diff --git a/.github/workflows/stacklet-ci.yml b/.github/workflows/stacklet-ci.yml new file mode 100644 index 000000000000..1a1ba37ee033 --- /dev/null +++ b/.github/workflows/stacklet-ci.yml @@ -0,0 +1,186 @@ +name: Stacklet CI + +on: + schedule: + - cron: '0 7 * * *' + workflow_dispatch: + +permissions: {} + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: false + +env: + SLACK_CHANNEL: C01HE4GGZ7A + +jobs: + notify-start: + name: Notify Slack (start) + runs-on: ubuntu-24.04 + environment: test + permissions: {} + env: + HARDEN_RUNNER: ${{ secrets.STEP_SECURITY_API_KEY != '' }} + outputs: + ts: ${{ steps.slack.outputs.ts }} + steps: + - name: Harden Runner + if: env.HARDEN_RUNNER == 'true' + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + + - name: Notify Slack starting + id: slack + uses: slackapi/slack-github-action@91efab103c0de0a537f72a35f6b8cda0ee76bf0a # v2.1.1 + with: + method: chat.postMessage + token: ${{ secrets.CI_SLACK_TOKEN }} + payload: | + channel: "${{ env.SLACK_CHANNEL }}" + text: "Superset CI - RUNNING" + attachments: + - color: "#FFA500" + blocks: + - type: "section" + text: + type: "mrkdwn" + text: "⏳ *Superset* CI - *RUNNING* ⏳" + - type: "divider" + - type: "section" + text: + type: "mrkdwn" + text: ${{ toJSON(github.ref_name == 'stacklet/integration' && 'Branch: stacklet/integration' || format('Branch: ⚠️ {0}', github.ref_name)) }} + - type: "divider" + - type: "section" + text: + type: "mrkdwn" + text: "<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|Test Logs>" + + python-unit: + name: Python unit tests + permissions: + contents: read + uses: stacklet/github-tooling/.github/workflows/run-script.yml@48cc95e34ca3ff105998f6b649ddee54bf6da4c2 # v1.1.0 + secrets: + STEP_SECURITY_API_KEY: ${{ secrets.STEP_SECURITY_API_KEY }} + with: + mise-env: stacklet-ci + run: | + set -euo pipefail + sudo apt-get update && sudo apt-get -y install libldap2-dev libsasl2-dev + uv pip install --system -r requirements/development.txt -e . + export PYTHONPATH="$PWD" SUPERSET_TESTENV=true SUPERSET_SECRET_KEY=not-a-secret + pytest --durations-min=0.5 ./tests/common ./tests/unit_tests --cache-clear --maxfail=50 + pytest --durations-min=0.5 --cov=superset/sql/ ./tests/unit_tests/sql/ --cache-clear --cov-fail-under=100 + + frontend: + name: Frontend tests and lint + runs-on: ubuntu-24.04 + permissions: + id-token: write + contents: read + env: + HARDEN_RUNNER: ${{ secrets.STEP_SECURITY_API_KEY != '' }} + defaults: + run: + working-directory: superset-frontend + steps: + - name: Harden Runner + if: env.HARDEN_RUNNER == 'true' + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + + - name: Checkout + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + + - name: Setup Node + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 + with: + node-version-file: superset-frontend/.nvmrc + cache: npm + cache-dependency-path: superset-frontend/package-lock.json + + - name: Configure AWS credentials + uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0 + with: + role-to-assume: ${{ vars.PUBLISH_ROLE_ARN }} + aws-region: us-east-1 + + # superset-frontend/.npmrc routes the @stacklet scope to CodeArtifact; + # the token goes in the user-level ~/.npmrc, which npm merges with it. + - name: Log in to CodeArtifact + run: | + token="$(aws codeartifact get-authorization-token \ + --domain stacklet \ + --domain-owner 653993915282 \ + --region us-east-1 \ + --query