mirror of
https://github.com/langchain-ai/langgraph.git
synced 2026-08-17 21:25:46 +02:00
John KennedyandGitHub
bcf3077267
## Summary - SHA-pins 7 distinct third-party actions across 10 workflow files to full commit SHAs - Prevents supply chain attacks via tag hijacking (mutable tags can be force-pushed by a compromised maintainer account) - Tag retained as an inline comment for readability | Action | Before | After | |--------|--------|-------| | `dorny/paths-filter` | `@v4` | `@fbd0ab8...` | | `Ana06/get-changed-files` | `@v2.3.0` | `@25f79e6...` | | `docker/login-action` | `@v4` | `@b45d80f...` | | `pypa/gh-action-pypi-publish` | `@release/v1` | `@ed0c539...` | | `ncipollo/release-action` | `@v1` | `@339a818...` | | `amannn/action-semantic-pull-request` | `@v6` | `@48f2562...` | | `peter-evans/create-pull-request` | `@v8` | `@c0f553f...` | ## Test plan - [x] CI passes on this PR - [x] Verify each pinned action still functions (no behaviour change, only ref format) 🤖 Generated with [Claude Code](https://claude.com/claude-code)
66 lines
1.7 KiB
YAML
66 lines
1.7 KiB
YAML
name: test
|
|
|
|
on:
|
|
workflow_call:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
matrix:
|
|
python-version:
|
|
- "3.10"
|
|
- "3.11"
|
|
- "3.12"
|
|
- "3.13"
|
|
- "3.14"
|
|
|
|
defaults:
|
|
run:
|
|
working-directory: libs/langgraph
|
|
name: "test #${{ matrix.python-version }}"
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
- name: Set up Python ${{ matrix.python-version }}
|
|
uses: ./.github/actions/uv_setup
|
|
with:
|
|
python-version: ${{ matrix.python-version }}
|
|
cache-suffix: "test-langgraph"
|
|
working-directory: libs/langgraph
|
|
- name: Login to Docker Hub
|
|
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4
|
|
if: ${{ !github.event.pull_request.head.repo.fork }}
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_RO_TOKEN }}
|
|
|
|
- name: Install dependencies
|
|
shell: bash
|
|
run: uv sync --frozen --group test --no-dev
|
|
|
|
- name: Run tests
|
|
shell: bash
|
|
run: make test_parallel
|
|
|
|
- name: Run strict msgpack pregel tests
|
|
if: ${{ matrix.python-version == '3.13' }}
|
|
shell: bash
|
|
env:
|
|
LANGGRAPH_STRICT_MSGPACK: "true"
|
|
run: make test TEST="tests/test_pregel.py tests/test_pregel_async.py"
|
|
|
|
- name: Ensure the tests did not create any additional files
|
|
shell: bash
|
|
run: |
|
|
set -eu
|
|
|
|
STATUS="$(git status)"
|
|
echo "$STATUS"
|
|
|
|
# grep will exit non-zero if the target message isn't found,
|
|
# and `set -e` above will cause the step to fail.
|
|
echo "$STATUS" | grep 'nothing to commit, working tree clean'
|