Skip to content

Ci/action versions - #46

Merged
vringar merged 2 commits into
masterfrom
ci/action-versions
Sep 1, 2026
Merged

vringar merged 2 commits into
masterfrom
ci/action-versions

Conversation

@vringar

@vringar vringar commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

No description provided.

The flake could not be entered by anything that runs `nix-shell`, which is
what the sandbox wrapper and plain `nix-shell` both do; `nix-shell flake.nix`
evaluates an attrset rather than a derivation and fails. Replace it with a
shell.nix, pinning nixpkgs with npins at the revision flake.lock already held,
so the toolchain is unchanged. `.envrc` switches to `use nix`.

The shell now also works under `--pure`. It ships cacert and sets
SSL_CERT_FILE, because `nix-shell --pure` points that variable at a file that
does not exist and uv then cannot reach PyPI. A shell whose dependency list is
only true impurely is not much of a dependency list.

Add pre-commit hooks for ruff, pyright, alejandra and actionlint. Every hook is
`language: system`: on NixOS the published ruff and pyright wheels are prebuilt
dynamically linked binaries that will not run, and taking the tools from the
environment keeps every hook on the same version as `just lint`. actionlint
delegates the workflows' `run:` blocks to shellcheck when it is on PATH, so the
shell provides that too. npins' generated default.nix is excluded from
alejandra, since formatting it would only be undone by the next `npins update`.

Ship type annotations. The package carries a py.typed marker and domain_utils
gains an __all__, without which none of the annotations are visible to
consumers. pyright runs in strict mode over the package and the tests.

Two things had to change to get there. The lazily created extractor moved from
an attribute on the wrapper function to a closure cell, and the decorator is
typed with ParamSpec so the functions it wraps keep their real signatures
instead of collapsing to (*args, **kwargs). The isinstance guard became
_require_extractor, called at the point of use so that a caller who passes no
extractor still fails only when one is actually needed. The public **kwargs
signatures are unchanged: Unpack of a TypedDict types them precisely, which
matters because passing extractor=None is deliberately not the same as leaving
it out, and promoting it to a real parameter would have erased that.

The justfile grows the recipes this commit needs: typecheck, test-all over the
four interpreters, ci, and the release-build and test-wheel recipes the release
workflow calls. typecheck depends on install-dev, because pyright resolves
imports through .venv and would otherwise report every third-party import as
unknown on a fresh checkout. check-version also gains a changelog check: the
changelog is part of the published description now, so releasing with an
"(unreleased)" heading would put that at the top of the PyPI page.

CI collapses to a single job that enters the shell and runs `just ci`, and the
release workflow does the same for everything short of publishing. A red build
now reproduces locally with the same command and the same tool versions. One
job rather than five because the shell's closure is 13 GB and realising it once
per matrix entry would dominate every run; `just test-all` loops the four
interpreters inside the single shell instead.
actions/checkout v4 declares a Node 20 runtime, which the runners now warn is
deprecated. Move to the current majors: checkout v7, upload-artifact v7,
download-artifact v8. install-nix-action and gh-action-pypi-publish are
already current.
@vringar
vringar merged commit bb08e5a into master Sep 1, 2026
1 check passed
@vringar
vringar deleted the ci/action-versions branch September 1, 2026 14:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant