undefined

undefined

undefined

undefined

undefined

undefined

undefined

  - name: Set up Python
    uses: actions/setup-python@v5
    with:
      python-version: ${{ env.PYTHON_VERSION }}
      cache: 'pip'

  - name: Install linters
    run: |
      pip install ruff mypy

  - name: Run linting
    run: |
      ruff check src/
      ruff format --check src/

  - name: Type checking
    run: mypy src/ --ignore-missing-imports

  - name: Set up Python
    uses: actions/setup-python@v5
    with:
      python-version: ${{ env.PYTHON_VERSION }}
      cache: 'pip'

  - name: Install dependencies
    run: |
      pip install -e ".[dev]"

  - name: Run tests
    run: |
      pytest tests/ -v --cov=src --cov-report=xml --cov-report=html

  - name: Upload coverage
    uses: codecov/codecov-action@v4
    with:
      files: ./coverage.xml
      fail_ci_if_error: true

  - name: Set up Python
    uses: actions/setup-python@v5
    with:
      python-version: ${{ env.PYTHON_VERSION }}

  - name: Install build tools
    run: pip install build

  - name: Get version
    id: version
    run: |
      VERSION=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml', 'rb'))['project']['version'])")
      echo "version=$VERSION" >> $GITHUB_OUTPUT

  - name: Build package
    run: python -m build

  - name: Upload artifacts
    uses: actions/upload-artifact@v4
    with:
      name: dist-${{ steps.version.outputs.version }}
      path: dist/
      retention-days: 5

undefined

undefined

strategy:
  fail-fast: false
  max-parallel: 4
  matrix:
    os: [ubuntu-latest, macos-latest, windows-latest]
    python-version: ['3.10', '3.11', '3.12']
    include:
      # Additional configuration for specific combinations
      - os: ubuntu-latest
        python-version: '3.12'
        coverage: true
      # Experimental Python version
      - os: ubuntu-latest
        python-version: '3.13-dev'
        experimental: true
    exclude:
      # Skip Windows + Python 3.10 (known issues)
      - os: windows-latest
        python-version: '3.10'

continue-on-error: ${{ matrix.experimental || false }}

steps:
  - uses: actions/checkout@v4

  - name: Set up Python ${{ matrix.python-version }}
    uses: actions/setup-python@v5
    with:
      python-version: ${{ matrix.python-version }}
      cache: 'pip'
      cache-dependency-path: |
        pyproject.toml
        requirements*.txt

  - name: Install dependencies (Unix)
    if: runner.os != 'Windows'
    run: |
      pip install -e ".[dev]"

  - name: Install dependencies (Windows)
    if: runner.os == 'Windows'
    run: |
      pip install -e ".[dev]"
    shell: pwsh

  - name: Run tests
    run: |
      pytest tests/ -v --tb=short
    env:
      CI: true
      PLATFORM: ${{ matrix.os }}

  - name: Run tests with coverage
    if: matrix.coverage
    run: |
      pytest tests/ -v --cov=src --cov-report=xml

  - name: Upload coverage
    if: matrix.coverage
    uses: codecov/codecov-action@v4
    with:
      files: ./coverage.xml

undefined

undefined

  # Python pip cache
  - name: Set up Python
    uses: actions/setup-python@v5
    with:
      python-version: '3.11'
      cache: 'pip'
      cache-dependency-path: |
        requirements.txt
        requirements-dev.txt

  # Node modules cache
  - name: Set up Node.js
    uses: actions/setup-node@v4
    with:
      node-version: '20'
      cache: 'npm'
      cache-dependency-path: package-lock.json

  # Custom cache for build artifacts
  - name: Cache build outputs
    uses: actions/cache@v4
    id: build-cache
    with:
      path: |
        build/
        dist/
        .pytest_cache/
      key: build-${{ runner.os }}-${{ hashFiles('src/**', 'pyproject.toml') }}
      restore-keys: |
        build-${{ runner.os }}-