authorizationToken \ + --output text)" + echo "::add-mask::$token" + echo "//stacklet-653993915282.d.codeartifact.us-east-1.amazonaws.com/npm/stacklet.client.ui/:_authToken=${token}" >> ~/.npmrc + + # @stacklet/ui's preinstall hook invokes pnpm. + - name: Install pnpm + run: npm install -g pnpm@10.34.9 + + - name: Install dependencies + run: npm ci + + - name: Stacklet unit tests + run: npm run test -- src/stacklet + + - name: Lint + run: npm run lint + + notify-result: + name: Notify Slack (result) + if: always() && needs.notify-start.outputs.ts != '' + needs: [notify-start, python-unit, frontend] + runs-on: ubuntu-24.04 + environment: test + permissions: {} + env: + HARDEN_RUNNER: ${{ secrets.STEP_SECURITY_API_KEY != '' }} + steps: + - name: Harden Runner + if: env.HARDEN_RUNNER == 'true' + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + + - name: Notify Slack result + uses: slackapi/slack-github-action@91efab103c0de0a537f72a35f6b8cda0ee76bf0a # v2.1.1 + env: + SUCCESS: ${{ needs.python-unit.result == 'success' && needs.frontend.result == 'success' }} + with: + method: chat.update + token: ${{ secrets.CI_SLACK_TOKEN }} + payload: | + channel: "${{ env.SLACK_CHANNEL }}" + ts: "${{ needs.notify-start.outputs.ts }}" + text: "Superset CI - ${{ env.SUCCESS == 'true' && 'SUCCEEDED' || 'FAILED' }}" + attachments: + - color: "${{ env.SUCCESS == 'true' && '#36a64f' || '#ff0000' }}" + blocks: + - type: "section" + text: + type: "mrkdwn" + text: "${{ env.SUCCESS == 'true' && '✅ *Superset* CI - *SUCCEEDED* ✅' || '❌ *Superset* CI - *FAILED* ❌' }}" + - type: "divider" + - type: "section" + text: + type: "mrkdwn" + text: ${{ toJSON(github.ref_name == 'stacklet/integration' && 'Branch: stacklet/integration' || format('Branch: ⚠️ {0}', github.ref_name)) }} + - type: "divider" + - type: "section" + text: + type: "mrkdwn" + text: "<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|Test Logs>" diff --git a/.github/workflows/stacklet-image.yml b/.github/workflows/stacklet-image.yml index 48eaa4de3fff..ebac8c9b8349 100644 --- a/.github/workflows/stacklet-image.yml +++ b/.github/workflows/stacklet-image.yml @@ -25,7 +25,16 @@ jobs: permissions: id-token: write contents: read + env: + HARDEN_RUNNER: ${{ secrets.STEP_SECURITY_API_KEY != '' }} steps: + - name: Harden Runner + if: env.HARDEN_RUNNER == 'true' + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Resolve source ref id: src env: diff --git a/.github/workflows/stacklet-sync-upstream-tags.yml b/.github/workflows/stacklet-sync-upstream-tags.yml index 4fc42cc0bfdc..7a945f009e1c 100644 --- a/.github/workflows/stacklet-sync-upstream-tags.yml +++ b/.github/workflows/stacklet-sync-upstream-tags.yml @@ -12,7 +12,18 @@ permissions: {} jobs: sync-tags: runs-on: ubuntu-latest + permissions: + contents: read + env: + HARDEN_RUNNER: ${{ secrets.STEP_SECURITY_API_KEY != '' }} steps: + - name: Harden Runner + if: env.HARDEN_RUNNER == 'true' + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Checkout uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: diff --git a/.rat-excludes b/.rat-excludes index 44cf26ac6a3a..57fa5cac80e6 100644 --- a/.rat-excludes +++ b/.rat-excludes @@ -9,6 +9,8 @@ .eslintignore .flake8 .nvmrc +mise.toml +mise.stacklet-ci.toml .prettierrc .rat-excludes .swcrc diff --git a/mise.stacklet-ci.lock b/mise.stacklet-ci.lock new file mode 100644 index 000000000000..5bd6760f752b --- /dev/null +++ b/mise.stacklet-ci.lock @@ -0,0 +1,57 @@ +# @generated - this file is auto-generated by `mise lock` https://mise.jdx.dev/dev-tools/mise-lock.html + +lockfile_version = 3 + +[[tools.python]] +version = "3.11.18" +backend = "core:python" +specifiers = ["3.11"] + +[tools.python."platforms.linux-arm64"] +checksum = "sha256:ecf28575cd67fa7a53c7bf2355bae5cff2c496efeb51780d50a8b54441cdce74" +url = "https://github.com/astral-sh/python-build-standalone/releases/download/20261026/cpython-3.11.18+20261026-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz" +provenance = "github-attestations" + +[tools.python."platforms.linux-x64"] +checksum = "sha256:17c4978a36c496dc53c08899ef8dad1ad2734f6325f08d6033a1e66419e0af26" +url = "https://github.com/astral-sh/python-build-standalone/releases/download/20261026/cpython-3.11.18+20261026-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz" +provenance = "github-attestations" + +[tools.python."platforms.macos-arm64"] +checksum = "sha256:f3e1cd83a7f1d70e58b0d69102c18bd6867d2f973068dc5cbfd5822e445c66df" +url = "https://github.com/astral-sh/python-build-standalone/releases/download/20261026/cpython-3.11.18+20261026-aarch64-apple-darwin-install_only_stripped.tar.gz" +provenance = "github-attestations" + +[tools.python."platforms.macos-x64"] +checksum = "sha256:d38edc2df25e7e7f886c802bf2fa552422b097c509dbdcbae828827470356095" +url = "https://github.com/astral-sh/python-build-standalone/releases/download/20261026/cpython-3.11.18+20261026-x86_64-apple-darwin-install_only_stripped.tar.gz" +provenance = "github-attestations" + +[[tools.uv]] +version = "0.13.5" +backend = "aqua:astral-sh/uv" +specifiers = ["0.13.5"] + +[tools.uv."platforms.linux-arm64"] +checksum = "sha256:4bb69cf95ed13f23713bb7bc09f241896ea0c75b7c557e615a20604b82f9c403" +url = "https://github.com/astral-sh/uv/releases/download/0.13.5/uv-aarch64-unknown-linux-gnu.tar.gz" +url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/664335837" +provenance = "github-attestations" + +[tools.uv."platforms.linux-x64"] +checksum = "sha256:f68d291c75783122dad58ab77def0e13f3233f358731db5d6d7e8715603b928f" +url = "https://github.com/astral-sh/uv/releases/download/0.13.5/uv-x86_64-unknown-linux-gnu.tar.gz" +url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/664336023" +provenance = "github-attestations" + +[tools.uv."platforms.macos-arm64"] +checksum = "sha256:743f85035a1996ecb350659e01cd9faea9709829be09b1b4b03c73eaf3c9cd73" +url = "https://github.com/astral-sh/uv/releases/download/0.13.5/uv-aarch64-apple-darwin.tar.gz" +url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/664335803" +provenance = "github-attestations" + +[tools.uv."platforms.macos-x64"] +checksum = "sha256:b0f52b0e3945b4107d89024ea38e625683011fbfc05a0d98f9fa2d6dcee28c66" +url = "https://github.com/astral-sh/uv/releases/download/0.13.5/uv-x86_64-apple-darwin.tar.gz" +url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/664335993" +provenance = "github-attestations" diff --git a/mise.stacklet-ci.toml b/mise.stacklet-ci.toml new file mode 100644 index 000000000000..67e638376c72 --- /dev/null +++ b/mise.stacklet-ci.toml @@ -0,0 +1,3 @@ +[tools] +python = "3.11" +uv = "0.13.5" diff --git a/mise.toml b/mise.toml new file mode 100644 index 000000000000..ae8ac43e7c1e --- /dev/null +++ b/mise.toml @@ -0,0 +1,3 @@ +[settings] +lockfile = true +lockfile_platforms = ["linux-x64", "linux-arm64", "macos-x64", "macos-arm64"]