Harden v0.1.0 release readiness #37

Workflow file for this run

	name: CI

	on:
	push:
	branches:
	- main
	pull_request:
	branches:
	- main
	workflow_dispatch:

	permissions:
	contents: read

	concurrency:
	group: ci-${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	quality:
	name: Tests and lint (Python 3.12)
	runs-on: ubuntu-latest
	timeout-minutes: 30

	steps:
	- name: Checkout repository
	uses: actions/checkout@v6

	- name: Set up Python
	uses: actions/setup-python@v6
	with:
	python-version: "3.12"
	cache: pip
	cache-dependency-path: \|
	requirements.txt
	requirements-dev.txt

	- name: Upgrade packaging tools
	run: \|
	python -m pip install \
	--upgrade \
	pip \
	setuptools \
	wheel

	- name: Install development dependencies
	run: python -m pip install -r requirements-dev.txt

	- name: Install project package
	run: python -m pip install --no-deps -e .

	- name: Verify dependency compatibility
	run: python -m pip check

	- name: Run Ruff
	run: python -m ruff check src tests scripts

	- name: Run unit tests
	run: python -m pytest -q

	package:
	name: Package preflight
	runs-on: ubuntu-latest
	timeout-minutes: 30
	needs: quality

	steps:
	- name: Checkout repository
	uses: actions/checkout@v6

	- name: Set up Python
	uses: actions/setup-python@v6
	with:
	python-version: "3.12"
	cache: pip
	cache-dependency-path: pyproject.toml

	- name: Install package tooling
	run: \|
	python -m pip install --upgrade pip
	python -m pip install \
	"build>=1.2,<2.0" \
	"twine>=6.0,<7.0"

	- name: Verify source release contract
	run: \|
	python scripts/verify_release_artifacts.py

	- name: Build distributions
	run: python -m build

	- name: Validate distributions with Twine
	run: python -m twine check dist/*

	- name: Inspect package distributions
	run: \|
	python scripts/verify_release_artifacts.py \
	--dist-dir dist

	- name: Install and verify built wheel
	shell: bash
	run: \|
	set -euo pipefail

	package_version="$(
	python -c '
	import tomllib
	from pathlib import Path

	metadata = tomllib.loads(
	Path("pyproject.toml").read_text(
	encoding="utf-8"
	)
	)

	print(metadata["project"]["version"])
	'
	)"

	python -m venv .package-venv

	.package-venv/bin/python -m pip install \
	--no-deps \
	dist/*.whl

	PACKAGE_VERSION="${package_version}" \
	.package-venv/bin/python - <<'PY'
	import os

	import edge_traffic_vision

	expected = os.environ["PACKAGE_VERSION"]
	actual = edge_traffic_vision.__version__

	if actual != expected:
	raise SystemExit(
	f"Installed version {actual} "
	f"does not match {expected}"
	)

	print(
	"Installed package version verified: "
	f"{actual}"
	)
	PY

	docker:
	name: Docker build and smoke check
	runs-on: ubuntu-latest
	timeout-minutes: 60
	needs: quality

	steps:
	- name: Checkout repository
	uses: actions/checkout@v6

	- name: Build CPU Docker image
	run: \|
	docker build \
	--progress=plain \
	--tag edge-traffic-vision:ci \
	.

	- name: Verify container entry point
	run: docker run --rm edge-traffic-vision:ci --help

	- name: Verify runtime imports
	run: \|
	docker run --rm \
	--entrypoint python \
	edge-traffic-vision:ci \
	-c "import cv2, numpy, onnxruntime, torch, ultralytics; print('runtime imports: PASS')"

	- name: Verify non-root user and writable output directory
	run: \|
	docker run --rm \
	--entrypoint sh \
	edge-traffic-vision:ci \
	-c '
	set -eu
	test "$(id -u)" -ne 0
	test -d /app/input
	test -d /app/models/onnx
	test -d /app/reports/video_inference
	test -d /app/reports/metrics/video_inference
	touch /app/reports/video_inference/.write-test
	rm /app/reports/video_inference/.write-test
	'

	- name: Inspect image metadata
	run: \|
	docker image inspect \
	edge-traffic-vision:ci \
	--format 'Size={{.Size}} User={{.Config.User}} Entrypoint={{json .Config.Entrypoint}}'

Navigation Menu

Harden v0.1.0 release readiness #37

Workflow file

Harden v0.1.0 release readiness #37

Uh oh!

Workflow file for this run