ci: modernize CI matrix, pin actions, and refresh docs#19
Open
thephez wants to merge 14 commits into
Open
Conversation
Modern Pythons (3.10-3.14) now run on all three OSes via the python-version x os matrix, while the legacy Pythons (2.7, 3.5, 3.6, 3.7) are added on ubuntu-20.04 only via include, since setup-python cannot provide them on newer runners. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Separate the matrix into a modern job (Python 3.10-3.14 on 22.04 and latest) and a legacy job (Python 2.7-3.7 on ubuntu-20.04), each with fail-fast disabled so one failure does not cancel the others. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Merge the modern and legacy jobs back into one build job covering Python 3.7 and 3.10-3.14 on ubuntu-22.04 and latest, dropping 2.7, 3.5, 3.6 and the ubuntu-20.04 runner. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Align the README with CI, which no longer tests 2.7, 3.5 or 3.6. Also drop the $ prompts from command examples for easier copy-paste. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Rename the workflow to reflect that it builds a Python C extension rather than a standalone C++ project, and add workflow_dispatch so it can be run manually. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Run the workflow every Monday at 08:17 UTC to catch breakage from new runner images or dependency updates between commits. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
📝 WalkthroughWalkthroughUpdates the GitHub Actions workflow: expanded test matrix (Python 3.10–3.14 plus 3.7 include), added legacy job for older Pythons, pinned action SHAs; README command examples reformatted (install/test/uninstall) and retains “Python 3.5+ or 2.7+” text. ChangesProject Configuration and Documentation
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (1)
.github/workflows/build-test.yaml (1)
22-22: ⚡ Quick winConsider adding
persist-credentials: falsefor defense in depth.The checkout action defaults to persisting GitHub credentials in the working directory. While the risk is lower for this C extension build workflow, explicitly setting
persist-credentials: falsefollows security best practices and prevents credential exposure if the workflow is later modified to execute untrusted code.🔒 Suggested hardening
- - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build-test.yaml at line 22, The checkout step currently uses actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10; update that step to explicitly set persist-credentials: false to avoid leaving GitHub credentials in the workspace (i.e., add persist-credentials: false under the actions/checkout step), ensuring credential persistence is disabled for defense-in-depth.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build-test.yaml:
- Around line 15-18: The CI matrix currently tests python-version: [ '3.10',
'3.11', '3.12', '3.13', '3.14' ] plus an include for 3.7, leaving out 3.8 and
3.9; update the matrix to include '3.8' and '3.9' (add them to the
python-version list or add include entries) so tests run on those interpreters,
or alternatively add a comment/README note in the workflow explaining the
intentional omission of 3.8/3.9 if you do not want to support them; refer to the
python-version matrix key in the workflow for the change.
- Line 18: The workflow matrix currently includes python-version '3.7' while the
job uses actions/setup-python@v6.2.0 which no longer supports EOL Python 3.7;
remove the { python-version: '3.7', os: ubuntu-22.04 } entry from the
matrix.include or alternatively pin actions/setup-python to a prior release that
still supports 3.7 (e.g., downgrade the setup action reference used in the
workflow from v6.2.0 to a compatible older tag) so the matrix and setup-python
version are consistent.
- Line 22: The pinned SHA for actions/checkout in the workflow is inconsistent
with the inline tag: update the line that currently uses
"actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" so the comment and
pin match—either replace the pinned SHA with the commit for tag "v6.0.3"
(9f698171ed81b15d1823a05fc7211befd50c8ae0) or change the comment/tag to reflect
the existing SHA; ensure the string "actions/checkout@..." and its accompanying
comment are consistent.
In `@README.md`:
- Line 9: Add a python_requires minimum version to the setup() invocation so pip
enforces the README/CI-supported Python >=3.7; update the setup.py file by
adding the python_requires='>=3.7' parameter to the existing setup(...) call
(the setup function that declares name/version/ext_modules) so installations on
older Python are rejected with a clear error.