  # Docker layer cache
  - name: Set up Docker Buildx
    uses: docker/setup-buildx-action@v3

  - name: Cache Docker layers
    uses: actions/cache@v4
    with:
      path: /tmp/.buildx-cache
      key: docker-${{ runner.os }}-${{ hashFiles('Dockerfile') }}
      restore-keys: |
        docker-${{ runner.os }}-

  # Rust cargo cache
  - name: Cache Cargo
    uses: actions/cache@v4
    with:
      path: |
        ~/.cargo/bin/
        ~/.cargo/registry/index/
        ~/.cargo/registry/cache/
        ~/.cargo/git/db/
        target/
      key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
      restore-keys: |
        cargo-${{ runner.os }}-

  - name: Skip build if cached
    if: steps.build-cache.outputs.cache-hit == 'true'
    run: echo "Using cached build artifacts"

  - name: Build
    if: steps.build-cache.outputs.cache-hit != 'true'
    run: |
      pip install -e ".[dev]"
      python -m build

  - name: Run tests
    run: pytest tests/ -v

undefined

undefined

steps:
  - uses: actions/checkout@v4

  - name: Build application
    run: |
      echo "Building for ${{ matrix.os }}"
      mkdir -p dist
      # Build commands here

  - name: Package (Unix)
    if: runner.os != 'Windows'
    run: |
      tar -czvf ${{ matrix.asset_name }} -C dist .

  - name: Package (Windows)
    if: runner.os == 'Windows'
    run: |
      Compress-Archive -Path dist/* -DestinationPath ${{ matrix.asset_name }}
    shell: pwsh

  - name: Upload artifact
    uses: actions/upload-artifact@v4
    with:
      name: ${{ matrix.artifact_name }}
      path: ${{ matrix.asset_name }}
      retention-days: 30
      compression-level: 9

  - name: Download all artifacts
    uses: actions/download-artifact@v4
    with:
      path: artifacts/
      merge-multiple: false

  - name: List artifacts
    run: find artifacts/ -type f

  - name: Generate changelog
    id: changelog
    run: |
      # Extract changelog for this version
      VERSION=${GITHUB_REF#refs/tags/}
      echo "version=$VERSION" >> $GITHUB_OUTPUT

      # Generate release notes
      cat << EOF > release_notes.md
      ## What's Changed

      See [CHANGELOG.md](CHANGELOG.md) for details.

      ## Assets
      - \`app-linux-x64.tar.gz\` - Linux (x64)
      - \`app-macos-x64.tar.gz\` - macOS (x64)
      - \`app-windows-x64.zip\` - Windows (x64)
      EOF

  - name: Create Release
    uses: softprops/action-gh-release@v2
    with:
      name: Release ${{ steps.changelog.outputs.version }}
      body_path: release_notes.md
      draft: false
      prerelease: ${{ contains(github.ref, 'alpha') || contains(github.ref, 'beta') }}
      files: |
        artifacts/**/*
      generate_release_notes: true

undefined

undefined

  - name: Set up Python
    uses: actions/setup-python@v5
    with:
      python-version: ${{ inputs.python-version }}
      cache: 'pip'

  - name: Install linters
    run: pip install ruff

  - name: Run ruff
    run: ruff check .

  - name: Set up Python
    uses: actions/setup-python@v5
    with:
      python-version: ${{ inputs.python-version }}
      cache: 'pip'

  - name: Install dependencies
    run: pip install -e ".[${{ inputs.install-extras }}]"

  - name: Run tests
    run: ${{ inputs.test-command }}

  - name: Run tests with coverage
    if: inputs.coverage
    run: |
      pip install pytest-cov
      pytest tests/ -v --cov=src --cov-report=xml --cov-report=term-missing

