Fix workflows context

.github/actions/pyenv/action.yml

@@ -16,6 +16,11 @@ inputs:
  description: 'Requirements-files to use for building the cache key'
  required: false
 
+ custom_cache_key_element:
+ default: ${{github.ref_name}}
+ description: 'Custom element that will be used when constructing the cache key'
+ required: false
+
 outputs:
  virtualenv-directory:
  description: 'The path to the restored or created virtualenv'
@@ -33,11 +38,16 @@ runs:
  id: cache-virtualenv
  with:
  requirement_files: ${{inputs.requirements-key}}
- custom_cache_key_element: ${{github.ref_name}}:${{inputs.requirements}}
+ custom_cache_key_element: ${{inputs.custom_cache_key_element}}:${{inputs.requirements}}
 
  - name: Install pip dependencies
  if: steps.cache-virtualenv.outputs.cache-hit != 'true'
  shell: bash
  run: |
  python -m pip install --upgrade pip
  pip install -r ${{inputs.requirements}}
+
+ - name: Print installed packages
+ shell: bash
+ run: |
+ pip list

.github/workflows/!PR.yml

@@ -11,25 +11,17 @@ on:
 jobs:
  env: # setup shared env
  runs-on: ubuntu-latest
- env:
- # https://github.com/actions/runner-images#available-images
- WINDOWS_IMAGE: windows-latest
- MACOS_IMAGE: macos-latest
- UBUNTU_IMAGE: ubuntu-latest
-
+ permissions: { }
  outputs:
  python-version: '3.8'
- matrix-for-draft: '{"os": ["${{env.WINDOWS_IMAGE}}"]}'
- matrix-for-ready: '{"os": ["${{env.UBUNTU_IMAGE}}", "${{env.MACOS_IMAGE}}"]}'
- windows-image: ${{env.WINDOWS_IMAGE}}
- ubuntu-image: ${{env.UBUNTU_IMAGE}}
- macos-image: ${{env.MACOS_IMAGE}}
-
+ source-ref: refs/pull/${{github.event.pull_request.number}}/merge
  steps:
- - run: echo successfully
+ - run: echo done
 
  changes: # detect changes
  runs-on: ubuntu-latest
+ permissions:
+ contents: read
  outputs:
  src: ${{ steps.filter.outputs.src }}
  scripts: ${{ steps.filter.outputs.scripts }}
@@ -68,6 +60,7 @@ jobs:
 
  gatekeeper: # check user's permissions
  runs-on: ubuntu-latest
+ permissions: read-all
  steps:
  - name: Check if PR has label
  id: label_check
@@ -87,15 +80,16 @@ jobs:
 
  # ----------------------------------------------------------------------------
  # PR stage: Draft
- pytest:
+ coverage:
  needs: [ changes, gatekeeper, env ]
  if: ${{ needs.changes.outputs.src == 'true' }}
- uses: ./.github/workflows/pytest.yml
+ uses: ./.github/workflows/coverage.yml
  secrets:
  PYTEST_SENTRY_DSN: ${{secrets.PYTEST_SENTRY_DSN}}
+ CODACY_PROJECT_TOKEN: ${{secrets.CODACY_PROJECT_TOKEN}}
  with:
  python-version: ${{needs.env.outputs.python-version}}
- matrix: ${{needs.env.outputs.matrix-for-draft}}
+ ref: ${{needs.env.outputs.source-ref}}
 
  guitest:
  needs: [ changes, gatekeeper, env ]
@@ -105,36 +99,30 @@ jobs:
  PYTEST_SENTRY_DSN: ${{secrets.PYTEST_SENTRY_DSN}}
  with:
  python-version: ${{needs.env.outputs.python-version}}
- matrix: ${{needs.env.outputs.matrix-for-draft}}
+ matrix: '{"os": ["windows-latest"]}'
+ ref: ${{needs.env.outputs.source-ref}}
 
  scripttest:
  needs: [ changes, env ]
  if: ${{ needs.changes.outputs.scripts == 'true' }}
  uses: ./.github/workflows/scripttest.yml
  with:
  python-version: ${{needs.env.outputs.python-version}}
+ ref: ${{needs.env.outputs.source-ref}}
 
