Repository navigation
ci: one run per push, pinned actions and dev tools, pip cache - #220
Merged
Merged
Conversation
From the code audit. validate.yml ran on every push and on pull_request, so a push to a branch with a PR ran the suite twice: push is now main only. hassfest and the HACS action are pinned to today's commits and requirements-dev.txt to today's versions, which Dependabot already moves monthly; the ruff job reads its pin from requirements-dev.txt, so lint and tests agree. The jobs that install requirements-dev.txt cache pip.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
CI tidy-up from the code audit. The six required checks keep their names; what they run does not change.
validate.ymlran on everypushand onpull_request, so each push to abranch with a PR ran the whole suite twice.
pushis now limited tomain; branches are checked through theirPR, and the merge queue and the weekly run are unchanged. A
ci/pr-Ncopy of a fork's PRno longer starts the suite by itself: it runs from
workflow_dispatch.hassfest@masterandhacs/action@mainare pinned to the commits they point to today, andrequirements-dev.txtuses==(the versions the CI installs today). A new release of an action or a tool canno longer turn the CI red on its own: Dependabot already watches both ecosystems and moves them once a month.
Their own dependencies stay unpinned. Neither action SHA is on a release tag, so the first Dependabot PR for
them is worth a look (it may offer an older tag).
ruff==0.16.10whilerequirements-dev.txtsaid>=0.16.10(so thetest jobs got 0.17.2). The job now reads the version from
requirements-dev.txt.requirements-dev.txt(pytest, the media/browser job, the Docker job).A new
tests/test_ci_pins.pykeeps this in place (no action on a branch, every dev tool pinned, the ruff jobreading
requirements-dev.txt,pushonly onmain); its four tests fail onmain.Not in this PR: the
livemarker stays (no test uses it today, butAGENTS.mdnames it in the safety rules forany test that would touch a real intercom);
pycryptodomekeeps its minimum of 3.19 in the manifest, while thetests run 4.1.0.
Tested on
Windows 11, Python 3.13:
CHECK VERDE: ci/workflow-tidy (f976e38) | ruff pulito | 2422 passed, 28 skipped, 111 deselected | copertura 97.15% (soglia 95%)The workflows themselves run on this PR.
Field test: not needed (CI only).
Docs
Docs: not needed.
Changelog
Changelog: none