feat: restore Trivy scanning via Socket-built distribution #128
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: python-tests | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "socket_basics/**/*.py" | |
| - "tests/**/*.py" | |
| - "pyproject.toml" | |
| - "uv.lock" | |
| - "action.yml" | |
| - ".github/workflows/python-tests.yml" | |
| pull_request: | |
| paths: | |
| - "socket_basics/**/*.py" | |
| - "tests/**/*.py" | |
| - "pyproject.toml" | |
| - "uv.lock" | |
| - "action.yml" | |
| - ".github/workflows/python-tests.yml" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: python-tests-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 1 | |
| persist-credentials: false | |
| - name: 🐍 Setup Python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.12" | |
| cache: "pip" | |
| - name: 🛠️ Install deps | |
| # `uv sync --locked` installs exactly the versions in uv.lock, so tests | |
| # run against the locked dependency set (not a fresh pip resolution). | |
| run: | | |
| python -m pip install --upgrade pip uv | |
| uv sync --locked --extra dev | |
| - name: 🔐 Assert uv.lock is in sync with pyproject.toml | |
| # Catches dependency PRs (Dependabot or maintainer) that change | |
| # pyproject.toml without regenerating the lock, or vice versa. | |
| run: uv lock --locked | |
| - name: 🔒 Assert release version metadata is in sync | |
| run: python3 scripts/sync_release_version.py --check | |
| - name: 🧪 Run tests | |
| run: uv run --no-sync pytest -q tests/ |