workflow: Add unit tests and reporting results workflows

.github/workflows/CI.yml

@@ -7,26 +7,44 @@ on:
       - 'releases/**'
   workflow_call:
   workflow_dispatch:
+
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build
     uses: ./.github/workflows/build.yml
   check_docs:
     name: Check docs
     uses: ./.github/workflows/check_docs.yml
-  # run_unit_tests:
-  #   name: Run unit tests
-  #   uses: ./.github/workflows/run_unit_tests.yml
-  #   needs: [build]
+  check_workflows:
+    name: Check workflows
+    uses: ./.github/workflows/check_workflows.yml
+    permissions:
+      actions: read
+      contents: read
+  checks_succeeded:
+    name: Checks succeeded
+    needs: [build, check_docs, check_workflows]
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - run: exit 0
+  run_unit_tests:
+    name: Run unit tests
+    uses: ./.github/workflows/run_unit_tests.yml
+    needs: [checks_succeeded]
   # run_system_tests:
   #   name: Run system tests
   #   uses: ./.github/workflows/run_system_tests.yml
   #   needs: [build, run_unit_tests]
-  # report_test_results:
-  #   name: Report test results
-  #   uses: ./.github/workflows/report_test_results.yml
-  #   needs: [run_unit_tests, run_system_tests]
-  #   if: always()
-  #   permissions:
-  #     checks: write
-  #     pull-requests: write
+  report_test_results:
+    name: Report test results
+    uses: ./.github/workflows/report_test_results.yml
+    needs: [run_unit_tests]
+    if: always()
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write

.github/workflows/PR.yml

@@ -17,6 +17,7 @@ jobs:
     name: Run CI
     uses: ./.github/workflows/CI.yml
     permissions:
+      actions: read
       contents: read
       checks: write
       pull-requests: write

.github/workflows/build.yml

@@ -3,6 +3,10 @@ name: Build
 on:
   workflow_call:
   workflow_dispatch:
+
+permissions:
+   contents: read
+
 jobs:
   build:
     name: Build
@@ -11,6 +15,8 @@ jobs:
     steps:
       - name: Check out repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Set up Python
         uses: ni/python-actions/setup-python@a2894c635a2cba635a1086c1f89796fec2c52f74 # v0.7.2
         id: setup-python

.github/workflows/check_docs.yml

@@ -4,13 +4,18 @@ on:
   workflow_call:
   workflow_dispatch:
 
+permissions:
+   contents: read
+
 jobs:
   check_docs:
     name: Check docs
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Set up Python
         uses: ni/python-actions/setup-python@a2894c635a2cba635a1086c1f89796fec2c52f74 # v0.7.2
         id: setup-python

.github/workflows/check_workflows.yml

@@ -0,0 +1,23 @@
+name: Check workflows
+
+on:
+  workflow_call:
+  workflow_dispatch:
+
+jobs:
+  zizmor:
+    name: Run zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
+        with:
+          # GitHub Advanced Security costs extra for internal repos
+          advanced-security: false

.github/workflows/publish.yml

@@ -30,6 +30,9 @@ env:
       }
     }
 
+permissions:
+  contents: read
+
 jobs:
   check_nislsc:
     name: Check nislsc
@@ -44,6 +47,8 @@ jobs:
     steps:
       - name: Check out repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Set up Python
         uses: ni/python-actions/setup-python@a2894c635a2cba635a1086c1f89796fec2c52f74 # v0.7.2
       - name: Set up Poetry
@@ -90,6 +95,8 @@ jobs:
     steps:
       - name: Check out repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Set up Python
         uses: ni/python-actions/setup-python@a2894c635a2cba635a1086c1f89796fec2c52f74 # v0.7.2
       - name: Set up Poetry

.github/workflows/report_test_results.yml

@@ -0,0 +1,31 @@
+name: Report test results
+
+on:
+  workflow_call:
+  workflow_dispatch:
+
+jobs:
+  report_test_results:
+    name: Report test results
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Download test results
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          path: test_results
+          pattern: test_results_*
+          merge-multiple: true
+      - name: List downloaded files
+        run: ls -lR
+      - name: Publish test results
+        uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2.24.0
+        with:
+          files: "test_results/*.xml"

.github/workflows/run_unit_tests.yml

@@ -0,0 +1,48 @@
+name: Run unit tests
+
+on:
+  workflow_call:
+  workflow_dispatch:
+
+permissions:
+   contents: read
+
+jobs:
+  run_unit_tests:
+    name: Run unit tests
+    runs-on:
+      - ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14", "pypy3.11"]
+      # Fail-fast skews the pass/fail ratio and seems to make pytest produce
+      # incomplete JUnit XML results.
+      fail-fast: false
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: ni/python-actions/setup-python@a2554c7e5680982d3355677b2290e48b60678744 # v0.8.0
+        id: setup-python
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Set up Poetry
+        uses: ni/python-actions/setup-poetry@a2554c7e5680982d3355677b2290e48b60678744 # v0.8.0
+      - name: Cache virtualenv (with test dependencies)
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: .venv
+          key: nislsc-${{ runner.os }}-py${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('poetry.lock') }}
+      - name: Install test dependencies
+        run: poetry install --only main,test
+      - name: Run unit tests
+        run: poetry run pytest -v --cov=generated/nislsc --junitxml=test_results/unit-${{ matrix.os }}-py${{ matrix.python-version }}.xml tests/unit
+      - name: Upload test results
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: test_results_unit_${{ matrix.os }}_py${{ matrix.python-version }}
+          path: test_results/*.xml
+        if: always()

.github/workflows/sync_github_issues_to_azdo.yml

@@ -8,6 +8,8 @@ on:
   issue_comment:
     types: [created, edited, deleted]
 
+permissions: {}
+
 jobs:
   alert:
     if: ${{ !github.event.issue.pull_request && github.event.issue.title != 'Dependency Dashboard' }}