Fix Semgrep CI: replace pipx with pip, bump to 1.113.0 #79
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI (build & import) | |
| on: | |
| push: | |
| branches: [ "main" ] | |
| pull_request: | |
| branches: [ "main" ] | |
| workflow_dispatch: {} | |
| permissions: | |
| contents: read | |
| jobs: | |
| build-smoke: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden runner | |
| uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout | |
| uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5 | |
| - name: Set up Python | |
| uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6 | |
| with: | |
| python-version: "3.12" | |
| # Build/test tools from HASHED lock (no raw pip installs) | |
| - name: Install build tools (hashed) | |
| run: | | |
| python -m pip install --require-hashes -r .github/requirements-build.lock | |
| - name: Clean dist | |
| run: rm -rf dist/* || true | |
| - name: Build wheel | |
| run: pyproject-build -o dist | |
| - name: Inspect wheel contents (show first 40 entries) | |
| run: | | |
| python - <<'PY' | |
| import glob, zipfile | |
| whl = glob.glob("dist/*.whl")[0] | |
| print("Wheel:", whl) | |
| with zipfile.ZipFile(whl) as z: | |
| names = z.namelist() | |
| pkg = [n for n in names if n.startswith("decision_security/")] | |
| print("Files in package:", len(pkg)) | |
| print("\n".join(pkg[:40])) | |
| assert pkg, "Wheel missing decision_security/*" | |
| assert any(n.endswith(".dist-info/METADATA") for n in names), "Wheel missing .dist-info/METADATA" | |
| PY | |
| # Install runtime deps from HASHED lock, then install the local wheel WITH its hash | |
| - name: Install runtime deps (hashed) + local wheel (hashed) | |
| run: | | |
| python -m pip install --require-hashes -r requirements-runtime.lock | |
| WHEEL=$(ls dist/*.whl) | |
| HASH=$(python - <<'PY' | |
| import glob, hashlib | |
| p = glob.glob("dist/*.whl")[0] | |
| print(hashlib.sha256(open(p,"rb").read()).hexdigest()) | |
| PY | |
| ) | |
| printf "%s --hash=sha256:%s\n" "$WHEEL" "$HASH" > wheel.requirements.txt | |
| python -m pip install --require-hashes --no-deps -r wheel.requirements.txt | |
| # Minimal fuzzer (fails CI on real invariant failures). Add 'continue-on-error: true' if you want advisory-only. | |
| - name: Minimal fuzzer (60s) | |
| run: python tools/fuzz_synth.py --iterations 600 --timeout-sec 60 --seed 123 | |
| # Run pytest only if tests exist; tools already installed from build lock | |
| - name: Run tests (pytest if present) | |
| if: ${{ hashFiles('tests/test_*.py', 'tests/**/test_*.py', 'tests/*_test.py', 'tests/**/*_test.py') != '' }} | |
| run: | | |
| set +e | |
| python -m pytest -q | |
| code=$? | |
| if [ "$code" = "5" ]; then | |
| echo "Pytest: no tests collected. Skipping." | |
| exit 0 | |
| fi | |
| exit "$code" |