DM-44444: Allow database passwords to be SecretStrs #808
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Python CI | |
| "on": | |
| merge_group: {} | |
| pull_request: {} | |
| push: | |
| branches-ignore: | |
| # These should always correspond to pull requests, so ignore them for | |
| # the push trigger and let them be triggered by the pull_request | |
| # trigger, avoiding running the workflow twice. This is a minor | |
| # optimization so there's no need to ensure this is comprehensive. | |
| - "dependabot/**" | |
| - "renovate/**" | |
| - "tickets/**" | |
| - "u/**" | |
| release: | |
| types: [published] | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| - name: Run pre-commit | |
| uses: pre-commit/action@v3.0.1 | |
| test: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| python: | |
| - "3.11" | |
| - "3.12" | |
| steps: | |
| - uses: actions/checkout@v4 | |
| # Temporarily pin requests because 2.32.0 breaks docker 6.1.3. | |
| - name: Run tox | |
| uses: lsst-sqre/run-tox@v1 | |
| with: | |
| python-version: ${{ matrix.python }} | |
| tox-envs: "py,typing" | |
| tox-plugins: "tox-docker 'requests<2.32.0'" | |
| docs: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # full history for setuptools_scm | |
| - name: Install Graphviz | |
| run: sudo apt-get install graphviz | |
| - name: Run tox | |
| uses: lsst-sqre/run-tox@v1 | |
| with: | |
| python-version: "3.11" | |
| tox-envs: "docs,docs-linkcheck" | |
| # Only attempt documentation uploads for tagged releases and pull | |
| # requests from ticket branches in the same repository. This avoids | |
| # version clutter in the docs and failures when a PR doesn't have access | |
| # to secrets. | |
| - name: Upload to LSST the Docs | |
| uses: lsst-sqre/ltd-upload@v1 | |
| with: | |
| project: "safir" | |
| dir: "docs/_build/html" | |
| username: ${{ secrets.LTD_USERNAME }} | |
| password: ${{ secrets.LTD_PASSWORD }} | |
| if: > | |
| github.event_name != 'pull_request' | |
| || startsWith(github.head_ref, 'tickets/') | |
| test-packaging: | |
| name: Test packaging | |
| timeout-minutes: 5 | |
| runs-on: ubuntu-latest | |
| needs: [lint, test, docs] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # full history for setuptools_scm | |
| - name: Build and publish | |
| uses: lsst-sqre/build-and-publish-to-pypi@v2 | |
| with: | |
| python-version: "3.11" | |
| upload: false | |
| pypi: | |
| name: Upload release to PyPI | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| needs: [lint, test, docs, test-packaging] | |
| environment: | |
| name: pypi | |
| url: https://pypi.org/p/safir | |
| permissions: | |
| id-token: write | |
| if: github.event_name == 'release' && github.event.action == 'published' | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # full history for setuptools_scm | |
| - uses: lsst-sqre/build-and-publish-to-pypi@v2 | |
| with: | |
| python-version: "3.11" |