Add --break-system-packages to shady pip commands if supported
#507
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: build | |
| on: | |
| merge_group: | |
| types: | |
| - checks_requested | |
| pull_request: | |
| push: | |
| repository_dispatch: | |
| types: | |
| - apb | |
| # Set a default shell for any run steps. The `-Eueo pipefail` sets errtrace, | |
| # nounset, errexit, and pipefail. The `-x` will print all commands as they are | |
| # run. Please see the GitHub Actions documentation for more information: | |
| # https://docs.github.com/en/actions/using-jobs/setting-default-values-for-jobs | |
| defaults: | |
| run: | |
| shell: bash -Eueo pipefail -x {0} | |
| env: | |
| CURL_CACHE_DIR: ~/.cache/curl | |
| PIP_CACHE_DIR: ~/.cache/pip | |
| PRE_COMMIT_CACHE_DIR: ~/.cache/pre-commit | |
| RUN_TMATE: ${{ secrets.RUN_TMATE }} | |
| TERRAFORM_DOCS_REPO_BRANCH_NAME: improvement/support_atx_closed_markdown_headers | |
| TERRAFORM_DOCS_REPO_DEPTH: 1 | |
| TERRAFORM_DOCS_REPO_URL: https://github.com/mcdonnnj/terraform-docs.git | |
| jobs: | |
| diagnostics: | |
| name: Run diagnostics | |
| runs-on: ubuntu-latest | |
| steps: | |
| # Note that a duplicate of this step must be added at the top of | |
| # each job. | |
| - id: harden-runner | |
| name: Harden the runner | |
| uses: step-security/harden-runner@v2 | |
| with: | |
| egress-policy: audit | |
| - id: github-status | |
| name: Check GitHub status | |
| uses: crazy-max/ghaction-github-status@v4 | |
| - id: dump-context | |
| name: Dump context | |
| uses: crazy-max/ghaction-dump-context@v2 | |
| lint: | |
| needs: | |
| - diagnostics | |
| runs-on: ubuntu-latest | |
| steps: | |
| - id: harden-runner | |
| name: Harden the runner | |
| uses: step-security/harden-runner@v2 | |
| with: | |
| egress-policy: audit | |
| - id: setup-env | |
| uses: cisagov/setup-env-github-action@develop | |
| - uses: actions/checkout@v4 | |
| - id: setup-python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ steps.setup-env.outputs.python-version }} | |
| # We need the Go version and Go cache location for the actions/cache step, | |
| # so the Go installation must happen before that. | |
| - id: setup-go | |
| uses: actions/setup-go@v5 | |
| with: | |
| # There is no expectation for actual Go code so we disable caching as | |
| # it relies on the existence of a go.sum file. | |
| cache: false | |
| go-version: ${{ steps.setup-env.outputs.go-version }} | |
| - id: go-cache | |
| name: Lookup Go cache directory | |
| run: | | |
| echo "dir=$(go env GOCACHE)" >> $GITHUB_OUTPUT | |
| - uses: actions/cache@v3 | |
| env: | |
| BASE_CACHE_KEY: "${{ github.job }}-${{ runner.os }}-\ | |
| py${{ steps.setup-python.outputs.python-version }}-\ | |
| go${{ steps.setup-go.outputs.go-version }}-\ | |
| packer${{ steps.setup-env.outputs.packer-version }}-\ | |
| tf${{ steps.setup-env.outputs.terraform-version }}-" | |
| with: | |
| key: "${{ env.BASE_CACHE_KEY }}\ | |
| ${{ hashFiles('**/requirements-test.txt') }}-\ | |
| ${{ hashFiles('**/requirements.txt') }}-\ | |
| ${{ hashFiles('**/.pre-commit-config.yaml') }}" | |
| # Note that the .terraform directory IS NOT included in the | |
| # cache because if we were caching, then we would need to use | |
| # the `-upgrade=true` option. This option blindly pulls down the | |
| # latest modules and providers instead of checking to see if an | |
| # update is required. That behavior defeats the benefits of caching. | |
| # so there is no point in doing it for the .terraform directory. | |
| path: | | |
| ${{ env.PIP_CACHE_DIR }} | |
| ${{ env.PRE_COMMIT_CACHE_DIR }} | |
