FLIP/.github/workflows/test_trust_kit_scripts.yml at develop · londonaicentre/FLIP · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
# Copyright (c) 2026 Guy's and St Thomas' NHS Foundation Trust & King's College London
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# scripts/tests/ had no CI job at all, so its assertions — including the one proving a kit file is
# restricted to 0600 *before* the trust credentials are written into it (FLIP#889) — only ran when
# someone remembered to run them by hand. Every file in that directory is stdlib-only, needs no
# services and shares the same `if __name__ == "__main__": main()` contract, so the whole directory
# runs here rather than one named file: a new script test is then covered by existing there.

name: Trust kit scripts

on:
  push:
    branches: [develop]
    paths:
      - "scripts/**"
      - "trust/deploy/scripts/**"
      - ".github/workflows/test_trust_kit_scripts.yml"
      # Some guards here assert on files outside scripts/ — test_container_identity.py
      # on the compose files, test_workflow_trust_guards.py on the image-build
      # workflows, test_pr_paths_changed.py on the gated service workflows and the
      # path gate itself — so those paths trigger the push run too, or a guard
      # silently never runs on the very edit it exists to catch (FLIP#1171 was
      # reintroduced once that way). pull_request below is deliberately unfiltered:
      # every develop-targeted PR runs this ~1s job, which removes the trap entirely
      # where it matters and needs no path list to keep in step with the guards. That
      # stays true now the service suites are themselves path-gated on PRs into
      # develop (FLIP#1223) — this workflow is not gated, and must not be, because it
      # is where those gates are checked.
      - ".github/workflows/test_*.yml"
      - ".github/workflows/pr_paths_changed.yml"
      - "deploy/compose*.yml"
      - "trust/deploy/compose/*.yml"
      - "fl-services/nvflare/compose.dev.yml"
      # test_flower_runtime_install.py asserts on the Flower composes, the Helm chart and the FL
      # images' Dockerfiles (FLIP#1418).
      - "fl-services/flower/compose*.yml"
      # test_fl_kit_edge_port.py asserts on the FLARE provisioning templates (FLIP#1365).
      - "fl-services/nvflare/provision/net-*_project_*.yml"
      - "fl-services/flower/*/Dockerfile"
      - "trust/deploy/helm/templates/**"
      - "trust/deploy/helm/values*.yaml"
      # test_secret_scanning_gate.py asserts on the secret-scanning workflow, the
      # pre-commit pin and the baseline (FLIP#1215) — same trap, same fix.
      - ".github/workflows/secret-scanning.yml"
      - ".pre-commit-config.yaml"
      - ".secrets.baseline"
      # test_compose_env_coverage.py asserts the dev composes against the env example (FLIP#1230).
      - ".env.development.example"
      - "deploy/env_mode.mk"
      - "deploy/fl_backend.mk"
      - ".github/workflows/docker_build_*.yml"
      - ".github/workflows/fl-docker-build-*.yml"
      - ".github/workflows/release.yml"
      - ".github/actions/**"
      - ".github/tests/**"
      - "tests/**"
      - "Makefile"
      - "flip-api/Makefile"
      - "trust/Makefile"
      - "trust/xnat/Makefile"
      - "deploy/portable.mk"
  pull_request:
    branches: [develop]

permissions:
  contents: read

jobs:
  test-trust-kit-lib:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      # test_sync_trust_kit.py drives sync_trust_kit.py through `uv run --no-config` and hard-exits
      # (rather than skipping) when uv is absent, so the runner needs it even though the tests
      # themselves are stdlib-only.
      - name: Install uv
        run: pip install uv
      # scripts/tests/ and trust/deploy/scripts/tests/, plus the repo-level trees that mirror what
      # they test: tests/ for the root Makefile, .github/tests/ for the workflows and actions. All
      # stdlib-only.
      - name: Run scripts/, trust/deploy/scripts/, tests/ and .github/tests/
        run: |
          for test_file in scripts/tests/test_*.py trust/deploy/scripts/tests/test_*.py tests/test_*.py $(find .github/tests -name 'test_*.py' | sort); do
            echo "== $test_file"
            python "$test_file" || exit 1
          done