Repository navigation
Raise the economy cache schema version so ×100 decile results stop being served #5336
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Pull request | |
| on: pull_request | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| env: | |
| ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true | |
| OLD_SIMULATION_GATEWAY_URL: ${{ vars.OLD_SIMULATION_GATEWAY_URL }} | |
| jobs: | |
| ci-complete: | |
| # The required check. Needs every other job: on a stacked pull request | |
| # above the lowest unmerged one it fails, because those jobs were skipped | |
| # and a skipped job would count as passing; otherwise it passes only when | |
| # every job passed. See docs/engineering/skills/github-prs.md. | |
| name: CI complete | |
| if: ${{ always() }} | |
| needs: | |
| - ensure-policyengine-bundle-supported-by-simulation-api | |
| - lint | |
| - typecheck-v2 | |
| - quality-guards | |
| - alembic-v1-check | |
| - alembic-v2-check | |
| - v2-integration-check | |
| - check-changelog | |
| - test_container_builds | |
| - test_cloud_run_container_builds | |
| - test_env_vars | |
| - test | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout the gate script | |
| uses: actions/checkout@v4 | |
| with: | |
| sparse-checkout: .github/scripts/check_ci_complete.sh | |
| sparse-checkout-cone-mode: false | |
| - name: Require full CI, with every job passing | |
| env: | |
| JOB_RESULTS: ${{ toJSON(needs) }} | |
| PULL_REQUEST_BASE_REF: ${{ github.event.pull_request.base.ref }} | |
| STACK_BASE_REF: ${{ github.event.pull_request.stack.base.ref }} | |
| run: bash .github/scripts/check_ci_complete.sh | |
| ensure-policyengine-bundle-supported-by-simulation-api: | |
| name: Ensure PolicyEngine bundle is supported by simulation API | |
| # Full CI runs only on the lowest unmerged pull request in a stack. | |
| if: ${{ !github.event.pull_request.stack || github.event.pull_request.stack.base.ref == github.event.pull_request.base.ref }} | |
| runs-on: ubuntu-latest | |
| environment: staging | |
| env: | |
| SIM_ENTRYPOINT: ${{ vars.SIM_ENTRYPOINT }} | |
| SIMULATION_ENTRYPOINT_URL: ${{ secrets.SIMULATION_ENTRYPOINT_URL }} | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repo | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install jq | |
| run: sudo apt-get install -y jq | |
| - name: Set up uv for installed bundle validation | |
| uses: astral-sh/setup-uv@v6 | |
| - name: Check simulation API supports updated PolicyEngine bundle | |
| run: bash .github/check-policyengine-bundle-supported.sh --if-changed-from-base "${{ github.base_ref }}" | |
| lint: | |
| name: Lint | |
| # Full CI runs only on the lowest unmerged pull request in a stack. | |
| if: ${{ !github.event.pull_request.stack || github.event.pull_request.stack.base.ref == github.event.pull_request.base.ref }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repo | |
| uses: actions/checkout@v4 | |
| - name: Setup Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install ruff (version pinned in uv.lock) | |
| run: bash .github/scripts/install_locked_ruff.sh | |
| - name: Format check with ruff | |
| run: ruff format --check . | |
| - name: Lint with ruff | |
| run: ruff check . | |
| typecheck-v2: | |
| name: Type-check API v2 | |
| # Full CI runs only on the lowest unmerged pull request in a stack. | |
| if: ${{ !github.event.pull_request.stack || github.event.pull_request.stack.base.ref == github.event.pull_request.base.ref }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repo | |
| uses: actions/checkout@v4 | |
| - name: Setup Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Setup uv | |
| uses: astral-sh/setup-uv@v6 | |
| - name: Install locked dependencies | |
| run: uv sync --frozen --extra dev | |
| - name: Type-check API v2 | |
| run: uv run --frozen --extra dev mypy | |
| quality-guards: | |
| name: Quality guards | |
| # Full CI runs only on the lowest unmerged pull request in a stack. | |
| if: ${{ !github.event.pull_request.stack || github.event.pull_request.stack.base.ref == github.event.pull_request.base.ref }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repo | |
| uses: actions/checkout@v4 | |
| with: | |
| # The rules registry guard compares baselines with the base branch. | |
| fetch-depth: 0 | |
| - name: Setup Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Test the rules registry tool | |
| run: python -m unittest discover -s scripts/rules/tests -t . | |
| - name: Install shellcheck (for the ci-scripts guard) | |
| run: pip install "shellcheck-py==0.11.0.1" | |
| - name: Run quality guards | |
| run: python scripts/run_quality_guards.py | |
| alembic-v1-check: | |
| name: Alembic v1 qualification | |
