policyengine-uk/.github/workflows/code_changes.yaml at main · PolicyEngine/policyengine-uk · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
# Workflow that runs on code changes to the main branch.

name: Code changes
on:
  push:
    branches:
      - main

    paths:
      - policyengine_uk/**
      - tests/**
      - .github/**
  workflow_dispatch:

jobs:
  Lint:
    runs-on: ubuntu-latest
    steps:
        - uses: actions/checkout@v6
        - name: Install uv
          uses: astral-sh/setup-uv@v8.1.0
        - name: Check formatting
          run: uvx ruff format --check .
  Test:
      runs-on: macos-latest
      permissions:
        contents: "read"
        id-token: "write"
      steps:
          - name: Checkout repo
            uses: actions/checkout@v6
          - name: Install uv
            uses: astral-sh/setup-uv@v8.1.0

          - name: Set up Python
            uses: actions/setup-python@v6
            with:
                python-version: '3.13'
          - uses: "google-github-actions/auth@v3"
            with:
              workload_identity_provider: "projects/322898545428/locations/global/workloadIdentityPools/policyengine-research-id-pool/providers/prod-github-provider"
              service_account: "policyengine-research@policyengine-research.iam.gserviceaccount.com"

          - name: Install package
            run: uv pip install -e .[dev] --system
          - name: Install policyengine
            run: uv pip install policyengine --system
          - name: Install JB
            run: uv pip install "jupyter-book>=2.0.0a0" --system
          - name: UV sync
            run: uv sync --extra dev
          - name: Run tests with coverage
            run: |
              # Only export token if non-empty (defensive against missing secrets)
              if [ -n "$HF_TOKEN_VALUE" ]; then
                export HUGGING_FACE_TOKEN="$HF_TOKEN_VALUE"
                # policyengine-core only passes a token to hf_hub_download when
                # the repo reports private=True. policyengine-uk-data-private
                # has been public + gated since 31 July 2026, so core sends the
                # request anonymously and the gate returns 401. HF_TOKEN is
                # huggingface_hub's implicit-token variable, used when the
                # explicit token is None, which restores authentication.
                export HF_TOKEN="$HF_TOKEN_VALUE"
              fi
              make test
            env:
              HF_TOKEN_VALUE: ${{ secrets.HUGGING_FACE_TOKEN }}
          - name: Upload coverage to Codecov
            uses: codecov/codecov-action@v6
            with:
              files: ./coverage.xml
              fail_ci_if_error: false
              verbose: true