_quality-python.yml

# SPDX-License-Identifier: Apache-2.0
# Copyright 2022 The HuggingFace Authors.

name: Check Python code quality
on:
  workflow_call:
    inputs:
      working-directory:
        required: true
        type: string
env:
  # required to get access to use a cached poetry venv in "/home/runner/.cache/pypoetry/virtualenvs"
  POETRY_VIRTUALENVS_IN_PROJECT: false
  python-version: "3.9.15"
  poetry-version: "1.4.2"
jobs:
  code-quality:
    defaults:
      run:
        shell: bash
        working-directory: ${{ inputs.working-directory }}
    runs-on: "ubuntu-latest"
    steps:
      - uses: actions/checkout@v3
      - name: Install poetry
        run: pipx install poetry==${{ env.poetry-version }}
      - name: Use Python
        uses: actions/setup-python@v4
        with:
          python-version: ${{ env.python-version }}
          cache: "poetry"
          cache-dependency-path: |
            ${{ inputs.working-directory }}/poetry.lock
      - name: Install packages
        run: sudo apt update; sudo apt install -y libicu-dev ffmpeg libavcodec-extra libsndfile1 llvm pkg-config poppler-utils
      - name: Install dependencies
        # "poetry env use" is required: https://github.com/actions/setup-python/issues/374#issuecomment-1088938718
        run: |
          poetry env use "${{ env.python-version }}"
          poetry install
      - name: Run black
        run: poetry run black --check tests src
      - name: Run isort
        run: poetry run isort --check-only tests src
      - name: Run flake8
        run: poetry run flake8 tests src
      - name: Run mypy
        run: poetry run mypy tests src
      - name: Run bandit
        run: poetry run bandit -r src
      - name: Run pip-audit
        run: bash -c "poetry run pip-audit -r <(poetry export -f requirements.txt --with dev | sed '/^kenlm @/d' | sed '/^torch @/d' | sed '/^libapi @/d' | sed '/^libcommon @/d' | sed '/^trec-car-tools @/d' | sed 's/^huggingface-hub @ git.*/huggingface-hub==0.15.1 ; python_full_version == \"3.9.15\" --hash=sha256:05b0fb0abbf1f625dfee864648ac3049fe225ac4371c7bafaca0c2d3a2f83445 --hash=sha256:a61b7d1a7769fe10119e730277c72ab99d95c48d86a3d6da3e9f3d0f632a4081/')"