python.yml

name: Python checks

on:
  push:
    branches:
      - main
      - master
  pull_request:
  schedule:
    - cron: 0 0 * * 1
  workflow_dispatch:

permissions: read-all

jobs:
  pytest:
    name: Pytest testing

    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        python-version:
          - '3.10'
          - '3.11'
          - '3.12'
          - '3.13'
          - '3.14'
        os:
          - ubuntu-latest
          - windows-latest
          - macos-latest
        resolution:
          - highest
          - lowest-direct

    permissions:
      contents: write

    steps:
      - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25
        with:
          disable-sudo: false
          egress-policy: audit

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip

      - uses: install-pinned/uv@dd913dd463d91b016b71467bc12b0d3754cfee61

      - run: uv pip install --system pytest-xvfb
        if: ${{ matrix.os == 'ubuntu-latest' }}

      - run: uv pip install --system --resolution ${{ matrix.resolution }} -e . --group dev

      - id: cache-pytest
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
        with:
          path: .pytest_cache
          key: ${{ matrix.os }}-pytest-${{ matrix.python-version }}-${{ hashFiles('pyproject.toml') }}

      - run: pytest -r A
        env:
          SE_AUTO_UPDATE: true # opt-in to selenium 5 behavior
          # Runner images put a chromedriver on PATH that can lag the installed Chrome ("This version of
          # ChromeDriver only supports Chrome version N"); let Selenium Manager resolve a matching driver instead.
          SE_SKIP_DRIVER_IN_PATH: true
          COVERAGE_FILE: .coverage.${{ matrix.os }}.${{ matrix.python-version }}.${{ matrix.resolution }}

      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
        with:
          name: coverage-${{ matrix.os }}-${{ matrix.python-version }}-${{ matrix.resolution }}
          path: .coverage.${{ matrix.os }}.${{ matrix.python-version }}.${{ matrix.resolution }}
          include-hidden-files: true

  ruff-format:
    name: Ruff formatting

    runs-on: ubuntu-latest

    steps:
      - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            files.pythonhosted.org:443
            github.com:443
            pypi.org:443

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
          python-version: '3.13'
          cache: pip

      - uses: install-pinned/uv@dd913dd463d91b016b71467bc12b0d3754cfee61

      - run: uv pip install --system -e . --group dev

      - id: cache-ruff
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
        with:
          path: .ruff_cache
          key: ${{ runner.os }}-ruff-3.13-${{ hashFiles('pyproject.toml') }}

      - id: run-ruff
        run: ruff format --diff .

  ruff-check:
    name: Ruff linting

    runs-on: ubuntu-latest

    permissions:
      security-events: write

    steps:
      - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            files.pythonhosted.org:443
            github.com:443
            pypi.org:443

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
          python-version: '3.13'
          cache: pip

      - uses: install-pinned/uv@dd913dd463d91b016b71467bc12b0d3754cfee61

      - run: uv pip install --system -e . --group dev

      - id: cache-ruff
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
        with:
          path: .ruff_cache
          key: ${{ runner.os }}-ruff-3.13-${{ hashFiles('pyproject.toml') }}

      - id: run-ruff-sarif
        run: ruff check --output-format=sarif -o results.sarif .

      - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d
        if: ( success() || failure() ) && contains('["success", "failure"]', steps.run-ruff-sarif.outcome)
        with:
          sarif_file: results.sarif

      - id: run-ruff
        if: failure() && contains('["failure"]', steps.run-ruff-sarif.outcome)
        run: ruff check --output-format=github .

  mypy:
    name: Mypy type checking

    runs-on: ubuntu-latest

    steps:
      - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            files.pythonhosted.org:443
            github.com:443
            pypi.org:443

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
          python-version: '3.13'
          cache: pip

      - uses: install-pinned/uv@dd913dd463d91b016b71467bc12b0d3754cfee61

      - run: uv pip install --system -e . --group dev

      - id: cache-mypy
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
        with:
          path: .mypy_cache
          key: ${{ runner.os }}-mypy-3.13-${{ hashFiles('pyproject.toml') }}

      - id: run-mypy
        run: mypy .

  bandit:
    name: Bandit security

    runs-on: ubuntu-latest

    permissions:
      security-events: write

    steps:
      - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            files.pythonhosted.org:443
            github.com:443
            pypi.org:443

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
          python-version: '3.13'
          cache: pip

      - uses: install-pinned/uv@dd913dd463d91b016b71467bc12b0d3754cfee61

      - run: uv pip install --system -e . --group dev

      - id: run-bandit-sarif
        run: |
          bandit --confidence-level 'medium' --format 'sarif' --output 'results.sarif' --recursive 'requestium'

      - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d
        if: ( success() || failure() ) && contains('["success", "failure"]', steps.run-bandit-sarif.outcome)
        with:
          sarif_file: results.sarif

      - id: run-bandit
        if: failure() && contains('["failure"]', steps.run-bandit-sarif.outcome)
        run: bandit --confidence-level 'medium' --recursive 'requestium'

  coverage:
    runs-on: ubuntu-latest
    needs: pytest
    permissions:
      pull-requests: write
      contents: write
    steps:
      - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            github.com:443
            img.shields.io:443

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
        with:
          pattern: coverage-*
          merge-multiple: true

      - name: Coverage comment
        id: coverage_comment
        uses: py-cov-action/python-coverage-comment-action@5d8df5979747514c914e1c5a12335a7cf9a2745f
        with:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          MERGE_COVERAGE_FILES: true

      - name: Store Pull Request comment to be posted
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
        if: steps.coverage_comment.outputs.COMMENT_FILE_WRITTEN == 'true'
        with:
          name: python-coverage-comment-action
          path: python-coverage-comment-action.txt

  pre-commit:
    runs-on: ubuntu-latest
    needs:
      - ruff-format
      - ruff-check
      - bandit
    permissions:
      contents: write

    steps:
      - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            files.pythonhosted.org:443
            github.com:443
            proxy.golang.org:443
            pypi.org:443

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
          python-version: '3.13'
          cache: pip

      - uses: install-pinned/uv@dd913dd463d91b016b71467bc12b0d3754cfee61

      - run: uv pip install --system -e . --group dev

      - id: cache-pre-commit
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
        with:
          path: .pre-commit-cache
          key: ${{ runner.os }}-pre-commit-3.13-${{ hashFiles('.pre-commit-config.yaml') }}

      - name: Run pre-commit on all files
        run: |
          pre-commit install
          pre-commit run --all-files
        env:
          PRE_COMMIT_HOME: .pre-commit-cache