Skip to content

Harden Pages deployment #50

Harden Pages deployment

Harden Pages deployment #50

Workflow file for this run

name: CI
on:
push:
branches: [main]
pull_request:
permissions:
contents: read
jobs:
python:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: actions/setup-python@v7
with:
python-version: "3.12"
cache: pip
- run: python -m pip install -e ".[dev]"
- run: python -m pytest
- name: Build wheel
run: |
python -m pip install build
python -m build
- name: Check packages
run: |
wheel=$(find dist -name '*.whl' -print -quit)
sdist=$(find dist -name '*.tar.gz' -print -quit)
python - "$wheel" <<'PY'
import re
import sys
from zipfile import ZipFile
with ZipFile(sys.argv[1]) as archive:
files = set(archive.namelist())
index = "pqviewer/static/index.html"
assert index in files, f"missing {index}"
html = archive.read(index).decode()
for asset in re.findall(r'(?:src|href)="(/assets/[^"?]+)', html):
bundled = f"pqviewer/static{asset}"
assert bundled in files, f"missing {bundled}"
if asset.endswith(".css"):
css = archive.read(bundled).decode()
for nested in re.findall(r"url\((/assets/[^)]+)\)", css):
nested_file = f"pqviewer/static{nested}"
assert nested_file in files, f"missing {nested_file}"
PY
tar -tzf "$sdist" | grep -q '/docs/conf.py$'
python -m venv /tmp/pqviewer-smoke
/tmp/pqviewer-smoke/bin/pip install "$wheel"
cd /tmp
/tmp/pqviewer-smoke/bin/pqviewer --help
/tmp/pqviewer-smoke/bin/pqviewer render --help
/tmp/pqviewer-smoke/bin/pqviewer-render --help
docs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: actions/setup-python@v7
with:
python-version: "3.12"
cache: pip
- run: python -m pip install -e ".[docs]"
- run: python -m sphinx -W --keep-going -b html docs docs/_build/html
frontend:
runs-on: ubuntu-latest
defaults:
run:
working-directory: frontend
steps:
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
with:
node-version: "24"
cache: npm
cache-dependency-path: frontend/package-lock.json
- run: npm ci
- run: npm run build
- name: Run frontend tests when available
run: npm run test --if-present
- name: Verify bundled frontend
working-directory: .
run: git diff --exit-code -- pqviewer/static
browser:
runs-on: ubuntu-24.04
timeout-minutes: 30
steps:
- uses: actions/checkout@v7
- uses: actions/setup-python@v7
with:
python-version: "3.12"
cache: pip
- run: python -m pip install -e ".[dev,render]"
- uses: actions/setup-node@v7
with:
node-version: "24"
cache: npm
cache-dependency-path: frontend/package-lock.json
- working-directory: frontend
run: npm ci
- working-directory: frontend
run: npx playwright install --with-deps chromium
- run: python -m playwright install chromium
- working-directory: frontend
run: npm run test:e2e
- name: Smoke-test headless rendering
env:
PQVIEWER_HEADLESS_TEST: "1"
run: python -m pytest tests/test_recipe.py -k headless_render_command
- name: Upload browser artifacts
if: failure()
uses: actions/upload-artifact@v4
with:
name: browser-artifacts
path: output/playwright
if-no-files-found: ignore