crml/.github/workflows/ci_python_tests.yml at main · Faux16/crml · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
name: CI (Python tests + secrets scan)

on:
  push:
    branches:
      - master

permissions:
  contents: read

jobs:
  trufflehog:
    name: TruffleHog secret scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: TruffleHog
        uses: trufflesecurity/trufflehog@v3.92.4
        with:
          path: .
          base: ${{ github.event.before }}
          head: ${{ github.sha }}
          extra_args: --results=verified,unknown --fail

  web:
    name: Web (lint, typecheck, build, smoke)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install Python dependencies (CRML CLI)
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e "./crml_lang[dev,xlsx]"
          python -m pip install -e "./crml_engine[dev]"

      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Install web dependencies
        working-directory: web
        run: npm install --no-audit --no-fund

      - name: Lint
        working-directory: web
        run: npm run lint

      - name: Typecheck
        working-directory: web
        run: npm run typecheck

      - name: Check legacy /simulation route is not referenced
        working-directory: web
        run: npm run check:no-simulation-route

      - name: Build
        working-directory: web
        run: npm run build

      - name: Start web app
        working-directory: web
        run: |
          npm run start -- --port 3000 &
          echo $! > /tmp/next_pid

      - name: Smoke check endpoints
        run: |
          npx --yes wait-on@7 http://127.0.0.1:3000
          curl -fsS http://127.0.0.1:3000/ > /dev/null

          curl -fsS http://127.0.0.1:3000/api/examples -o /tmp/examples.json
          python - <<'PY'
          import json
          with open('/tmp/examples.json', 'r', encoding='utf-8') as f:
              data = json.load(f)
          assert isinstance(data.get('examples'), list), data
          assert len(data['examples']) > 0, 'Expected examples to be non-empty'
          PY

          cat > /tmp/validate_payload.json <<'JSON'
          {
            "yaml": "crml_scenario: \"1.0\"\nmeta:\n  name: \"ci-smoke\"\nscenario:\n  frequency:\n    basis: per_organization_per_year\n    model: poisson\n    parameters: {lambda: 0.5}\n  severity:\n    model: lognormal\n    parameters: {mu: 10.0, sigma: 1.0}\n"
          }
          JSON

          curl -fsS -X POST http://127.0.0.1:3000/api/validate \
            -H 'Content-Type: application/json' \
            --data @/tmp/validate_payload.json \
            -o /tmp/validate.json
          python - <<'PY'
          import json
          with open('/tmp/validate.json', 'r', encoding='utf-8') as f:
              data = json.load(f)
          assert data.get('valid') is True, data
          PY

      - name: Stop web app
        if: always()
        run: |
          if [ -f /tmp/next_pid ]; then
            kill "$(cat /tmp/next_pid)" || true
          fi

  tests:
    name: Pytest (${{ matrix.name }})
    runs-on: ${{ matrix.runs_on }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: ubuntu-x64
            runs_on: ubuntu-latest
            python_version: "3.11"
            arch: x64
            mode: native

          - name: ubuntu-arm64 (emulated)
            runs_on: ubuntu-latest
            python_version: "3.11"
            arch: arm64
            mode: docker

          - name: windows-x64
            runs_on: windows-latest
            python_version: "3.11"
            arch: x64
            mode: native

          - name: macos-13-x64
            runs_on: macos-13
            python_version: "3.11"
            arch: x64
            mode: native

          - name: macos-14-arm64
            runs_on: macos-14
            python_version: "3.11"
            arch: arm64
            mode: native

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        if: matrix.mode == 'native'
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python_version }}

      - name: Install dependencies
        if: matrix.mode == 'native'
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e "./crml_lang[dev,xlsx]"
          python -m pip install -e "./crml_engine[dev]"

      - name: Run pytest
        if: matrix.mode == 'native'
        run: python -m pytest

      - name: Set up QEMU (Linux ARM64 emulation)
        if: matrix.mode == 'docker'
        uses: docker/setup-qemu-action@v3

      - name: Run pytest in Linux/ARM64 container
        if: matrix.mode == 'docker'
        run: |
          docker run --rm --platform linux/arm64 \
            -v "${{ github.workspace }}:/work" \
            -w /work \
            python:${{ matrix.python_version }} \
            bash -lc "python -m pip install --upgrade pip && python -m pip install -e './crml_lang[dev,xlsx]' && python -m pip install -e './crml_engine[dev]' && python -m pytest"