- coverage:
- needs: [ changes, gatekeeper, env ]
- if: ${{ needs.changes.outputs.src == 'true' }}
- uses: ./.github/workflows/coverage.yml
- secrets:
- PYTEST_SENTRY_DSN: ${{secrets.PYTEST_SENTRY_DSN}}
- CODACY_PROJECT_TOKEN: ${{secrets.CODACY_PROJECT_TOKEN}}
- with:
- python-version: ${{needs.env.outputs.python-version}}
 
  # ----------------------------------------------------------------------------
  # PR stage: Ready
- pytest_nix:
+ pytest:
  needs: [ changes, gatekeeper, env ]
  if: ${{needs.changes.outputs.src == 'true' && !github.event.pull_request.draft}}
  uses: ./.github/workflows/pytest.yml
  secrets:
  PYTEST_SENTRY_DSN: ${{secrets.PYTEST_SENTRY_DSN}}
  with:
  python-version: ${{needs.env.outputs.python-version}}
- matrix: ${{needs.env.outputs.matrix-for-ready}}
+ matrix: '{"os": ["windows-latest", "macos-latest"]}'
+ ref: ${{needs.env.outputs.source-ref}}
 
  guitest_nix:
  needs: [ changes, gatekeeper, env ]
@@ -144,7 +132,8 @@ jobs:
  PYTEST_SENTRY_DSN: ${{secrets.PYTEST_SENTRY_DSN}}
  with:
  python-version: ${{needs.env.outputs.python-version}}
- matrix: ${{needs.env.outputs.matrix-for-ready}}
+ matrix: '{"os": ["ubuntu-latest", "macos-latest"]}'
+ ref: ${{needs.env.outputs.source-ref}}
 
  # build binaries
  ubuntu:
@@ -155,6 +144,7 @@ jobs:
  upload: false
  os: ${{needs.env.outputs.ubuntu-image}}
  python-version: ${{needs.env.outputs.python-version}}
+ ref: ${{needs.env.outputs.source-ref}}
 
  windows:
  needs: [ changes, env ]
@@ -164,6 +154,7 @@ jobs:
  upload: false
  os: ${{needs.env.outputs.windows-image}}
  python-version: ${{needs.env.outputs.python-version}}
+ ref: ${{needs.env.outputs.source-ref}}
 
  # check documentation build
  documentation:
@@ -172,3 +163,4 @@ jobs:
  uses: ./.github/workflows/documentation.yml
  with:
  python-version: ${{needs.env.outputs.python-version}}
+ ref: ${{needs.env.outputs.source-ref}}

.github/workflows/build_mac.yml

@@ -18,6 +18,10 @@ on:
  type: boolean
  required: false
 
+ ref:
+ type: string
+ required: true
+
  workflow_dispatch:
  inputs:
  os:
@@ -38,14 +42,17 @@ on:
  type: boolean
  required: true
 
+permissions:
+ contents: read
+
 jobs:
  build:
  runs-on: ${{ github.event.inputs.os || inputs.os }}
  steps:
  - uses: actions/checkout@v3
  with:
  fetch-depth: 0
- ref: ${{github.event.pull_request.head.sha}}
+ ref: ${{inputs.ref}}
 
  - uses: actions/setup-python@v4
  with:

.github/workflows/build_ubuntu.yml

@@ -17,6 +17,11 @@ on:
  default: false
  type: boolean
  required: false
+
+ ref:
+ type: string
+ required: true
+
  secrets:
  SENTRY_URL:
  required: false
@@ -41,21 +46,25 @@ on:
  type: boolean
  required: true
 
