Add nightly scheduled GitHub Actions workflow#148
Merged
Conversation
Reviewer's GuideAdds a new nightly GitHub Actions workflow that mirrors the existing tox-based CI jobs (linting, typing, tests across Python 3.10–3.13, coverage, security, and docs) and runs them on a daily schedule at 06:23 UTC, while also allowing manual runs via workflow_dispatch. Sequence diagram for manual dispatch of nightly workflowsequenceDiagram
actor Developer
participant GitHubUI
participant GitHubActions
participant NightlyWorkflow
participant Job_linting
participant Job_mypy
participant Job_unit_tests_matrix
participant Job_coverage
participant Job_security
participant Job_docs
Developer->>GitHubUI: Trigger_nightly_workflow_dispatch
GitHubUI->>GitHubActions: Create_workflow_run_nightly_yml
GitHubActions->>NightlyWorkflow: Start_workflow
NightlyWorkflow->>Job_linting: Start_job
NightlyWorkflow->>Job_mypy: Start_job
NightlyWorkflow->>Job_unit_tests_matrix: Start_job
NightlyWorkflow->>Job_coverage: Start_job
NightlyWorkflow->>Job_security: Start_job
NightlyWorkflow->>Job_docs: Start_job
Job_linting-->>NightlyWorkflow: Status_success_or_failure
Job_mypy-->>NightlyWorkflow: Status_success_or_failure
Job_unit_tests_matrix-->>NightlyWorkflow: Status_success_or_failure
Job_coverage-->>NightlyWorkflow: Status_success_or_failure
Job_security-->>NightlyWorkflow: Status_success_or_failure
Job_docs-->>NightlyWorkflow: Status_success_or_failure
NightlyWorkflow-->>GitHubActions: Aggregate_job_status
GitHubActions-->>Developer: Report_workflow_result
Flow diagram for unit tests matrix job in nightly workflowflowchart TD
Start[unit_tests_job_start] --> Matrix[Expand_matrix_python_versions_3_10_3_11_3_12_3_13]
Matrix --> Checkout[actions_checkout_v6]
Checkout --> SetupPy[actions_setup_python_v6_with_matrix_version]
SetupPy --> AptUpdate[sudo_apt_get_update]
AptUpdate --> InstallRpm[sudo_apt_get_install_rpm]
InstallRpm --> InstallKrb[sudo_apt_get_install_libkrb5_dev]
InstallKrb --> InstallTox[pip_install_tox]
InstallTox --> RunTox[tox_e_pyXY_from_matrix_python_version]
RunTox --> End[unit_tests_job_end]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Collaborator
Author
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue, and left some high level feedback:
- There is a lot of repeated setup (checkout, apt-get, setup-python, tox install) across jobs; consider extracting this into a composite action, YAML anchors, or a reusable workflow so changes only need to be made in one place.
- The unit-tests job installs plain
toxwhile the other jobs pinvirtualenv<20.21.1; if that pin is important for reproducibility, you may want to align the unit-tests job with the others to avoid subtle differences in behavior. - Each job runs
apt-get updateand installs the same OS packages independently; consider consolidating this via a shared base image or caching to reduce runtime and avoid redundant package installation in the nightly workflow.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- There is a lot of repeated setup (checkout, apt-get, setup-python, tox install) across jobs; consider extracting this into a composite action, YAML anchors, or a reusable workflow so changes only need to be made in one place.
- The unit-tests job installs plain `tox` while the other jobs pin `virtualenv<20.21.1`; if that pin is important for reproducibility, you may want to align the unit-tests job with the others to avoid subtle differences in behavior.
- Each job runs `apt-get update` and installs the same OS packages independently; consider consolidating this via a shared base image or caching to reduce runtime and avoid redundant package installation in the nightly workflow.
## Individual Comments
### Comment 1
<location path=".github/workflows/nightly.yml" line_range="104-107" />
<code_context>
+ run: tox -e security
+ - name: Install project
+ run: python -m pip install .
+ - name: Run pip-audit
+ uses: pypa/gh-action-pip-audit@v1.1.0
+ with:
+ inputs: requirements.txt requirements-test.txt
+ docs:
</code_context>
<issue_to_address>
**🚨 suggestion (security):** Using a fixed minor version of the pip-audit action may limit security updates.
Since this is a security tool, consider pinning to the major version (e.g. `pypa/gh-action-pip-audit@v1`) so the workflow automatically picks up patch/minor security and database updates while still avoiding breaking changes from a new major version.
```suggestion
- name: Run pip-audit
uses: pypa/gh-action-pip-audit@v1
with:
inputs: requirements.txt requirements-test.txt
```
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Collaborator
Author
|
NOTE: depends on #147 |
Collaborator
|
@JAVGan could I know why are we running linting test daily ? |
lslebodn
force-pushed
the
add-nightly-workflow
branch
from
6ff9f47 to
c23fe5e
Compare
Collaborator
Collaborator
@lslebodn but for every PR proposed we run mypy, so isn't that will make sure that our code is mypy compatible ? |
Collaborator
yeah but we do not have pinned version of mypy here and new version of any python package (including mypy) can reveal new issues which we needn't notice when there is a long delay between 2 PRs :-) |
Collaborator
Collaborator
Author
|
Ok, I'll adjust it to weekly |
Run the full tox test suite (lint, mypy, unit tests, coverage, security, docs) weekly at 6:23 AM UTC with manual trigger support via workflow_dispatch. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
JAVGan
force-pushed
the
add-nightly-workflow
branch
from
c23fe5e to
caf5313
Compare
Collaborator
Author
lslebodn
reviewed
May 29, 2026
Collaborator
lslebodn
left a comment
lslebodn
left a comment
There was a problem hiding this comment.
Couple of post merge questions :-)
| - name: Install Tox | ||
| run: pip install tox 'virtualenv<20.21.1' | ||
| - name: Install pytest cov | ||
| run: pip install pytest-cov |
Collaborator
There was a problem hiding this comment.
Why do we install it here?
IIUC tox would not use it in venv or did I overlook something?
Collaborator
Author
There was a problem hiding this comment.
I think this was an old workaround for something I can't properly remember. It is there since we opened the repository as opensource: https://github.com/release-engineering/pubtools-marketplacesvm/blame/main/.github/workflows/tox-test.yml#L20
So I feel it was safer to keep it there, but we may test removing it, but I would do that for all workflows, not just this new one.
| run: | | ||
| sudo apt-get -y update | ||
| sudo apt-get install -y rpm | ||
| sudo apt-get install -y libkrb5-dev |
Collaborator
There was a problem hiding this comment.
could we install all dependencies as part of single command?
sudo apt-get install -y rpm libkrb5-dev
it might be a bit faster in CI
Adn similar on other places.
Collaborator
Author
There was a problem hiding this comment.
Yeah, I can file a PR to adjust that, tks!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
nightly.ymlworkflow that runs the full tox test suite weekly on Mondays at 6:23 AM UTCtox-test.yml: linting, mypy, unit tests (Python 3.10-3.13), coverage, security, and docsworkflow_dispatchTest plan
🤖 Generated with Claude Code
Summary by Sourcery
CI: