python-code-quality.yml

---
name: Python Code Quality

on:
  push:
    branches:
      - main
      - releasebranch_*
  pull_request:

permissions: {}

jobs:
  python-checks:
    name: Python Code Quality Checks

    concurrency:
      group: ${{ github.workflow }}-${{ github.job }}-${{
        github.event_name == 'pull_request' &&
        github.head_ref || github.sha }}
      cancel-in-progress: true

    strategy:
      matrix:
        include:
          - os: ubuntu-22.04

    env:
      # renovate: datasource=python-version depName=python
      PYTHON_VERSION: "3.13"
      MIN_PYTHON_VERSION: "3.9"
      # renovate: datasource=pypi depName=flake8
      FLAKE8_VERSION: "7.2.0"
      # renovate: datasource=pypi depName=pylint
      PYLINT_VERSION: "3.3.7"
      # renovate: datasource=pypi depName=bandit
      BANDIT_VERSION: "1.8.3"
      # renovate: datasource=pypi depName=ruff
      RUFF_VERSION: "0.11.12"

    runs-on: ${{ matrix.os }}
    permissions:
      security-events: write

    steps:
      - name: Versions
        run: |
          echo OS: ${{ matrix.os }}
          echo Python: ${{ env.PYTHON_VERSION }}
          echo Minimal Python version: ${{ env.MIN_PYTHON_VERSION }}
          echo Flake8: ${{ env.FLAKE8_VERSION }}
          echo Pylint: ${{ env.PYLINT_VERSION }}
          echo Bandit: ${{ env.BANDIT_VERSION }}
          echo Ruff: ${{ env.RUFF_VERSION }}

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: pip
      - name: Upgrade pip
        run: python -m pip install --upgrade pip

      - name: Install Ruff
        run: pip install ruff==${{ env.RUFF_VERSION }}
      - name: Run Ruff (output annotations on fixable errors)
        run: ruff check --output-format=github . --preview --unsafe-fixes
        continue-on-error: true
      - name: Run Ruff (apply fixes for suggestions)
        run: ruff check . --preview --fix --unsafe-fixes
      - name: Run `ruff format` showing diff without failing
        continue-on-error: true
        if: ${{ !cancelled() }}
        run: ruff format --diff
      - name: Run `ruff format` fixing files
        # Run `ruff format` even when `ruff check` fixed files: fixes can require formatting
        if: ${{ !cancelled() }}
        run: ruff format
      - name: Create and uploads code suggestions to apply for Ruff
        # Will fail fast here if there are changes required
        id: diff-ruff
        # To run after ruff step exits with failure when rules don't have fixes available
        if: ${{ !cancelled() }}
        uses: ./.github/actions/create-upload-suggestions
        with:
          tool-name: ruff
          # To keep repo's file structure in formatted changes artifact
          extra-upload-changes: pyproject.toml

      - name: Install non-Python dependencies
        run: |
          sudo apt-get update -y
          sudo apt-get install -y wget git gawk findutils
          xargs -a <(awk '! /^ *(#|$)/' ".github/workflows/apt.txt") -r -- \
          sudo apt-get install -y --no-install-recommends --no-install-suggests

      - name: Install Python dependencies
        run: |
          pip install -r .github/workflows/python_requirements.txt
          pip install -r .github/workflows/optional_requirements.txt
          pip install --user pipx
          pipx ensurepath
          pipx install flake8==${{ env.FLAKE8_VERSION }}
          pipx install pylint==${{ env.PYLINT_VERSION }}
          pipx inject pylint -r .github/workflows/python_requirements.txt -r .github/workflows/optional_requirements.txt
          # The extra toml is only needed before Python 3.11
          pipx install bandit[sarif,toml]==${{ env.BANDIT_VERSION }}

      - name: Run Flake8
        run: |
          flake8 --count --statistics --show-source --jobs=$(nproc) .

      - name: Run Flake8 on additional files
        run: |
          flake8 --count --statistics --show-source --jobs=$(nproc) python/grass/{script,jupyter}/testsuite/

      - name: Bandit Vulnerability Scan
        run: |
          bandit -c pyproject.toml -iii -r . -f sarif -o bandit.sarif --exit-zero

      - name: Upload Bandit Scan Results
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: bandit.sarif
          path: bandit.sarif

      - name: Upload SARIF File into Security Tab
        uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
        with:
          sarif_file: bandit.sarif

      - name: Create installation directory
        run: |
          mkdir $HOME/install

      - name: Set number of cores for compilation
        run: |
          echo "MAKEFLAGS=-j$(nproc)" >> $GITHUB_ENV

      - uses: rui314/setup-mold@67424c1b3680e35255d95971cbd5de0047bf31c3 # v1
      - name: Build
        run: .github/workflows/build_${{ matrix.os }}.sh $HOME/install

      - name: Add the bin directory to PATH
        run: |
          echo "$HOME/install/bin" >> $GITHUB_PATH

      - name: Run Pylint on grass package
        # Until slower checks (like similarity) are reenabled, running in one step is faster
        if: false
        run: |
          export PYTHONPATH=`grass --config python_path`:$PYTHONPATH
          export LD_LIBRARY_PATH=$(grass --config path)/lib:$LD_LIBRARY_PATH
          pylint --persistent=no --py-version=${{ env.MIN_PYTHON_VERSION }} --jobs=$(nproc) grass

      - name: Run Pylint on other files using pytest
        # Until slower checks (like similarity) are reenabled, running in one step is faster
        if: false
        run: |
          pipx inject --include-apps pylint pytest
          pipx inject pylint pytest-pylint pytest-github-actions-annotate-failures pytest-timeout
          export PYTHONPATH=`grass --config python_path`:$PYTHONPATH
          export LD_LIBRARY_PATH=$(grass --config path)/lib:$LD_LIBRARY_PATH
          pytest --pylint -m pylint --pylint-jobs=$(nproc) \
            --pylint-ignore-patterns="${{ env.PylintIgnore }}"
        env:
          PylintIgnore: "python/.*,gui/.*"

      - name: Run Pylint on wxGUI
        # Until slower checks (like similarity) are reenabled, running in one step is faster
        if: false
        run: |
          export PYTHONPATH=`grass --config python_path`:$PYTHONPATH
          export LD_LIBRARY_PATH=$(grass --config path)/lib:$LD_LIBRARY_PATH
          pylint --persistent=no --py-version=${{ env.MIN_PYTHON_VERSION }} --jobs=$(nproc) gui

      - name: Run Pylint all in one pass
        run: |
          export PYTHONPATH=`grass --config python_path`:$PYTHONPATH
          export LD_LIBRARY_PATH=$(grass --config path)/lib:$LD_LIBRARY_PATH
          pylint --persistent=no --py-version=${{ env.MIN_PYTHON_VERSION }} --jobs=$(nproc) .

      - name: Test compiling example modules
        run: |
          ( cd doc/examples/raster/r.example/ && make )
          ( cd doc/examples/vector/v.example/ && make )

  python-success:
    name: Python Code Quality Result
    needs:
      - python-checks
    if: ${{ always() }}
    uses: ./.github/workflows/verify-success.yml
    with:
      needs_context: ${{ toJson(needs) }}