build: Add new python CI checks

.envrc

@@ -11,3 +11,6 @@ if [[ "$(which pyenv)" == "" ]]; then
 else
     layout pyenv "${PY_VERS}"
 fi
+
+pip install --upgrade pre-commit &>/dev/null
+pre-commit install -c ./.pre-commit-config.yaml &>/dev/null

.github/workflows/check-for-dnm-label.yml

@@ -1,10 +1,11 @@
-name: Check for blocking labels
+name: Label check
 
 on:
   pull_request:
 
 jobs:
   fail-if-blocked:
+    name: do-not-merge
     runs-on: ubuntu-latest
     permissions:
       pull-requests: read

.github/workflows/detect-secrets.yml

@@ -4,7 +4,7 @@ on: push
 
 jobs:
   detect-secrets:
-    name: Check for secrets
+    name: scan+audit
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo

.github/workflows/ensure-version-changed.yml

@@ -1,12 +1,12 @@
-name: Ensure VERSION file bumped
+name: VERSION bump
 
 on:
   pull_request:
 
 jobs:
   changed_files:
     runs-on: ubuntu-latest
-    name: Ensure VERSION file has been updated
+    name: validate
     steps:
       - uses: actions/checkout@v4
         with:

.github/workflows/python-validate.yml

@@ -1,9 +1,28 @@
-name: Python validation
+name: Code
 
 on: push
 
 jobs:
+  mypy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+        with:
+          submodules: true
+          fetch-depth: 0
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: make
+        shell: bash
+        run: |
+          sudo apt-get update &>/dev/null
+          sudo apt-get install -yq direnv make &>/dev/null
+          direnv allow . && eval "$(direnv export bash)"
+          make type-check
   lint:
+    name: lint
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
@@ -21,3 +40,42 @@ jobs:
           sudo apt-get install -yq direnv make &>/dev/null
           direnv allow . && eval "$(direnv export bash)"
           make lint
+  test-unit:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+        with:
+          submodules: true
+          fetch-depth: 0
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: make
+        shell: bash
+        run: |
+          sudo apt-get update &>/dev/null
+          sudo apt-get install -yq direnv make git &>/dev/null
+          direnv allow . && eval "$(direnv export bash)"
+          make test-unit
+  test-integration:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+        with:
+          submodules: true
+          fetch-depth: 0
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: make
+        shell: bash
+        run: |
+          sudo apt-get update &>/dev/null
+          sudo apt-get install -yq direnv make git &>/dev/null
+          git config --global init.defaultBranch main
+          git config --global user.email urmom@fake.com
+          git config --global user.name "Your mom"
+          direnv allow . && eval "$(direnv export bash)"
+          make test-integration

.github/workflows/validate-pr-title.yml

@@ -1,4 +1,4 @@
-name: "Enforce conventional commit PR title"
+name: "Conventional commit PR title"
 
 on:
   pull_request_target:
@@ -9,7 +9,7 @@ permissions:
 
 jobs:
   validate-pr-title:
-    name: Validate PR title conformity to conventional commit
+    name: validate
     runs-on: ubuntu-latest
     steps:
       - uses: amannn/action-semantic-pull-request@v5

.gitmodules

@@ -1,4 +1,4 @@
 [submodule "plox-common"]
 	path = plox-common
 	url = ../plox-common
-	branch = plox-py-common
+	branch = add-more-python-ci-checks-common

.pre-commit-config.yaml

@@ -1,6 +1,5 @@
 repos:
 - repo: https://github.com/astral-sh/ruff-pre-commit
-  # Ruff version.
   rev: v0.6.2
   hooks:
     # Run the linter.
@@ -16,3 +15,11 @@ repos:
   hooks:
     - id: detect-secrets # pragma: whitelist secret
       args: [--baseline, .secrets.baseline, --use-all-plugins]
+
+-   repo: https://github.com/pre-commit/mirrors-mypy
+    rev: v1.11.2
+    hooks:
+    -   id: mypy
+        exclude: "test/.*|plox-common/.*"
+        args: ["--config-file", "mypy.ini"]
+        additional_dependencies: []

