Update version number to v2026.4.1-dev #146
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Python Lint Check | |
| on: | |
| pull_request: | |
| paths: | |
| - '**.py' # only trigger on python files | |
| permissions: | |
| contents: read | |
| jobs: | |
| lint-changed-files: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| # Required to fetch the base branch for comparison | |
| fetch-depth: 0 | |
| - name: Get changed Python files | |
| id: changed-files-py | |
| uses: tj-actions/changed-files@v46 # This action finds changed files | |
| with: | |
| files: | | |
| **.py | |
| - name: Set up Python | |
| if: steps.changed-files-py.outputs.any_changed == 'true' | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.11' | |
| - name: Install Pylint | |
| if: steps.changed-files-py.outputs.any_changed == 'true' | |
| run: python -m pip install pylint | |
| - name: Install dependencies | |
| if: steps.changed-files-py.outputs.any_changed == 'true' | |
| run: python -m pip install -r requirements.txt | |
| # Artifact name/description fields ship to the HTML report and the LAVA manifest | |
| # and get quoted in casework, so they must not assert what the data means in the | |
| # real world. See the script's docstring for the allowlist workflow. | |
| - name: Guard against unsupported claim language | |
| if: steps.changed-files-py.outputs.any_changed == 'true' | |
| run: python admin/scripts/check_claim_language.py | |
| # An artifact's description is the one line the report, the LAVA manifest and | |
| # casework quote for it. One that is missing, runs to several lines, only repeats | |
| # the name, or duplicates a sibling's in the same module says nothing about the | |
| # rows it fronts. Whether a description claims past its own notes is a judgement | |
| # the script cannot make; its --review mode lays the pair out for that pass. | |
| - name: Guard against an artifact description that says nothing | |
| if: steps.changed-files-py.outputs.any_changed == 'true' | |
| run: python admin/scripts/check_artifact_descriptions.py | |
| # html_columns cells are written to the report without html.escape, so evidence | |
| # placed there can inject markup, and any remote href/src makes opening a report | |
| # beacon to a third party. Pre-existing findings are carried in the script's | |
| # BASELINE and do not fail; new ones do. See the script's docstring. | |
| - name: Guard report output against injection and remote destinations | |
| if: steps.changed-files-py.outputs.any_changed == 'true' | |
| run: python admin/scripts/check_html_safety.py | |
| # The seeker stages evidence under <report folder>/data, so every files_found entry | |
| # is an absolute path on the examiner's machine. artifact_processor normalizes only | |
| # the third element of the return tuple; a path put in a data row or handed to | |
| # write_artifact_data_table is published verbatim. The column is never empty and the | |
| # row count is always right, so nothing else catches it. See the script's docstring. | |
| - name: Guard report output against local filesystem paths | |
| if: steps.changed-files-py.outputs.any_changed == 'true' | |
| run: python admin/scripts/check_report_local_paths.py | |
| # The third element of an artifact's return tuple becomes the report's | |
| # "located at" line and the LAVA manifest source_path, so it has to be real | |
| # paths. Prose standing in for one points the examiner at a column that often | |
| # holds a basename, and the location ends up nowhere in the report. | |
| - name: Guard against prose returned as a source path | |
| if: steps.changed-files-py.outputs.any_changed == 'true' | |
| run: python admin/scripts/check_source_path.py | |
| # That same "located at" line and the LAVA manifest already carry the evidence | |
| # location, so an artifact that reads one system-wide file does not also need a | |
| # Source File column repeating the identical path on every row. The column earns | |
| # its place only when the declared paths can match more than one file, which is | |
| # why a per-user or per-app path keeps it: that column is what attributes a row | |
| # to a user or to one of several stores. | |
| - name: Guard against a Source File column that repeats one path | |
| if: steps.changed-files-py.outputs.any_changed == 'true' | |
| run: python admin/scripts/check_source_file_column.py | |
| # scripts/vendor/ holds code copied verbatim from another repository, so it | |
| # drifts in two directions and both are silent: an edit here looks like a fix | |
| # until the next re-vendor reverts it, and an upstream release leaves this copy | |
| # quietly old. The manifest records each copy's hash and upstream commit; this | |
| # checks the hash and fetches the upstream file at that commit. Unconditional | |
| # rather than gated on changed Python files, because the recorded hashes live in | |
| # a .json and a stale record is the same defect. | |
| - name: Check vendored files match what was vendored | |
| run: python admin/scripts/check_vendored.py | |
| # Fails only on warnings this pull request introduces. vleapp.py and | |
| # vleappGUI.py carry pre-existing warnings that are structural rather than | |
| # fixable -- wildcard imports are how those modules are put together -- so | |
| # failing on the absolute count would make every pull request that touches | |
| # them red for reasons unrelated to the change. See the script's docstring. | |
| - name: Run on changed files | |
| if: steps.changed-files-py.outputs.any_changed == 'true' | |
| run: | | |
| BASE=$(git merge-base "origin/${{ github.base_ref }}" HEAD) | |
| echo "Comparing against merge base $BASE" | |
| python admin/scripts/lint_changed.py --base-ref "$BASE" \ | |
| ${{ steps.changed-files-py.outputs.all_changed_files }} |