+permissions:
+ contents: read
+
 jobs:
  build:
  runs-on: ${{ github.event.inputs.os || inputs.os }}
  steps:
  - uses: actions/checkout@v3
  with:
  fetch-depth: 0
- ref: ${{github.event.pull_request.head.sha}}
+ ref: ${{inputs.ref}}
 
  - name: Create python environment
  id: pyenv
  uses: ./.github/actions/pyenv
  with:
  python-version: ${{ github.event.inputs.python-version || inputs.python-version }}
  requirements: requirements-build.txt
+ custom_cache_key_element: ${{inputs.ref || github.ref_name}}
 
  - uses: ./.github/actions/save_git_info
 

.github/workflows/build_windows.yml

@@ -18,6 +18,10 @@ on:
  type: boolean
  required: false
 
+ ref:
+ type: string
+ required: true
+
  workflow_dispatch:
  inputs:
  os:
@@ -38,6 +42,9 @@ on:
  type: boolean
  required: true
 
+permissions:
+ contents: read
+
 jobs:
  build:
  runs-on: ${{ github.event.inputs.os || inputs.os }}
@@ -46,7 +53,7 @@ jobs:
  - uses: actions/checkout@v3
  with:
  fetch-depth: 0
- ref: ${{github.event.pull_request.head.sha}}
+ ref: ${{inputs.ref}}
 
  - name: Modify PATH
  run: |

.github/workflows/codacy.yml

@@ -5,6 +5,10 @@ on:
  secrets:
  CODACY_PROJECT_TOKEN:
  required: true
+
+permissions:
+ contents: read
+
 jobs:
  analyse:
  runs-on: ubuntu-latest

.github/workflows/coverage.yml

@@ -7,12 +7,20 @@ on:
  default: 3.8
  type: string
  required: false
+
+ ref:
+ type: string
+ required: true
+
  secrets:
  CODACY_PROJECT_TOKEN:
  required: false
  PYTEST_SENTRY_DSN:
  required: false
 
+permissions:
+ contents: read
+
 jobs:
  generate_and_upload:
  name: generate and upload
@@ -23,12 +31,15 @@ jobs:
 
  steps:
  - uses: actions/checkout@v3
+ with:
+ ref: ${{inputs.ref}}
 
  - name: Create python environment
  uses: ./.github/actions/pyenv
  with:
  python-version: ${{inputs.python-version}}
  requirements: requirements-test.txt
+ custom_cache_key_element: ${{inputs.ref}}
 
  - name: Export env
  uses: cardinalby/export-env-action@v2

.github/workflows/documentation.yml

@@ -8,18 +8,28 @@ on:
  type: string
  required: false
 
+ ref:
+ type: string
+ required: true
+
+permissions:
+ contents: read
+
 jobs:
  build:
  runs-on: ubuntu-latest
  steps:
  - uses: actions/checkout@v3
+ with:
+ ref: ${{inputs.ref}}
 
  - name: Create python environment
  uses: ./.github/actions/pyenv
  with:
  python-version: ${{inputs.python-version}}
  requirements: ./doc/requirements.txt
  requirements-key: ./doc/requirements*.txt
+ custom_cache_key_element: ${{inputs.ref}}
 
  - name: Build documentation
  run: |

.github/workflows/guitest.yml

@@ -18,10 +18,17 @@ on:
  type: boolean
  required: false
 
+ ref:
+ type: string
+ required: true
+
  secrets:
  PYTEST_SENTRY_DSN:
  required: false
 
+permissions:
+ contents: read
+
 jobs:
  run:
  runs-on: ${{ matrix.os }}
@@ -40,12 +47,15 @@ jobs:
 
  steps:
  - uses: actions/checkout@v3
+ with:
+ ref: ${{inputs.ref}}
 
  - name: Create python environment
  uses: ./.github/actions/pyenv
  with:
  python-version: ${{inputs.python-version}}
  requirements: requirements-test.txt
+ custom_cache_key_element: ${{inputs.ref}}
 
  - name: Install dependencies (Win)
  if: runner.os == 'Windows'