python-erc7730/.github/workflows/ci.yml at main · sourcifyeth/python-erc7730 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
name: 🔎 continuous integration

"on":
  push:
    branches:
      - main
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ──────────────────────────────────────────────────────────────────
  # Lint & Test — runs for EVERY PR (including forks)
  # Uses GitHub-hosted runners so untrusted code never touches infra.
  # Minimal permissions: read-only token, no secrets.
  # ──────────────────────────────────────────────────────────────────
  ci:
    name: continuous integration
    runs-on: ubuntu-latest
    timeout-minutes: 60
    permissions:
      contents: read
    steps:
      - name: Checkout
        timeout-minutes: 10
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Checkout test registries
        timeout-minutes: 10
        run: >-
          git submodule update --init --checkout
          tests/registries/clear-signing-erc7730-registry
          tests/registries/ledger-asset-dapps

      - name: Setup mise
        timeout-minutes: 10
        uses: jdx/mise-action@v4.3.0

      - name: Install dependencies
        timeout-minutes: 10
        run: pdm install --dev --check --frozen-lockfile

      - name: Get API keys
        timeout-minutes: 10
        if: github.event.pull_request.head.repo.full_name == github.repository || github.event_name == 'push'
        shell: bash
        run: |
          cat << EOF | jq -r 'to_entries[] | select(.key|endswith("_API_KEY")) | "\(.key)=\(.value)"' >> "$GITHUB_ENV"
          ${{ toJSON(secrets) }}
          EOF

      - name: Lint
        timeout-minutes: 10
        run: pdm run lint

      - name: Test
        timeout-minutes: 40
        env:
          HAS_INTEGRATION_LABEL: >-
            ${{ contains(github.event.pull_request.labels.*.name, 'integration')
            || contains(github.event.pull_request.labels.*.name, 'submodules') }}
        run: |
          ARGS=""
          if [ "$HAS_INTEGRATION_LABEL" = "true" ]; then
            ARGS="--run-integration"
          fi
          pdm run test $ARGS

      - name: Upload test results
        timeout-minutes: 10
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@v7
        with:
          name: test-results
          path: tests/.tests.xml
          include-hidden-files: true

      - name: Build docs
        timeout-minutes: 10
        if: ${{ !cancelled() }}
        run: pdm run docs

      - name: Upload docs artifact
        timeout-minutes: 10
        if: ${{ !cancelled() && github.event_name == 'push' && github.ref == 'refs/heads/main' }}
        uses: actions/upload-artifact@v7
        with:
          name: docs-build
          path: "./docs/build"

  # ──────────────────────────────────────────────────────────────────
  # Deploy docs — only on push to main
  # ──────────────────────────────────────────────────────────────────
  deploy-docs:
    name: deploy docs
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    needs: ci
    runs-on: ubuntu-latest
    timeout-minutes: 40
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    permissions:
      pages: write
      id-token: write
    steps:
      - name: Download docs artifact
        timeout-minutes: 10
        uses: actions/download-artifact@v8
        with:
          name: docs-build
          path: "./docs/build"

      - name: Setup Github Pages
        timeout-minutes: 10
        uses: actions/configure-pages@v6

      - name: Upload docs to Github Pages
        timeout-minutes: 10
        uses: actions/upload-pages-artifact@v5
        with:
          path: "./docs/build"

      - name: Deploy GitHub Pages
        id: deployment
        timeout-minutes: 30
        uses: actions/deploy-pages@v5
        with:
          # Pages runner backlog can spend several minutes in the queue before
          # the build starts; give the deployment more room than the 10min default.
          timeout: 1500000