docs: record private remote validation #8

Workflow file for this run

	name: CI

	on:
	pull_request:
	push:
	branches:
	- main
	schedule:
	- cron: "23 4 * * 1"

	permissions:
	contents: read

	concurrency:
	group: ci-${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	env:
	UV_VERSION: 0.11.8

	jobs:
	quality:
	name: Offline quality and workflow checks
	runs-on: ubuntu-latest
	timeout-minutes: 20
	steps:
	- name: Check out the candidate
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	- name: Set up Python
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
	with:
	python-version: "3.14"
	- name: Install the pinned uv frontend
	run: python -m pip install --disable-pip-version-check "uv==$UV_VERSION"
	- name: Check lock consistency
	run: uv lock --check
	- name: Reproduce the locked environment
	run: uv sync --locked
	- name: Lint
	run: uv run ruff check src tests scripts
	- name: Check formatting
	run: uv run ruff format --check src tests scripts
	- name: Type check
	run: uv run pyright
	- name: Run offline unit and contract tests
	run: uv run pytest -m "not live"
	- name: Check release version agreement
	run: uv run python scripts/check_version.py --expected 0.1.0a1 --require-changelog
	- name: Check canonical public content and identity
	run: uv run python scripts/check_version.py --require-public-preview-docs
	- name: Scan for credentials and scope mistakes
	run: uv run python scripts/check_secrets.py
	- name: Validate workflow syntax with checksum-pinned actionlint
	run: uv run python scripts/run_actionlint.py
	- name: Verify release-workflow trust semantics
	run: uv run python scripts/check_workflows.py

	locked-runtime:
	name: Locked dependencies / Python ${{ matrix.python-version }}
	runs-on: ubuntu-latest
	timeout-minutes: 20
	strategy:
	fail-fast: false
	matrix:
	python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
	steps:
	- name: Check out the candidate
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	- name: Set up Python
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
	with:
	python-version: ${{ matrix.python-version }}
	- name: Install the pinned uv frontend
	run: python -m pip install --disable-pip-version-check "uv==$UV_VERSION"
	- name: Reproduce the locked environment
	run: uv sync --locked
	- name: Run offline tests
	run: uv run pytest -m "not live"

	minimum-openai:
	name: Minimum OpenAI / Python 3.10
	runs-on: ubuntu-latest
	timeout-minutes: 20
	steps:
	- name: Check out the candidate
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	- name: Set up Python
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
	with:
	python-version: "3.10"
	- name: Install the pinned uv frontend
	run: python -m pip install --disable-pip-version-check "uv==$UV_VERSION"
	- name: Create the development environment
	run: uv sync --locked
	- name: Select the minimum supported OpenAI dependency
	run: uv pip install --python .venv/bin/python "openai==2.45.0"
	- name: Run offline tests without resyncing the lock
	run: uv run --no-sync pytest -m "not live"

	latest-openai:
	name: Latest OpenAI within major canary
	if: github.event_name == 'schedule' \|\| github.actor == 'dependabot[bot]'
	runs-on: ubuntu-latest
	timeout-minutes: 20
	steps:
	- name: Check out the candidate
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	- name: Set up Python
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
	with:
	python-version: "3.14"
	- name: Install the pinned uv frontend
	run: python -m pip install --disable-pip-version-check "uv==$UV_VERSION"
	- name: Create the development environment
	run: uv sync --locked
	- name: Select latest OpenAI within the supported major
	run: uv pip install --python .venv/bin/python --upgrade "openai>=2.45.0,<3.0.0"
	- name: Run canary tests without resyncing the lock
	run: uv run --no-sync pytest -m "not live"

	package:
	name: Build, inspect, and clean-install exact artifacts
	needs: [quality, locked-runtime, minimum-openai]
	runs-on: ubuntu-latest
	timeout-minutes: 25
	steps:
	- name: Check out the candidate
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	- name: Set up Python
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
	with:
	python-version: "3.14"
	- name: Install the pinned uv frontend
	run: python -m pip install --disable-pip-version-check "uv==$UV_VERSION"
	- name: Reproduce the locked environment
	run: uv sync --locked
	- name: Build wheel and source distribution
	run: uv build
	- name: Check package metadata rendering
	run: uv run twine check dist/*
	- name: Inspect artifact identity and shape
	run: uv run python scripts/check_artifacts.py dist/*
	- name: Install and smoke-test each exact artifact
	run: uv run python scripts/check_clean_install.py dist/*
	- name: Record immutable artifact digests
	run: sha256sum dist/* > artifact-sha256.txt
	- name: Retain verified artifacts
	uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
	with:
	name: python-distributions
	path: \|
	dist/*
	artifact-sha256.txt
	if-no-files-found: error
	retention-days: 7

	standalone:
	name: Standalone copied-checkout verification
	needs: package
	runs-on: ubuntu-latest
	timeout-minutes: 35
	steps:
	- name: Check out the candidate
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	- name: Set up Python
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
	with:
	python-version: "3.14"
	- name: Install the pinned uv frontend
	run: python -m pip install --disable-pip-version-check "uv==$UV_VERSION"
	- name: Verify from a copied standalone repository
	run: python scripts/check_repository_independence.py

Navigation Menu

Uh oh!

docs: record private remote validation #8

Workflow file

docs: record private remote validation #8

Uh oh!

Workflow file for this run