| # Full CI runs only on the lowest unmerged pull request in a stack. | |
| if: ${{ !github.event.pull_request.stack || github.event.pull_request.stack.base.ref == github.event.pull_request.base.ref }} | |
| uses: ./.github/workflows/alembic-v1-check.yml | |
| alembic-v2-check: | |
| name: Alembic v2 qualification | |
| # Full CI runs only on the lowest unmerged pull request in a stack. | |
| if: ${{ !github.event.pull_request.stack || github.event.pull_request.stack.base.ref == github.event.pull_request.base.ref }} | |
| uses: ./.github/workflows/alembic-v2-check.yml | |
| v2-integration-check: | |
| name: Cross-database integration tests | |
| # Full CI runs only on the lowest unmerged pull request in a stack. | |
| if: ${{ !github.event.pull_request.stack || github.event.pull_request.stack.base.ref == github.event.pull_request.base.ref }} | |
| uses: ./.github/workflows/v2-integration-check.yml | |
| secrets: | |
| CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} | |
| check-changelog: | |
| name: Check changelog fragment | |
| # Full CI runs only on the lowest unmerged pull request in a stack. | |
| if: ${{ !github.event.pull_request.stack || github.event.pull_request.stack.base.ref == github.event.pull_request.base.ref }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Check for changelog fragment | |
| run: bash .github/scripts/check_changelog_fragment.sh | |
| test_container_builds: | |
| name: Docker | |
| runs-on: ubuntu-latest | |
| needs: ensure-policyengine-bundle-supported-by-simulation-api | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Checkout repo | |
| uses: actions/checkout@v4 | |
| - name: Log in to the Container registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build container | |
| run: docker build -t ghcr.io/policyengine/policyengine docker | |
| test_cloud_run_container_builds: | |
| name: Cloud Run container | |
| runs-on: ubuntu-latest | |
| needs: ensure-policyengine-bundle-supported-by-simulation-api | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repo | |
| uses: actions/checkout@v4 | |
| - name: Build Cloud Run container | |
| run: docker build -f gcp/cloud_run/Dockerfile -t policyengine-api-cloud-run:test . | |
| test_env_vars: | |
| name: Test environment variables | |
| runs-on: ubuntu-latest | |
| needs: ensure-policyengine-bundle-supported-by-simulation-api | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - name: Checkout repo | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Auth | |
| uses: google-github-actions/auth@v2 | |
| with: | |
| workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }} | |
| service_account: ${{ secrets.GCP_DEPLOY_SERVICE_ACCOUNT }} | |
| - name: Wait until PolicyEngine bundle version is available on PyPI | |
| run: .github/wait-for-pypi.sh | |
| - name: Install dependencies | |
| run: make install | |
| - name: Run environment variable tests | |
| run: pytest tests/env_variables/test_environment_variables.py | |
| env: | |
| POLICYENGINE_GITHUB_MICRODATA_AUTH_TOKEN: ${{ secrets.POLICYENGINE_GITHUB_MICRODATA_AUTH_TOKEN }} | |
| # Compatibility name required by PolicyEngine Core. The GitHub | |
| # credential name describes its provider, data, and read-only scope. | |
| HUGGING_FACE_TOKEN: ${{ secrets.PE_UK_PRIVATE_HF_READ_TOKEN }} | |
| POLICYENGINE_DB_PASSWORD: ${{ secrets.POLICYENGINE_DB_PASSWORD }} | |
| test: | |
| name: Test | |
| runs-on: ubuntu-latest | |
| needs: | |
| - ensure-policyengine-bundle-supported-by-simulation-api | |
| - test_env_vars | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - name: Checkout repo | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Update package lists | |
| run: sudo apt-get update | |
| - name: Install system dependencies | |
| run: sudo apt-get install -y redis-server | |
| - name: Start Redis | |
| run: sudo systemctl start redis-server | |
| - name: Auth | |
| uses: google-github-actions/auth@v2 | |
| with: | |
| workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }} | |
| service_account: ${{ secrets.GCP_DEPLOY_SERVICE_ACCOUNT }} | |
| - name: Set up Cloud SDK | |
| uses: google-github-actions/setup-gcloud@v2 | |
| with: | |
| project_id: policyengine-api | |
| - name: Install dependencies | |
| run: make install | |
| - name: Test the API | |
| run: make test | |
| env: | |
| POLICYENGINE_DB_PASSWORD: ${{ secrets.POLICYENGINE_DB_PASSWORD }} | |
| POLICYENGINE_GITHUB_MICRODATA_AUTH_TOKEN: ${{ secrets.POLICYENGINE_GITHUB_MICRODATA_AUTH_TOKEN }} | |
| OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} | |
| HUGGING_FACE_TOKEN: ${{ secrets.PE_UK_PRIVATE_HF_READ_TOKEN }} | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@v5 | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| slug: PolicyEngine/policyengine-api |