check-python.yaml

name: Check Python Code

on:
  workflow_call:

jobs:
  check-python:
    runs-on: "ubuntu-latest"
    strategy:
      matrix:
        python-version: ["3.10", "3.11", "3.12"]
    steps:
      - name: Checkout source code
        uses: actions/checkout@v3

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install pipx
        run: |
          python -m pip install --upgrade pip
          python -m pip install pipx
          python -m pipx ensurepath

      - name: Cache Poetry
        uses: actions/cache@v4
        with:
          path: ~/.local/share/pipx/venvs/poetry
          key: ${{ runner.os }}-poetry-${{ matrix.python-version }}-${{ hashFiles('**/poetry.lock') }}
          restore-keys: |
            ${{ runner.os }}-poetry-${{ matrix.python-version }}-

      - name: Install poetry
        run: pipx install poetry

      - name: Install dependencies
        run: poetry install --no-interaction --no-root

      - name: Audit with pip-audit
        run: |
          # audit non dev dependencies, no exclusions
          poetry export --without=dev > requirements.txt && poetry run pip-audit -r requirements.txt

          # audit all dependencies, with exclusions. 
          # If a vulnerability is found in a dev dependency without an available fix,
          # it can be temporarily ignored by adding --ignore-vuln e.g.
          # --ignore-vuln "GHSA-hcpj-qp55-gfph" # GitPython vulnerability, dev only dependency
          poetry run pip-audit

      - name: Check formatting with Ruff
        run: |
          # stop the build if there are files that don't meet formatting requirements
          poetry run ruff format --check .

      - name: Check linting with Ruff
        run: |
          # stop the build if there are Python syntax errors or undefined names
          poetry run ruff check .

      - name: Check types with mypy
        run: poetry run mypy