borg/.github/workflows/pypy.yml
Thomas Waldmann 70fc87ec1b
CI: do not persist the checkout credentials where they are not needed
actions/checkout leaves the job token behind in .git/config, so anything
that later archives the workspace also archives the credential (zizmor's
artipacked audit).  None of these workflows push with it - release.yml
authenticates gh via GH_TOKEN, and peter-evans/create-pull-request uses
its own token input - so they can all opt out.

backport.yml is the exception and keeps the credentials: korthout/backport-action
pushes the backport branch with a plain `git push`, which only works with
what actions/checkout left in .git/config.  Marked accordingly.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-29 22:37:28 +02:00

79 lines
2 KiB
YAML

# Tests on a PyPy 3.11 nightly build, see #1755. Non-blocking: pypy is a
# best-effort target. Nightly, because the cpyext fixes borg needs land
# there long before they get released.
name: PyPy (nightly)
on:
push:
branches: [ master ]
pull_request:
branches: [ master ]
paths:
- '**.py'
- '**.pyx'
- '**.c'
- '**.h'
- '**.yml'
- '**.toml'
- '**.cfg'
- '**.ini'
- 'requirements.d/*'
- '!docs/**'
workflow_dispatch:
concurrency:
group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
permissions:
contents: read
env:
PY_COLORS: "1"
jobs:
pypy_nightly:
name: Tests (pypy-3.11-nightly, ubuntu-26.04)
runs-on: ubuntu-26.04
timeout-minutes: 120
continue-on-error: true
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0
fetch-tags: true
persist-credentials: false
- name: Set up PyPy 3.11 (nightly)
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: 'pypy-3.11-nightly'
- name: Install Linux packages
shell: bash
run: |
sudo apt-get update
sudo apt-get install -y pkg-config build-essential
sudo apt-get install -y libssl-dev libacl1-dev liblz4-dev
# no fuse packages: the fuse bindings do not support pypy
- name: Install Python requirements
shell: bash
run: |
python -VV
python -m pip install --upgrade pip setuptools wheel
# unlocked requirements: the lock file is for CPython
python -m pip install -r requirements.d/development.txt
- name: Install borgbackup
shell: bash
run: |
python -m pip install -e .
borg -V
- name: Run tests
shell: bash
run: |
python -m pytest -n auto -v -rs --benchmark-skip --junitxml=test-results.xml --pyargs borg.testsuite