python-dependency-bounds.yml

name: Python - Dependency Bounds

on:
  pull_request:
    branches: ["main"]
  merge_group:
  workflow_dispatch:

permissions:
  contents: read

env:
  UV_CACHE_DIR: /tmp/.uv-cache

jobs:
  dependency-bounds:
    name: Dependency Bounds Validation
    runs-on: ubuntu-latest
    timeout-minutes: 60
    env:
      UV_PYTHON: "3.13"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Test version-bump detection
        working-directory: ./python
        run: python3 -m unittest discover -s scripts/dependencies/tests -p test_detect_version_bumps.py
      - name: Detect new packages and package version changes
        id: versions
        env:
          EVENT_NAME: ${{ github.event_name }}
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha }}
        run: |
          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            echo "required=true" >> "$GITHUB_OUTPUT"
          else
            python3 python/scripts/dependencies/detect_version_bumps.py \
              --base-ref "$BASE_SHA" --github-output "$GITHUB_OUTPUT"
          fi
      - name: Set up python and install the project
        if: steps.versions.outputs.required == 'true'
        uses: ./.github/actions/python-setup
        with:
          python-version: ${{ env.UV_PYTHON }}
          os: ${{ runner.os }}
      - name: Run lower and upper dependency tests and typing
        if: steps.versions.outputs.required == 'true'
        working-directory: ./python
        run: uv run --locked --group tool-runtime poe validate-dependency-bounds-test --package "*"
      - name: Upload dependency bounds report
        if: always() && steps.versions.outputs.required == 'true'
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: dependency-bounds-test-results
          path: python/scripts/dependencies/dependency-bounds-test-results.json
          if-no-files-found: warn