  - name: Extract coverage
    if: inputs.coverage
    id: coverage
    run: |
      COVERAGE=$(python -c "import xml.etree.ElementTree as ET; print(f\"{float(ET.parse('coverage.xml').getroot().get('line-rate')) * 100:.1f}\")")
      echo "percent=$COVERAGE" >> $GITHUB_OUTPUT

  - name: Upload coverage
    if: inputs.coverage && secrets.CODECOV_TOKEN
    uses: codecov/codecov-action@v4
    with:
      token: ${{ secrets.CODECOV_TOKEN }}
      files: ./coverage.xml

```yaml

undefined

undefined

- name: Get pip cache dir
  id: pip-cache-dir
  shell: bash
  run: echo "dir=$(pip cache dir)" >> $GITHUB_OUTPUT

- name: Cache pip
  id: pip-cache
  uses: actions/cache@v4
  with:
    path: ${{ steps.pip-cache-dir.outputs.dir }}
    key: pip-${{ runner.os }}-${{ inputs.python-version }}-${{ hashFiles('**/pyproject.toml', '**/requirements*.txt') }}
    restore-keys: |
      pip-${{ runner.os }}-${{ inputs.python-version }}-
      pip-${{ runner.os }}-

- name: Install base dependencies
  shell: bash
  working-directory: ${{ inputs.working-directory }}
  run: |
    python -m pip install --upgrade pip wheel setuptools

- name: Install project
  shell: bash
  working-directory: ${{ inputs.working-directory }}
  run: |
    if [ "${{ inputs.install-dev }}" == "true" ]; then
      pip install -e ".[dev]"
    else
      pip install -e .
    fi

```yaml

  - name: Setup Project
    uses: ./.github/actions/setup-project
    with:
      python-version: '3.11'
      install-dev: 'true'

  - name: Run tests
    run: pytest tests/ -v

undefined

undefined

  - name: Configure AWS credentials
    uses: aws-actions/configure-aws-credentials@v4
    with:
      aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      aws-region: us-east-1

  - name: Deploy to staging
    env:
      DATABASE_URL: ${{ secrets.DATABASE_URL }}
      API_KEY: ${{ secrets.API_KEY }}
      ENVIRONMENT: staging
    run: |
      echo "Deploying to staging..."
      # Deployment commands

  - name: Configure AWS credentials
    uses: aws-actions/configure-aws-credentials@v4
    with:
      aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      aws-region: us-east-1

  - name: Deploy to production
    env:
      DATABASE_URL: ${{ secrets.DATABASE_URL }}
      API_KEY: ${{ secrets.API_KEY }}
      ENVIRONMENT: production
    run: |
      echo "Deploying to production..."
      # Deployment commands

  - name: Notify on failure
    if: failure()
    uses: slackapi/slack-github-action@v1
    with:
      payload: |
        {
          "text": "Production deployment failed!",
          "blocks": [
            {
              "type": "section",
              "text": {
                "type": "mrkdwn",
                "text": "*Production Deployment Failed*\nWorkflow: ${{ github.workflow }}\nRun: ${{ github.run_id }}"
              }
            }
          ]
        }
    env:
      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

undefined

undefined

steps:
  - name: Checkout
    uses: actions/checkout@v4

  - name: Set up QEMU
    uses: docker/setup-qemu-action@v3

  - name: Set up Docker Buildx
    uses: docker/setup-buildx-action@v3

  - name: Login to Container Registry
    if: github.event_name != 'pull_request'
    uses: docker/login-action@v3
    with:
      registry: ${{ env.REGISTRY }}
      username: ${{ github.actor }}
      password: ${{ secrets.GITHUB_TOKEN }}

  - name: Extract metadata
    id: meta
    uses: docker/metadata-action@v5
    with:
      images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
      tags: |
        type=ref,event=branch
        type=ref,event=pr
        type=semver,pattern={{version}}
        type=semver,pattern={{major}}.{{minor}}
        type=semver,pattern={{major}}
        type=sha,prefix=

