validate_deps.yml

name: Validate all Python dependencies work together
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
    types: [opened, synchronize]
    paths-ignore:
      - '**/*.md'
      - '*.md'

permissions: {}

defaults:
  run:
    shell: bash

jobs:
  model-signing:
    name: Test model signing dependencies
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false # Don't cancel other jobs if one fails
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        include:
          - os: macos-latest
            os_family: Darwin
          - os: ubuntu-latest
            os_family: Linux
          - os: windows-latest
            os_family: Windows
    steps:
    - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
    - uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
      with:
        python-version: 3.11
        cache: pip
        cache-dependency-path: model_signing/install/requirements_${{ matrix.os_family }}.txt
    - name: Install dependencies
      run: |
        set -exuo pipefail
        python -m venv venv
        .github/workflows/scripts/venv_activate.sh
        python -m pip install --require-hashes -r model_signing/install/requirements_${{ matrix.os_family }}.txt

  slsa-for-ml:
    name: Test SLSA for ML demo dependencies
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false # Don't cancel other jobs if one fails
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        include:
          - os: macos-latest
            os_family: Darwin
          - os: ubuntu-latest
            os_family: Linux
          - os: windows-latest
            os_family: Windows
    steps:
    - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
    - uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
      with:
        python-version: 3.11
        cache: pip
        cache-dependency-path: slsa_for_models/install/requirements_${{ matrix.os_family }}.txt
    - name: Install dependencies
      run: |
        set -exuo pipefail
        python -m venv venv
        .github/workflows/scripts/venv_activate.sh
        python -m pip install --require-hashes -r slsa_for_models/install/requirements_${{ matrix.os_family }}.txt