docs: reconcile protected capability maturity #3965
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.run_id }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| jobs: | |
| build-and-test: | |
| if: ${{ github.event_name != 'pull_request' || (!github.event.pull_request.draft && github.event.action != 'closed') }} | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| persist-credentials: false | |
| - name: Verify exact checkout | |
| env: | |
| INKSPAN_EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} | |
| run: | | |
| actual_head="$(git rev-parse HEAD)" | |
| test "$actual_head" = "$INKSPAN_EXPECTED_HEAD_SHA" | |
| # pnpm version comes from the package.json "packageManager" field | |
| # (pnpm 10+), which is required to read `overrides` from | |
| # pnpm-workspace.yaml consistently with the committed lockfile. | |
| - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - name: Typecheck | |
| run: pnpm typecheck | |
| - name: Test with 100% coverage | |
| run: pnpm coverage | |
| - name: Build library | |
| run: pnpm build | |
| - name: Verify packed package consumers | |
| run: pnpm verify:package | |
| - name: Build demo | |
| run: pnpm build:demo | |
| browser-release-evidence: | |
| if: ${{ github.event_name != 'pull_request' || (!github.event.pull_request.draft && github.event.action != 'closed') }} | |
| name: Cross-engine Clipboard / Playwright 1.62.0 | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 60 | |
| env: | |
| PLAYWRIGHT_BROWSERS_PATH: /tmp/inkspan-playwright-browsers | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| persist-credentials: false | |
| - name: Verify exact checkout | |
| env: | |
| INKSPAN_EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} | |
| run: | | |
| actual_head="$(git rev-parse HEAD)" | |
| test "$actual_head" = "$INKSPAN_EXPECTED_HEAD_SHA" | |
| - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - name: Install root dependencies from the immutable lock | |
| run: pnpm install --frozen-lockfile | |
| - name: Install browser-test dependencies from the isolated immutable lock | |
| run: pnpm --dir tests/browser install --frozen-lockfile | |
| - name: Install Playwright browser revisions pinned by 1.62.0 | |
| run: pnpm --dir tests/browser exec playwright install --with-deps chromium firefox webkit | |
| - name: Verify real-engine rich clipboard release evidence | |
| env: | |
| INKSPAN_EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} | |
| run: pnpm --dir tests/browser exec playwright test --config playwright.config.ts | |
| office: | |
| if: ${{ github.event_name != 'pull_request' || (!github.event.pull_request.draft && github.event.action != 'closed') }} | |
| name: Office / Python ${{ matrix.python-version }} | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 30 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ${{ github.event_name == 'pull_request' && fromJSON('["3.14"]') || fromJSON('["3.11", "3.12", "3.13", "3.14"]') }} | |
| defaults: | |
| run: | |
| working-directory: office | |
| env: | |
| PYTHONPATH: src | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| persist-credentials: false | |
| - name: Verify exact checkout | |
| env: | |
| INKSPAN_EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} | |
| run: | | |
| actual_head="$(git rev-parse HEAD)" | |
| test "$actual_head" = "$INKSPAN_EXPECTED_HEAD_SHA" | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| cache: pip | |
| cache-dependency-path: office/requirements-ci.txt | |
| - name: Install hash-locked dependencies | |
| run: "python -m pip install --require-hashes --only-binary=:all: -r requirements-ci.txt" | |
| - name: Verify dependency consistency | |
| run: python -m pip check | |
| - name: Verify 100% docstring coverage | |
| run: python scripts/check_docstrings.py | |
| - name: Test with 100% branch coverage | |
| run: | | |
| coverage run -m pytest | |
| coverage report | |
| - name: Build wheel | |
| run: python -m pip wheel . --no-deps --no-build-isolation --wheel-dir dist | |
| - name: Verify packaged schema and license | |
| run: | | |
| python - <<'PY' | |
| from pathlib import Path | |
| from zipfile import ZipFile | |
| wheel = next(Path("dist").glob("*.whl")) | |
| with ZipFile(wheel) as archive: | |
| names = set(archive.namelist()) | |
| assert "inkspan_office/schema.json" in names | |
| assert any(name.endswith(".dist-info/licenses/LICENSE") for name in names) | |
| PY |