AIPass
1deb786c8a
security(ci): least-privilege token on e2e-wheel workflow + W24 changelog (also carries playbook commit 6b89fcd)
56 lines
1.7 KiB
YAML
56 lines
1.7 KiB
YAML
name: e2e-wheel
|
|
|
|
# Cross-OS end-to-end WIRING test (FPLAN-0239, P1 of DPLAN-0194).
|
|
# Builds the wheel, installs it into a clean venv (handled by the pytest
|
|
# fixtures in tests/e2e/conftest.py), and runs the 4-tier wiring ladder.
|
|
#
|
|
# RED-FIRST: Windows is EXPECTED to fail in known places (symlink init,
|
|
# bin-vs-Scripts, /tmp). Do not "fix" Windows here — the red is the deliverable.
|
|
|
|
on:
|
|
push:
|
|
branches: [main, dev]
|
|
paths:
|
|
- "tests/e2e/**"
|
|
- ".github/workflows/e2e-wheel.yml"
|
|
- "pyproject.toml"
|
|
- "src/**"
|
|
pull_request:
|
|
paths:
|
|
- "tests/e2e/**"
|
|
- ".github/workflows/e2e-wheel.yml"
|
|
- "pyproject.toml"
|
|
- "src/**"
|
|
workflow_dispatch:
|
|
|
|
# Least-privilege token (Scorecard Token-Permissions). This workflow only
|
|
# reads the repo to build + smoke-test the wheel; it needs no write scopes.
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
e2e-wheel:
|
|
name: e2e-wheel (${{ matrix.os }})
|
|
runs-on: ${{ matrix.os }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os: [ubuntu-latest, windows-latest, macos-latest]
|
|
python-version: ["3.12"]
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
|
|
- name: Set up Python ${{ matrix.python-version }}
|
|
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
|
|
with:
|
|
python-version: ${{ matrix.python-version }}
|
|
|
|
- name: Install build tooling
|
|
run: python -m pip install --upgrade pip build pytest
|
|
|
|
- name: Run cross-OS e2e wiring harness
|
|
# conftest.py builds the wheel + clean venv internally; the outer env
|
|
# only needs build + pytest.
|
|
run: python -m pytest tests/e2e -v
|