_quality-python.yml

# SPDX-License-Identifier: Apache-2.0
# Copyright 2022 The HuggingFace Authors.

name: Check Python code quality
on:
  workflow_call:
    inputs:
      working-directory:
        required: true
        type: string
env:
  # required to get access to use a cached poetry venv in "/home/runner/.cache/pypoetry/virtualenvs"
  POETRY_VIRTUALENVS_IN_PROJECT: false
  python-version: "3.9.18"
  poetry-version: "1.8.2"
jobs:
  code-quality:
    defaults:
      run:
        shell: bash
        working-directory: ${{ inputs.working-directory }}
    runs-on: "ubuntu-latest"
    steps:
      - uses: actions/checkout@v4
      - name: Install poetry
        run: pipx install poetry==${{ env.poetry-version }}
      - name: Use Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.python-version }}
          cache: "poetry"
          cache-dependency-path: |
            ${{ inputs.working-directory }}/poetry.lock
      - name: Install packages
        run: sudo apt update; sudo apt install -y ffmpeg libavcodec-extra libsndfile1
      - name: Verify consistency of poetry.lock with pyproject.toml
        run: poetry lock --no-update --check
      - name: Install dependencies
        # "poetry env use" is required: https://github.com/actions/setup-python/issues/374#issuecomment-1088938718
        run: |
          poetry env use "${{ env.python-version }}"
          poetry install
      - name: Run ruff linter
        run: |
          if [ -d src ]; then poetry run ruff check src; fi
          if [ -d tests ]; then poetry run ruff check tests --ignore=ARG; fi
      - name: Run ruff formatter
        run: |
          if [ -d src ]; then poetry run ruff format --check src; fi
          if [ -d tests ]; then poetry run ruff format --check tests; fi
      - name: Run mypy
        run: |
          if [ -d src ]; then poetry run mypy src; fi
          if [ -d tests ]; then poetry run mypy tests; fi
      - name: Run bandit
        run: if [ -d src ]; then poetry run bandit -r src; fi
      # - name: Run pip-audit
      #   run: bash -c "poetry run pip-audit --ignore-vuln GHSA-wj6h-64fc-37mp --ignore-vuln GHSA-wfm5-v35h-vwf4 --ignore-vuln GHSA-cwvm-v4w8-q58c --ignore-vuln PYSEC-2022-43059 -r <(poetry export -f requirements.txt --with dev | sed '/^libapi @/d' | sed '/^libcommon @/d')"
      # ^ 20240506 - disabled until we upgrade to huggingface-hub@0.23 and datasets@2.20