modularize python check action

.github/workflows/python-checks.yml

@@ -0,0 +1,168 @@
+name: Python checks
+
+on:
+    push:
+        branches: [ "main", "major-release" ]
+    pull_request:
+        branches: [ "main", "major-release" ]
+    workflow_dispatch:
+
+permissions:
+    contents: read
+
+jobs:
+    test:
+        strategy:
+            fail-fast: false
+            matrix:
+                python-version: ["3.8", "3.9", "3.10", "3.11", "3.12"]
+                os: ["ubuntu-latest", "windows-latest", "macos-latest"]
+                limited-dependencies: ["", "TRUE"]
+
+        runs-on: ${{ matrix.os }}
+
+        steps:
+            - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
+            - name: Set up Python ${{ matrix.python-version }}
+              uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
+              with:
+                  python-version: ${{ matrix.python-version }}
+
+            - name: Install uv
+              uses: install-pinned/uv@de03c60d508703a83d3f8f49afcf1249590ecda1  # 0.4.12
+
+            - name: Install dependencies
+              env:
+                  PARSONS_LIMITED_DEPENDENCIES: ${{ matrix.limited-dependencies }}
+              run: |
+                uv pip install --system -e .[all]
+                uv pip install --system -r requirements-dev.txt
+
+            - name: Test with pytest
+              run: |
+                pytest
+
+    ruff-format:
+        runs-on: ubuntu-latest
+
+        steps:
+            - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
+            - name: Set up Python 3.12
+              uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
+              with:
+                  python-version: "3.12"
+
+            - name: Install uv
+              uses: install-pinned/uv@de03c60d508703a83d3f8f49afcf1249590ecda1  # 0.4.12
+
+            - name: Install dependencies
+              run: |
+                uv pip install --system -r requirements-dev.txt
+
+            - name: Run ruff format
+              run: |
+                ruff format --diff --target-version=py38 .
+
+    ruff:
+        runs-on: ubuntu-latest
+
+        steps:
+            - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
+            - name: Set up Python 3.12
+              uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
+              with:
+                  python-version: "3.12"
+
+            - name: Install uv
+              uses: install-pinned/uv@de03c60d508703a83d3f8f49afcf1249590ecda1  # 0.4.12
+
+            - name: Install dependencies
+              run: |
+                uv pip install --system -r requirements-dev.txt
+
+            - name: Run ruff
+              run: |
+                ruff check --output-format=github .
+
+    bandit:
+        runs-on: ubuntu-latest
+
+        steps:
+            - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
+            - name: Set up Python 3.12
+              uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
+              with:
+                  python-version: "3.12"
+
+            - name: Install uv
+              uses: install-pinned/uv@de03c60d508703a83d3f8f49afcf1249590ecda1  # 0.4.12
+
+            - name: Install bandit
+              run: |
+                uv pip install --system -r requirements-dev.txt
+
+            - name: Run bandit scan
+              run: |
+                bandit -c pyproject.toml -r . -ll -ii
+
+    coverage:
+        runs-on: ubuntu-latest
+
+        steps:
+            - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
+            - name: Set up Python 3.12
+              uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
+              with:
+                  python-version: "3.12"
+
+            - name: Install uv
+              uses: install-pinned/uv@de03c60d508703a83d3f8f49afcf1249590ecda1  # 0.4.12
+
+            - name: Install dependencies
+              run: |
+                uv pip install --system -e .[all]
+                uv pip install --system -r requirements-dev.txt
+
+            - name: Test with pytest
+              run: |
+                coverage run -m pytest
+
+            - name: Check coverage
+              run: |
+                coverage report -m --skip-covered --fail-under=75
+
+    pip-install:
+        strategy:
+            fail-fast: false
+            matrix:
+                python-version: ["3.8", "3.9", "3.10", "3.11", "3.12"]
+                os: ["ubuntu-latest", "windows-latest", "macos-latest"]
+                limited-dependencies: ["", "TRUE"]
+
+        runs-on: ${{ matrix.os }}
+
+        steps:
+            - name: Harden Runner
+              uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
+              with:
+                  egress-policy: audit
+
+            - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
+            - name: Set up Python ${{ matrix.python-version }}
+              uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
+              with:
+                  python-version: ${{ matrix.python-version }}
+                  cache: pip
+
+            - name: Install dependencies
+              env:
+                  PARSONS_LIMITED_DEPENDENCIES: ${{ matrix.limited-dependencies }}
+              run: |
+                  pip install -r requirements-dev.txt
+                  pip install -e .[all]

pyproject.toml

@@ -1,5 +1,10 @@
 [tool.ruff]
 # Exclude a variety of commonly ignored directories.
+include = [
+    "parsons/**/*.py",
+    "test/**/*.py",
+    "useful_resources/**/*.py"
+]
 exclude = [
     ".bzr",
     ".direnv",
@@ -83,4 +88,17 @@ testpaths = [
 filterwarnings = [
     # Warnings triggered by libraries we use (not our own code)
     "ignore:invalid escape sequence:DeprecationWarning"
+]
+
+[tool.bandit]
+exclude_dirs = [
+    ".venv/"
+]
+
+[tool.isort]
+profile = "hug"
+src_paths = [
+    "parsons/",
+    "test/",
+    "useful_resources/"
 ]

requirements-dev.txt

@@ -1,8 +1,10 @@
 # Testing Requirements
-pycodestyle==2.11.1
+bandit[toml]==1.7.10
+coverage==7.6.2
+pycodestyle==2.12.1
 pytest-datadir==1.5.0
-pytest-mock==3.12.0
-pytest==8.1.1
-requests-mock==1.11.0
+pytest-mock==3.14.0
+pytest==8.3.3
+requests-mock==1.12.1
 ruff==0.6.9
-testfixtures==8.1.0
+testfixtures==8.3.0