  - name: Build and push
    uses: docker/build-push-action@v5
    with:
      context: .
      platforms: linux/amd64,linux/arm64
      push: ${{ github.event_name != 'pull_request' }}
      tags: ${{ steps.meta.outputs.tags }}
      labels: ${{ steps.meta.outputs.labels }}
      cache-from: type=gha
      cache-to: type=gha,mode=max
      build-args: |
        VERSION=${{ github.ref_name }}
        BUILD_DATE=${{ github.event.head_commit.timestamp }}

  - name: Sign image
    if: github.event_name != 'pull_request'
    uses: sigstore/cosign-installer@v3

  - name: Sign container image
    if: github.event_name != 'pull_request'
    run: |
      cosign sign --yes ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build-and-push.outputs.digest }}

undefined

undefined

  - name: Set up Python
    uses: actions/setup-python@v5
    with:
      python-version: '3.11'

  - name: Update dependencies
    run: |
      pip install pip-tools
      pip-compile --upgrade requirements.in -o requirements.txt
      pip-compile --upgrade requirements-dev.in -o requirements-dev.txt

  - name: Create PR if changes
    uses: peter-evans/create-pull-request@v6
    with:
      token: ${{ secrets.GITHUB_TOKEN }}
      commit-message: 'chore(deps): update dependencies'
      title: 'chore(deps): Weekly dependency update'
      body: |
        Automated weekly dependency update.

        Please review the changes and merge if CI passes.
      branch: deps/weekly-update
      delete-branch: true
      labels: dependencies,automated

  - name: Run Trivy vulnerability scanner
    uses: aquasecurity/trivy-action@master
    with:
      scan-type: 'fs'
      ignore-unfixed: true
      format: 'sarif'
      output: 'trivy-results.sarif'
      severity: 'CRITICAL,HIGH'

  - name: Upload Trivy scan results
    uses: github/codeql-action/upload-sarif@v3
    with:
      sarif_file: 'trivy-results.sarif'

  - name: Python safety check
    run: |
      pip install safety
      safety check --full-report || true

undefined

undefined

  - name: Check PR title
    uses: amannn/action-semantic-pull-request@v5
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    with:
      types: |
        feat
        fix
        docs
        style
        refactor
        perf
        test
        build
        ci
        chore
        revert
      requireScope: false
      subjectPattern: ^.{1,50}$
      subjectPatternError: |
        PR title must be 50 characters or less

  - name: Check for breaking changes
    if: contains(github.event.pull_request.title, '!')
    run: |
      echo "::warning::This PR contains breaking changes"

  - name: Add size labels
    uses: codelytv/pr-size-labeler@v1
    with:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      xs_label: 'size/xs'
      xs_max_size: 10
      s_label: 'size/s'
      s_max_size: 100
      m_label: 'size/m'
      m_max_size: 500
      l_label: 'size/l'
      l_max_size: 1000
      xl_label: 'size/xl'
      fail_if_xl: false
      message_if_xl: |
        This PR is very large. Please consider breaking it into smaller PRs.

undefined

undefined

undefined

undefined

  - name: Configure AWS credentials (OIDC)
    uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
      aws-region: us-east-1

  - name: Setup Python
    uses: actions/setup-python@v5
    with:
      python-version: '3.11'

  - name: Install SAM CLI
    run: pip install aws-sam-cli

  - name: Build
    run: sam build

  - name: Deploy
    run: |
      sam deploy \
        --no-confirm-changeset \
        --no-fail-on-empty-changeset \
        --stack-name my-app \
        --capabilities CAPABILITY_IAM \
        --parameter-overrides Environment=production

undefined

undefined

undefined

undefined

undefined

undefined

undefined

undefined

undefined

undefined

**Issue: Cache not restoring**
```yaml

**Issue: Secrets not available**
```yaml

**Issue: Permission denied**
```yaml

undefined

undefined

undefined