Continuous integration

GitHub Actions for lint, Python 3.10–3.13 tests, package build, Docker api+cli smoke, and VS Code extension.

This page

Continuous integration

Abstract

CI is the public invariant check for the pyne repo after AXIS extraction. Workflows live under .github/workflows/. AXIS PWA/e2e CI lives in the sister axis repo — not here.

Workflow filename:Role
ci.ymlCILint, test matrix, package, Docker api+cli, VSIX
release.ymlBuild & ReleaseTag v* + dispatch: wheels, CLI/LSP Nuitka binaries, CLI image tarball, VSIX, GitHub Release
publish.ymlPublishTag v* + dispatch: PyPI hoox-pyne (token or OIDC)
ghcr.ymlGHCRTag v* + dispatch: ghcr.io/hoox-sh/pyne/{api,cli,lsp} multi-arch
docs-versions.ymlDocs versionsDaily: refresh PyPI / npm / Open VSX / GitHub release stamps. Commits only on change. No docs pageload.

Conceptual model

Diagram

Rendering…

Interface surface

Triggers

WorkflowOnPurpose
CIpush/PR to mainRequired confidence
Build & Releasetags v* + dispatchBinaries + VSIX + GitHub Release
Publishtags v* + dispatch (dry_run default true)PyPI hoox-pyne
GHCRtags v* + dispatchPublic images api / cli / lsp

ci.yml jobs (current)

JobRuntimeWhat it asserts
lintPython 3.13Ruff E/F/W gate on src/ tests/ (+ auth middleware); mypy non-blocking
testMatrix 3.10–3.13.[lsp,pro,compile] + backend deps; core (test_linter / test_evaluator / test_cli); runtime (parity, strategy, series, incremental TA, package Runtime); LSP (test_langserver + test_lsp_features); backend; Codecov on 3.13
package3.13python -m build + twine; wheel smoke (pynescript --help); artifact
dockerbuildxBuild api + cli targets; API health + admin fail-closed; CLI --help / info / check (--network=none)
vscode-ext-testNode 22npm ci → compile → vsce package → VSIX artifact

Concurrency: group: ci-${{ github.ref }}, cancel-in-progress: true. Default permissions: contents: read.

Not in this repo’s CI

  • AXIS PWA / Playwright (axis repo — no axis-nightly.yml here)
  • GHCR push (separate ghcr.yml, tag-triggered)
  • Cloudflare Worker deploy
  • Full tests/ corpus parametrized suite (run locally: make test)

Internals

PathRole
.github/workflows/ci.ymlPR/main fan-out (name: CI)
.github/workflows/release.ymlMulti-artifact tag release (name: Build & Release)
.github/workflows/publish.ymlPyPI (token preferred) (name: Publish)
.github/workflows/ghcr.ymlMulti-arch image push (name: GHCR)
tests/test_cli.pyCLI unit suite (CI-critical)

Secrets

SecretUsed byNotes
PYPI_API_TOKENpublish.ymlPersonal PyPI account (jango-blockchained)
METADATA_KEY / CRYPTO_KEYrelease.yml LSP encryptFernet metadata
VSCE_PAToptional MarketplaceVSIX still attaches without it
GITHUB_TOKENrelease uploaddefault

Invariants

  1. Fail-fast is off on the Python matrix.
  2. Codecov only on 3.13.
  3. CLI Docker image is non-root — smoke mounts must be world-readable (chmod on mktemp).
  4. Corpus parametrized tests are intentionally skipped in CI for time; local make test is broader.
  5. Package smoke installs the wheel and runs pynescript --help.

Worked examples

# Lint as CI (correctness gate)
ruff check src/ tests/ backend/middleware/auth.py --select E,F,W --ignore E501,E741,F841,W293,E402

# Core unit slice
pip install -e ".[lsp,pro,compile]"
python -m pytest tests/test_linter.py tests/test_evaluator.py tests/test_cli.py -q

# Docker CLI smoke
docker buildx bake cli
docker run --rm --network=none pynescript-cli:latest info

Failure modes

SymptomCauseFix
Docker CLI PermissionError on smoke.pinemktemp 0700 + non-root userCI chmods 755/644 (already fixed)
Wheel missing pynescriptwrong package nameinstall hoox-pyne / built wheel
Ruff F821 on mainincomplete importsfix before push; gate is E,F,W

See also