Add a workflow to publish images to ACR #18
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| - uses: astral-sh/setup-uv@v10.0.1 | |
| with: | |
| enable-cache: true | |
| # --frozen fails when pyproject.toml and uv.lock disagree, so a dependency | |
| # change that skipped the lock cannot merge. | |
| - name: Install dependencies | |
| run: uv sync --extra dev --frozen | |
| - name: Ruff | |
| run: uv run ruff check openops_mcp tests | |
| requirements: | |
| # requirements.txt is generated, and two things read it: Snyk, which only scans | |
| # that format, and the App image, which pip-installs it. Regenerating here proves | |
| # it still matches the lockfile rather than trusting whoever last changed a | |
| # dependency to have remembered. | |
| name: Requirements Export | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| - uses: astral-sh/setup-uv@v10.0.1 | |
| with: | |
| enable-cache: true | |
| # The same command that generated the committed file, so the header uv writes | |
| # into it matches and only a real dependency change shows up. | |
| - name: Re-export and compare | |
| run: | | |
| uv export --format requirements-txt --no-dev --no-emit-project --frozen \ | |
| -o requirements.txt | |
| git diff --exit-code -- requirements.txt | |
| types: | |
| name: Types | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| - uses: astral-sh/setup-uv@v10.0.1 | |
| with: | |
| enable-cache: true | |
| - name: Install dependencies | |
| run: uv sync --extra dev --frozen | |
| - name: Mypy | |
| run: uv run mypy openops_mcp | |
| test: | |
| # The floor and the ceiling of requires-python. The floor is the one that | |
| # breaks, since development happens on a newer interpreter. | |
| name: Test (Python ${{ matrix.python-version }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ['3.10', '3.13'] | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| - uses: astral-sh/setup-uv@v10.0.1 | |
| with: | |
| enable-cache: true | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install dependencies | |
| run: uv sync --extra dev --frozen | |
| - name: Pytest | |
| run: uv run pytest -q | |
| image: | |
| # Build-only, so a Dockerfile that no longer builds on either architecture cannot | |
| # merge, rather than failing at publish time. Skipped on pushes to main: there the | |
| # Publish workflow builds the same image for real, and running both would waste two | |
| # builds and race it for the shared cache scopes. | |
| name: Image (${{ matrix.platform }}) | |
| if: github.event_name != 'push' | |
| runs-on: ${{ matrix.platform == 'amd64' && 'ubuntu-latest' || 'ubuntu-arm64' }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| platform: [amd64, arm64] | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4.3.0 | |
| - name: Build image | |
| uses: docker/build-push-action@v7.3.0 | |
| with: | |
| context: . | |
| file: ./Dockerfile | |
| platforms: linux/${{ matrix.platform }} | |
| build-args: VERSION=${{ github.sha }} | |
| push: false | |
| provenance: false | |
| cache-from: type=gha,scope=${{ matrix.platform }} | |
| cache-to: type=gha,mode=max,scope=${{ matrix.platform }} |