.secrets.baseline

@@ -1,9 +1,9 @@
 {
   "exclude": {
-    "files": "^.secrets.baseline$",
+    "files": "^poetry.lock$|^.secrets.baseline$",
     "lines": null
   },
-  "generated_at": "2024-08-22T21:30:37Z",
+  "generated_at": "2024-08-30T16:25:58Z",
   "plugins_used": [
     {
       "name": "AWSKeyDetector"
@@ -76,26 +76,7 @@
       "name": "TwilioKeyDetector"
     }
   ],
-  "results": {
-    "poetry.lock": [
-      {
-        "hashed_secret": "0ef1dfd3b0d0bda2103888bb3e7e16ae31e96fed",
-        "is_secret": false,
-        "is_verified": false,
-        "line_number": 361,
-        "type": "Hex High Entropy String",
-        "verified_result": null
-      },
-      {
-        "hashed_secret": "12af8138d8b0643b77a928e7f4a7d0142ee22734",
-        "is_secret": false,
-        "is_verified": false,
-        "line_number": 829,
-        "type": "Hex High Entropy String",
-        "verified_result": null
-      }
-    ]
-  },
+  "results": {},
   "version": "0.13.1+ibm.62.dss",
   "word_list": {
     "file": null,

DEVELOPMENT.md

@@ -0,0 +1,90 @@
+# Plox python development guidelines
+
+## Common python project pattern requirements
+
+1. [`direnv`](https://github.com/direnv/direnv/blob/master/docs/installation.md)
+2. Python and `pip`. Download via w.e package manger you want/use, or via distributed download packages: [see here](https://www.python.org/downloads/)
+    * `pre-commit` installed via `pip install --upgrade pre-commit`
+3. GNU utils (`make`, `sed`, `find`, etc.)
+
+> [!WARNING]
+> `sed` shipped with macOS by default _is not_ the same as GNU sed!!! Be sure to install
+> the GNU coreutils/make/sed etc and then that they occur earlier appropriately in your
+> system's `$PATH`.
+
+## 0. Get project
+
+```bash
+git clone --recurse-submodules <git URL ...>
+
+cd <project_repo>
+```
+
+## 1. Configured direnv managed project based venv
+
+```bash
+cd <project_repo>
+
+direnv allow .
+```
+
+To validate, run
+
+```bash
+which python
+```
+
+and be sure that the Python it points to is based under a `.direnv/` folder in the current
+project's directory.
+
+## 2. Install project's deps
+
+```bash
+make install-deps
+```
+
+## 3. Validate pre-commit hooks
+
+```bash
+pre-commit run --all-files
+```
+
+## 4. Do development
+
+Do your work.
+
+## 5. Update secrets baseline
+
+```bash
+detect-secrets scan --update .secrets.baseline  .
+detect-secrets audit .secrets.baseline
+```
+
+Work through the interactive menu answering the prompts as appropriate.
+
+Them,
+
+```bash
+git add .secrets.baseline
+```
+
+
+## 5. Ensure code conformity
+
+```bash
+pre-commit run --all-files
+```
+
+Iterate and fix any issues that may arise.
+
+## 6. Push code to branch, open PR
+
+```bash
+git checkout -b my-feature-branch
+git add <files>
+git commit -m "<type>: <description>"
+git push -u origin my-feature-branch
+```
+
+Navigate to github.com and open a pull request. Make the title the same as the initial
+conventional commit that was first pushed.

README.md

@@ -3,3 +3,7 @@
 Available in test PyPI:
 
 https://test.pypi.org/project/plox-version/
+
+## Developing
+
+See: [DEVELOPMENT.md](./DEVELOPMENT.md)

VERSION

@@ -1 +1 @@
-0.4.1
+0.4.2