Repository navigation
146 lines (128 loc) · 7.69 KB
/
Copy pathpython_lint.yml
File metadata and controls
146 lines (128 loc) · 7.69 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
name: Python Lint Check
on:
pull_request:
paths:
- '**.py' # only trigger on python files
permissions:
contents: read
jobs:
lint-changed-files:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
with:
# Required to fetch the base branch for comparison
fetch-depth: 0
# Blob-less fetch; materialize everything except the committed test
# fixtures under admin/test/cases/data, which no step here reads.
sparse-checkout: |
/*
!/admin/test/cases/data
sparse-checkout-cone-mode: false
- name: Get changed Python files
id: changed-files-py
uses: tj-actions/changed-files@v46 # This action finds changed files
with:
files: |
**.py
- name: Set up Python
if: steps.changed-files-py.outputs.any_changed == 'true'
uses: actions/setup-python@v5
with:
python-version: '3.11'
- name: Install Pylint
if: steps.changed-files-py.outputs.any_changed == 'true'
run: python -m pip install pylint
- name: Install dependencies
if: steps.changed-files-py.outputs.any_changed == 'true'
run: python -m pip install -r requirements.txt
- name: Guard against PyPI blackboxprotobuf imports
if: steps.changed-files-py.outputs.any_changed == 'true'
run: python admin/test/scripts/test_no_pypi_blackboxprotobuf.py
# Artifact name/description fields ship to the HTML report and the LAVA manifest
# and get quoted in casework, so they must not assert what the data means in the
# real world. See the script's docstring for the allowlist workflow.
- name: Guard against unsupported claim language
if: steps.changed-files-py.outputs.any_changed == 'true'
run: python admin/scripts/check_claim_language.py
# An artifact's description is the one line the report, the LAVA manifest and
# casework quote for it. One that is missing, runs to several lines, only repeats
# the name, or duplicates a sibling's in the same module says nothing about the
# rows it fronts. Whether a description claims past its own notes is a judgement
# the script cannot make; its --review mode lays the pair out for that pass.
- name: Guard against an artifact description that says nothing
if: steps.changed-files-py.outputs.any_changed == 'true'
run: python admin/scripts/check_artifact_descriptions.py
# A conversation artifact's columns are ordered from the roles it declares in
# data_views: timestamp, other dates, direction, sender, conversation label,
# message text, media, then the rest. See admin/docs/conversation_column_order.md.
- name: Check conversation artifact column order
if: steps.changed-files-py.outputs.any_changed == 'true'
run: python admin/scripts/check_conversation_column_order.py
# os.path.normcase folds case on Windows, so two paths patterns differing only in
# case are one pattern there: the artifact reports one file twice and can leave the
# other file unread entirely. Use a single bracket class. See the script's docstring.
- name: Guard against colliding artifact paths patterns
if: steps.changed-files-py.outputs.any_changed == 'true'
run: python admin/scripts/check_artifact_paths.py
# An artifact reading a directory named for a third party library accepts a file only
# when its container also holds a marker file the application itself writes.
# files_found is built per artifact, so those marker patterns must sit in that
# artifact's own paths; otherwise its marker set is always empty and a guard that
# fails closed reports nothing on exactly the images where the app is installed.
# See the script's docstring.
- name: Guard against container-scoped artifacts with no marker pattern
if: steps.changed-files-py.outputs.any_changed == 'true'
run: python admin/scripts/check_container_markers.py
# html_columns cells are written to the report without html.escape, so evidence
# placed there can inject markup, and any remote href/src makes opening a report
# beacon to a third party. Pre-existing findings are carried in the script's
# BASELINE and do not fail; new ones do. See the script's docstring.
- name: Guard report output against injection and remote destinations
if: steps.changed-files-py.outputs.any_changed == 'true'
run: python admin/scripts/check_html_safety.py
# The seeker stages evidence under <report folder>/data, so every files_found entry
# is an absolute path on the examiner's machine. artifact_processor normalizes only
# the third element of the return tuple; a path put in a data row or handed to
# write_artifact_data_table is published verbatim. The column is never empty and the
# row count is always right, so nothing else catches it. See the script's docstring.
- name: Guard report output against local filesystem paths
if: steps.changed-files-py.outputs.any_changed == 'true'
run: python admin/scripts/check_report_local_paths.py
# The third element of an artifact's return tuple becomes the report's
# "located at" line and the LAVA manifest source_path, so it has to be real
# paths. Prose standing in for one points the examiner at a column that often
# holds a basename, and the location ends up nowhere in the report.
- name: Guard against prose returned as a source path
if: steps.changed-files-py.outputs.any_changed == 'true'
run: python admin/scripts/check_source_path.py
# That same "located at" line and the LAVA manifest already carry the evidence
# location, so an artifact that reads one system-wide file does not also need a
# Source File column repeating the identical path on every row. The column earns
# its place only when the declared paths can match more than one file, which is
# why a per-user or per-app path keeps it: that column is what attributes a row
# to a user or to one of several stores.
- name: Guard against a Source File column that repeats one path
if: steps.changed-files-py.outputs.any_changed == 'true'
run: python admin/scripts/check_source_file_column.py
# scripts/vendor/ holds code copied verbatim from another repository, so it
# drifts in two directions and both are silent: an edit here looks like a fix
# until the next re-vendor reverts it, and an upstream release leaves this copy
# quietly old. The manifest records each copy's hash and upstream commit; this
# checks the hash and fetches the upstream file at that commit. Unconditional
# rather than gated on changed Python files, because the recorded hashes live in
# a .json and a stale record is the same defect.
- name: Check vendored files match what was vendored
run: python admin/scripts/check_vendored.py
# Fails only on warnings this pull request introduces. Long-lived modules carry
# deliberate pre-existing warnings (ileapp.py's wildcard imports, ilapfuncs.py's
# backward-compat re-exports), and failing on those pushed contributors toward
# unrelated refactors or blanket file-level disables. See the script's docstring.
- name: Run on changed files
if: steps.changed-files-py.outputs.any_changed == 'true'
run: |
BASE=$(git merge-base "origin/${{ github.base_ref }}" HEAD)
echo "Comparing against merge base $BASE"
python admin/scripts/lint_changed.py --base-ref "$BASE" \
${{ steps.changed-files-py.outputs.all_changed_files }}