Skip to content

ci: test the Python event source - #241

Open
ryanduguid wants to merge 4 commits into
XeroAPI:masterfrom
ryanduguid:agent/test-python-event-source
Open

ci: test the Python event source#241
ryanduguid wants to merge 4 commits into
XeroAPI:masterfrom
ryanduguid:agent/test-python-event-source

Conversation

@ryanduguid

@ryanduguid ryanduguid commented Aug 12, 2026

Copy link
Copy Markdown

Summary

  • run on pull requests and test the event source instead of checking out upstream master
  • test the declared Python 3.8 floor, 3.12 and 3.13 ceiling with pinned, read-only actions and bounded runtime
  • replace manual virtualenv/sudo installs with the configured Python environment and pip check
  • run a runtime dependency audit and build the PEP 517 package on Python 3.13
  • pin Node 24.18 and Prism 5.16.0, then wait for all nine mock ports instead of sleeping for a fixed interval
  • pin all nine mock inputs to reviewed Xero-OpenAPI commit ee65f8bddb16f37cde3e32741d465eeed6507a74; update that SHA deliberately when the test contract changes
  • keep linting focused on fatal Python errors rather than trying to reformat hundreds of generated files in CI
  • clean up Prism even when setup or tests fail
  • cancel superseded runs for the same pull request to avoid overlapping nine-process mock suites

Validation

  • actionlint .github/workflows/build-test-lint.yml
  • static assertions that the OpenAPI ref is a full commit SHA, the mock script rejects branch refs and the build runs on Python 3.13
  • python -m pip check
  • python -m pip_audit -r requirements.txt — no known vulnerabilities
  • python -m flake8 --select E9,F63,F7,F82 xero_python
  • python -m build
  • all nine Prism mocks reached ready state locally with Prism 5.16.0
  • 167 of 168 tests passed on Windows; one existing pre-epoch datetime.timestamp() portability failure was isolated and will be proposed separately

The CI audit tool is pinned to pip-audit 2.10.1. Other dependencies, including the CI-only build tool, retain the repository's existing open requirement policy; this workflow is therefore not a hermetic dependency build and does not introduce a lock policy. The authoritative result for the Linux Python 3.8/3.12/3.13 matrix is this pull request's exact-head Actions run. The pull request remains a draft until those hosted checks finish.

@ryanduguid
ryanduguid marked this pull request as ready for review August 18, 2026 15:06
start-prism.sh ended with a non-backgrounded prism mock, so invoking it in
the foreground never returned. Every push and PR sat on the Start Prism step
until the 25 minute job timeout, which meant the readiness loop and pytest
never ran. Background the last mock so the script returns once all nine are
spawned and the readiness loop is what gates the Test step.

pip-audit 2.10.1 declares Requires-Python >=3.10, so the 3.8 leg died while
installing requirements/dev.txt. Gate it with an environment marker and run
the audit once on the newest leg, since auditing requirements.txt does not
vary by interpreter.

Restore flake8-black so black checking comes back for every consumer of
requirements/flake8.txt, including tox -e flake8, and drop the --select that
was overriding the [flake8] section in setup.cfg. Pin black, because an
unpinned black now reports 543 BLK100 findings against generated code on
master and would make the restored gate unusable. Reformat the two test
files that were genuinely misformatted so the full gate passes.

Widen the matrix to the declared support range; setup.py and tox move to the
same range in the runtime policy branch.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant