Skip to content

chore(deps): bump the hooks group with 2 updates #189

chore(deps): bump the hooks group with 2 updates

chore(deps): bump the hooks group with 2 updates #189

Workflow file for this run

name: CI and Publish to PyPI
on:
push:
branches: [main]
paths-ignore:
- "*.md"
- "docs/**"
- "LICENSE"
- ".gitignore"
pull_request:
paths-ignore:
- "*.md"
- "docs/**"
- "LICENSE"
- ".gitignore"
release:
types: [created]
workflow_dispatch:
inputs:
run_publish:
description: 'Set to true to run the publish job'
required: false
default: 'false'
permissions: {}
jobs:
lint:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true
cache-dependency-glob: "pyproject.toml"
- run: uv python install 3.13
# Not a lint step: `--frozen` fails if uv.lock has drifted from pyproject.
- run: uv sync --all-extras --dev --frozen
# Run the hooks themselves instead of re-invoking ruff and ty, so the revs
# in .pre-commit-config.yaml are the single source of truth for which tool
# versions run. A version named here too would be a copy Dependabot cannot
# see, and it would silently drift from the hook on the next bump.
- run: uvx prek run --all-files --show-diff-on-failure
test:
runs-on: ubuntu-latest
permissions:
contents: read
strategy:
matrix:
python-version: ["3.12", "3.13"]
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true
cache-dependency-glob: "pyproject.toml"
- run: uv python install ${{ matrix.python-version }}
- run: uv sync --all-extras --dev --frozen
- run: uv run pytest --cov=agentic_data_contracts --cov-report=term-missing
test-pydantic-ai-latest:
# Early-warning job. pyproject allows pydantic-ai-slim >=2.0 (unbounded), and
# Pydantic AI's version policy only guarantees ~3 months between breaking majors.
# The `test` job above runs against the locked v2.0; this runs the adapter suite
# against the newest release allowed by the floor (the next 2.x, and the next
# major once it ships) so an upstream break surfaces here rather than in a user's
# install. Intentionally NOT a release gate (omitted from publish.needs).
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true
cache-dependency-glob: "pyproject.toml"
- run: uv python install 3.13
# --isolated forces a fresh resolve (ignoring the locked v2.0); --with pins
# only the floor, so uv resolves the newest compatible release. Only the
# extras the adapter suite needs are installed.
- run: >-
uv run --isolated --python 3.13
--with 'pydantic-ai-slim[anthropic]>=2.0'
--extra pydantic-ai --extra duckdb --extra dev
pytest tests/test_tools/test_pydantic_ai.py -v
security:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
- run: uvx uv-secure uv.lock
publish:
needs: [lint, test, security]
if: github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.run_publish == 'true')
runs-on: ubuntu-latest
permissions:
id-token: write
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true
- run: uv python install 3.13
- run: uv build --no-sources
- uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0