| ${{ env.CURL_CACHE_DIR }} | |
| ${{ steps.go-cache.outputs.dir }} | |
| restore-keys: | | |
| ${{ env.BASE_CACHE_KEY }} | |
| - name: Setup curl cache | |
| run: mkdir -p ${{ env.CURL_CACHE_DIR }} | |
| - name: Install Packer | |
| env: | |
| PACKER_VERSION: ${{ steps.setup-env.outputs.packer-version }} | |
| run: | | |
| PACKER_ZIP="packer_${PACKER_VERSION}_linux_amd64.zip" | |
| curl --output ${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}" \ | |
| --time-cond ${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}" \ | |
| --location \ | |
| "https://releases.hashicorp.com/packer/${PACKER_VERSION}/${PACKER_ZIP}" | |
| sudo unzip -d /opt/packer \ | |
| ${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}" | |
| sudo mv /usr/local/bin/packer /usr/local/bin/packer-default | |
| sudo ln -s /opt/packer/packer /usr/local/bin/packer | |
| - uses: hashicorp/setup-terraform@v3 | |
| with: | |
| terraform_version: ${{ steps.setup-env.outputs.terraform-version }} | |
| - name: Install go-critic | |
| env: | |
| PACKAGE_URL: github.com/go-critic/go-critic/cmd/gocritic | |
| PACKAGE_VERSION: ${{ steps.setup-env.outputs.go-critic-version }} | |
| run: go install ${PACKAGE_URL}@${PACKAGE_VERSION} | |
| - name: Install goimports | |
| env: | |
| PACKAGE_URL: golang.org/x/tools/cmd/goimports | |
| PACKAGE_VERSION: ${{ steps.setup-env.outputs.goimports-version }} | |
| run: go install ${PACKAGE_URL}@${PACKAGE_VERSION} | |
| - name: Install gosec | |
| env: | |
| PACKAGE_URL: github.com/securego/gosec/v2/cmd/gosec | |
| PACKAGE_VERSION: ${{ steps.setup-env.outputs.gosec-version }} | |
| run: go install ${PACKAGE_URL}@${PACKAGE_VERSION} | |
| - name: Install staticcheck | |
| env: | |
| PACKAGE_URL: honnef.co/go/tools/cmd/staticcheck | |
| PACKAGE_VERSION: ${{ steps.setup-env.outputs.staticcheck-version }} | |
| run: go install ${PACKAGE_URL}@${PACKAGE_VERSION} | |
| # TODO: https://github.com/cisagov/skeleton-generic/issues/165 | |
| # We are temporarily using @mcdonnnj's forked branch of terraform-docs | |
| # until his PR: https://github.com/terraform-docs/terraform-docs/pull/745 | |
| # is approved. This temporary fix will allow for ATX header support when | |
| # terraform-docs is run during linting. | |
| - name: Clone ATX headers branch from terraform-docs fork | |
| run: | | |
| git clone \ | |
| --branch $TERRAFORM_DOCS_REPO_BRANCH_NAME \ | |
| --depth $TERRAFORM_DOCS_REPO_DEPTH \ | |
| --single-branch \ | |
| $TERRAFORM_DOCS_REPO_URL /tmp/terraform-docs | |
| - name: Build and install terraform-docs binary | |
| run: | | |
| go build \ | |
| -C /tmp/terraform-docs \ | |
| -o $(go env GOPATH)/bin/terraform-docs | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip setuptools wheel | |
| pip install --upgrade --requirement requirements-test.txt | |
| - name: Set up pre-commit hook environments | |
| run: pre-commit install-hooks | |
| - name: Run pre-commit on all files | |
| run: pre-commit run --all-files | |
| - name: Setup tmate debug session | |
| uses: mxschmitt/action-tmate@v3 | |
| if: env.RUN_TMATE | |
| test: | |
| name: >- | |
| test (${{ matrix.scenario }}) - | |
| ${{ matrix.platform }}-${{ matrix.architecture }} | |
| needs: | |
| - diagnostics | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| architecture: | |
| - amd64 | |
| - arm64 | |
| exclude: | |
| # Buster does not have a new enough version of the golang | |
| # package to build any go projects of recent vintage. | |
| - platform: debian10-systemd | |
| scenario: go | |
| # Focal does not have a new enough version of the golang | |
| # package to build any go projects of recent vintage. | |
| - platform: ubuntu-20-systemd | |
| scenario: go | |
| # PowerShell does not support ARM64 on Debian-based platforms. | |
| - architecture: arm64 | |
| scenario: powershell | |
| # The latest official release of PowerShell does not support | |
| # Ubuntu Noble. It requires libicu <= 72, but Noble only | |
| # offers libicu 74: | |
| # https://packages.ubuntu.com/search?keywords=libicu&searchon=names&suite=noble§ion=all | |
| - platform: ubuntu-24-systemd | |
| scenario: powershell | |
| # Debian Bookworm and Trixie do not offer Python 2. | |
| - platform: debian12-systemd | |
| scenario: python2 | |
| - platform: debian13-systemd | |
| scenario: python2 | |
| # Kali cannot build the wheels for HarmJ0y/ImpDump on ARM64. | |
| - platform: kali-systemd | |
| scenario: python2 | |
| # Ubuntu Noble does not offer Python 2. | |
| - platform: ubuntu-24-systemd | |
| scenario: python2 | |
| # Debian Buster does not have a new enough version of cargo | |
| # to parse the cargo.toml file for RustScan. The | |
| # buster-backports package repository no longer exists. | |
| - platform: debian10-systemd | |
| scenario: rust | |
| # Debian Bullseye has an older version of cargo, which gives | |
| # a "feature `resolver` is required" error when installing | |
| # RustScan. There is no newer version in backports. | |
| - platform: debian11-systemd | |
| scenario: rust | |
| # Debian Bookworm has an older version of rustc, which gives | |
| # a "package `regex-syntax v0.8.2` cannot be built because | |
| # it requires rustc 1.65 or newer, while the currently | |
| # active rustc version is 1.63.0" error when installing the | |
| # tool. | |
| - platform: debian12-systemd | |
| scenario: rust | |
| platform: | |
| # This Ansible role only supports Debian-based platforms for | |
| # now. | |
| # - amazonlinux2023-systemd | |
| - debian10-systemd | |
| - debian11-systemd | |
| - debian12-systemd | |
| - debian13-systemd | |
| # This Ansible role only supports Debian-based platforms for | |
| # now. | |
| # - fedora39-systemd | |
| # - fedora40-systemd | |
| - kali-systemd | |
| - ubuntu-20-systemd | |
| - ubuntu-22-systemd | |
| - ubuntu-24-systemd | |
| scenario: | |
| - csharp | |
| - default | |
| - go | |
| - powershell | |
| - python | |
| - python2 | |
| - rust | |
| steps: | |
| - id: harden-runner | |
| name: Harden the runner | |
| uses: step-security/harden-runner@v2 | |
| with: | |
| egress-policy: audit | |
| - id: setup-env | |
| uses: cisagov/setup-env-github-action@develop | |
| - uses: actions/checkout@v4 | |
| - id: setup-python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ steps.setup-env.outputs.python-version }} | |
| - uses: actions/cache@v3 | |
| env: | |
| BASE_CACHE_KEY: "${{ github.job }}-${{ runner.os }}-\ | |
| py${{ steps.setup-python.outputs.python-version }}-" | |
| with: | |
| path: ${{ env.PIP_CACHE_DIR }} | |
| key: "${{ env.BASE_CACHE_KEY }}\ | |
| ${{ hashFiles('**/requirements-test.txt') }}-\ | |
| ${{ hashFiles('**/requirements.txt') }}" | |
| restore-keys: | | |
| ${{ env.BASE_CACHE_KEY }} | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install --upgrade --requirement requirements-test.txt | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v3 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Run molecule tests | |
| run: >- | |
| molecule test | |
| --platform-name ${{ matrix.platform }}-${{ matrix.architecture }} | |
| --scenario-name ${{ matrix.scenario }} | |
| - name: Setup tmate debug session | |
| uses: mxschmitt/action-tmate@v3 | |
| if: env.RUN_TMATE |