chore: gitignore all of reports/, and move the examples out of it #271
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI pipeline | |
| on: | |
| push: | |
| branches: | |
| - '**' | |
| tags-ignore: | |
| - 'v*' # this tag type is used for release pipelines | |
| paths-ignore: | |
| - 'README.md' | |
| - 'CLAUDE.md' | |
| - 'assets/**' | |
| - 'specs/**' # includes specs/CHANGELOG.md | |
| # Manual trigger for re-running CI without a new commit (e.g. after a transient | |
| # GitHub Actions hiccup that silently drops a push event): | |
| # gh workflow run "CI pipeline" --ref <branch> | |
| workflow_dispatch: | |
| # Don't let two pushes on the same branch race each other through the deploy step. | |
| concurrency: | |
| group: deploy-${{ github.ref }} | |
| cancel-in-progress: false | |
| # `DATABRICKS_CLIENT_SECRET` is deliberately NOT here: a workflow-level env var is visible | |
| # to every step, including dependency installation, where third-party action and package | |
| # code executes. It is injected per-step, only on the three steps that talk to Databricks. | |
| # (The host and client ID are identifiers, not credentials — leaking them grants nothing.) | |
| env: | |
| DATABRICKS_HOST: ${{ secrets.DATABRICKS_HOST }} | |
| DATABRICKS_CLIENT_ID: ${{ secrets.DATABRICKS_CLIENT_ID }} | |
| TEMPLATE_ALERT_EMAILS: ${{ secrets.TEMPLATE_ALERT_EMAILS }} | |
| jobs: | |
| ci: | |
| runs-on: ubuntu-latest | |
| steps: | |
| # Third-party actions are pinned to a full commit SHA, not a tag: tags are mutable, | |
| # so whoever controls the action's repo can repoint one at new code that runs on this | |
| # runner. The trailing comment records which release the SHA corresponds to. | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: '3.12' | |
| - name: Install uv | |
| # setup-uv stopped publishing moving major tags (v1..v7) after v7, so `@v9` does | |
| # not resolve — the comment records the exact release this SHA belongs to. | |
| uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 | |
| with: | |
| version: "0.11.31" | |
| enable-cache: true | |
| cache-dependency-glob: "uv.lock" | |
| # Fail if a PR edited pyproject.toml without re-running `uv lock`. `make sync` | |
| # would silently re-resolve and discard the update in CI's throwaway checkout, | |
| # leaving the committed uv.lock stale. This read-only check keeps them in sync. | |
| - name: Verify lockfile is current | |
| run: uv lock --check | |
| - name: Install dependencies | |
| run: make sync | |
| - name: Unit tests | |
| run: make unit-test | |
| - name: Upload coverage report | |
| if: always() | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: coverage-report | |
| path: reports/coverage/ | |
| retention-days: 14 | |
| # Pinned so an upstream change can't silently break CI; comment records the release. | |
| - name: Install Databricks CLI | |
| uses: databricks/setup-cli@8b7b124dc4f5b9621e959ea61cf4d3dd4e421f67 # v1.9.0 | |
| - name: Deploy on staging | |
| env: | |
| DATABRICKS_CLIENT_SECRET: ${{ secrets.DATABRICKS_CLIENT_SECRET }} | |
| run: make deploy env=staging | |
| - name: Run integration tests on staging | |
| env: | |
| DATABRICKS_CLIENT_SECRET: ${{ secrets.DATABRICKS_CLIENT_SECRET }} | |
| run: make run env=staging | |
| - name: Deploy on prod | |
| if: github.ref == 'refs/heads/main' | |
| env: | |
| DATABRICKS_CLIENT_SECRET: ${{ secrets.DATABRICKS_CLIENT_SECRET }} | |
| run: make deploy env=prod |