---
Nitpick comments:
In @.github/workflows/build-test.yaml:
- Line 22: The checkout step currently uses
actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10; update that step to
explicitly set persist-credentials: false to avoid leaving GitHub credentials in
the workspace (i.e., add persist-credentials: false under the actions/checkout
step), ensuring credential persistence is disabled for defense-in-depth.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 5047bb6d-a224-4ee3-bdf1-c956084f490f
📒 Files selected for processing (2)
.github/workflows/build-test.yamlREADME.md
Author
|
@UdjinM6 @PastaPastaPasta can someone with write access review this? |
knst
reviewed
Jun 9, 2026
actions/setup-python no longer publishes these builds for the available runner images, so test them inside the official python:X.Y-buster images, which ship a working interpreter and gcc. The C extension already has Python 2 build branches. Restore the README's supported-version note to 3.5+/2.7+ accordingly.
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/workflows/build-test.yaml (2)
22-22: ⚡ Quick winConsider adding
persist-credentials: falsefor defense in depth.While not a risk in this workflow, explicitly disabling credential persistence prevents potential leakage through artifacts if the workflow evolves.
🔒 Suggested addition
- - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build-test.yaml at line 22, Add persist-credentials: false to the actions/checkout step to prevent GitHub Actions from persisting workflow token credentials; locate the checkout usage (the line with uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10) and add the persist-credentials: false property under that step so credentials are not retained for later steps or artifacts.Source: Linters/SAST tools
46-46: ⚡ Quick winConsider adding
persist-credentials: falsefor defense in depth.Same security recommendation as the main build job: explicitly disabling credential persistence prevents potential leakage if the workflow evolves.
🔒 Suggested addition
- - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build-test.yaml at line 46, The actions/checkout step currently uses a pinned ref (actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10) but does not disable credential persistence; add persist-credentials: false to that checkout step to prevent GitHub token being persisted to the workspace (defense in depth). Locate the checkout usage (actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10) and add the persist-credentials: false input under that step.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build-test.yaml:
- Line 48: The legacy workflow step currently runs "python -m pip install ."
without first installing requirements; update that job/step to mirror the main
build by running pip install -r requirements.txt (to install setuptools, wheel,
etc.) prior to the existing "python -m pip install ." command so the environment
and build tools match the main build job.
---
Nitpick comments:
In @.github/workflows/build-test.yaml:
- Line 22: Add persist-credentials: false to the actions/checkout step to
prevent GitHub Actions from persisting workflow token credentials; locate the
checkout usage (the line with uses:
actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10) and add the
persist-credentials: false property under that step so credentials are not
retained for later steps or artifacts.
- Line 46: The actions/checkout step currently uses a pinned ref
(actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10) but does not disable
credential persistence; add persist-credentials: false to that checkout step to
prevent GitHub token being persisted to the workspace (defense in depth). Locate
the checkout usage (actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10)
and add the persist-credentials: false input under that step.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 91d172ec-923b-4bb9-9ba6-caa6ca3268a4
📒 Files selected for processing (2)
.github/workflows/build-test.yamlREADME.md
✅ Files skipped from review due to trivial changes (1)
- README.md
These are still published by actions/setup-python for the current runners, so add them to the modern build matrix to close the 3.7-to-3.10 gap. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
knst
approved these changes
Jun 9, 2026
UdjinM6
approved these changes
Jun 14, 2026
Author
|
Turns out I can't merge in this repo either. Can someone merge it as well? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Modernizes the GitHub Actions workflow and refreshes the README. All previously supported Python versions remain tested — modern releases on hosted runners, and the EOL releases (2.7, 3.5, 3.6) inside official Docker images.
CI changes
actions/setup-pythonon hosted runners (ubuntu-22.04andubuntu-latest). Python 3.7 runs on 22.04 only (added viainclude), since newer runners don't provide it.actions/setup-pythonfor the available runner images, so a separatelegacyjob runs them inside the officialpython:X.Y-busterDocker images, which still ship a working interpreter and gcc. The C extension already has Python 2 build branches, so no source changes were needed.checkoutv6.0.3 (both jobs) andsetup-pythonv6.2.0 (previously floating@v2tags). buster's glibc (2.28) is new enough to run checkout v6's bundled Node.fail-fast: falseso one version failing doesn't cancel the rest.workflow_dispatch(manual runs) and a weeklyschedule(Mondays 08:17 UTC) to catch breakage from runner/dependency drift.Docs
TestandUninstallheading underlines.$prompts from command examples for easier copy-paste.Summary by CodeRabbit
Documentation
Chores