-version }}
      - name: Executing unit tests
        run: nox -s test
  docs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false
      - name: Setting up PDM
        uses: pdm-project/setup-pdm@94a823180e06fcde4ad29308721954a521c96ed0 # v4
        with:
          python-version: "3.10"
          architecture: x64
      - name: Setting up nox
        uses: wntrblm/nox@a74da2c766d4e656d6105639926c31f3aa4a6ca1 # 2025.02.09
        with:
          python-versions: "3.10"
      - name: Configure Git Credentials
        run: |
          git config user.email "action@github.com"
          git config user.name "GitHub Action"
      - name: Building docs
        run: nox -s docs -- deploy --update-aliases dev
  security:
    runs-on: ubuntu-latest
    permissions:
      security-events: write # Needed for uploading SARIF reports
    steps:
      - name: Checkout
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false
      - name: Perform gitleaks checks
        run: |
          # Download and check
          curl -LJO https://github.com/gitleaks/gitleaks/releases/download/v8.18.2/gitleaks_8.18.2_linux_x64.tar.gz
          curl -LJO https://github.com/gitleaks/gitleaks/releases/download/v8.18.2/gitleaks_8.18.2_checksums.txt
          shasum -a 256 --ignore-missing --quiet -c gitleaks_8.18.2_checksums.txt
          if [ $? != 0 ]; then exit 1; fi
          # Extract gitleaks
          tar -zxvf gitleaks_8.18.2_linux_x64.tar.gz gitleaks
          # Run gitleaks
          ./gitleaks detect \
            --config .gitleaks.toml \
            --gitleaks-ignore-path .gitleaksignore \
            --no-git
      - name: Perform GitHub actions and workflows SAST
        uses: zizmorcore/zizmor-action@e673c3917a1aef3c65c972347ed84ccd013ecda4 # v0.2.0
        with:
          min-severity: low
          persona: pedantic
          version: latest