Python in CI/CD, add lintage and tests

Signed-off-by: William Woodruff <[email protected]>

.github/workflows/python.yml

@@ -0,0 +1,38 @@
+name: Python tests and linting
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  test:
+    strategy:
+      matrix:
+        python:
+          - "3.7"
+          - "3.8"
+          - "3.9"
+          - "3.10"
+          - "3.11"
+          - "3.12"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+      - name: test
+        run: make test INSTALL_EXTRA=test
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.x"
+      - name: lint
+        run: make lint INSTALL_EXTRA=lint

python/Makefile

@@ -0,0 +1,63 @@
+SHELL := /bin/bash
+
+PY_MODULE := in_toto_attestation
+
+ALL_PY_SRCS := $(shell find $(PY_MODULE) tests -name '*.py')
+
+# Optionally overriden by the user, if they're using a virtual environment manager.
+VENV ?= env
+
+VENV_STAMP = $(VENV)/pyvenv.cfg
+
+# On Windows, venv scripts/shims are under `Scripts` instead of `bin`.
+VENV_BIN := $(VENV)/bin
+ifeq ($(OS),Windows_NT)
+	VENV_BIN := $(VENV)/Scripts
+endif
+
+# Optionally overridden by the user in the `release` target.
+BUMP_ARGS :=
+
+# Optionally overridden by the user/CI, to limit the installation to a specific
+# subset of development dependencies.
+INSTALL_EXTRA := dev
+
+.PHONY: all
+all:
+	@echo "Run my targets individually!"
+
+.PHONY: dev
+dev: $(VENV_STAMP)
+
+$(VENV_STAMP): pyproject.toml
+	python -m venv env
+	$(VENV_BIN)/python -m pip install --upgrade pip
+	$(VENV_BIN)/python -m pip install -e .[$(INSTALL_EXTRA)]
+
+.PHONY: lint
+lint: $(VENV_STAMP)
+	. $(VENV_BIN)/activate && \
+		ruff format --check $(ALL_PY_SRCS) && \
+		ruff $(ALL_PY_SRCS) && \
+		mypy $(PY_MODULE)
+
+.PHONY: reformat
+reformat: $(VENV_STAMP)
+	. $(VENV_BIN)/activate && \
+		ruff format $(ALL_PY_SRCS) && \
+		ruff --fix $(ALL_PY_SRCS)
+
+.PHONY: test tests
+test tests: $(VENV_STAMP)
+	. env/bin/activate && \
+		pytest --cov=$(PY_MODULE) $(T) $(TEST_ARGS) && \
+		python -m coverage report -m $(COV_ARGS)
+
+.PHONY: package
+package: $(VENV_STAMP)
+	. $(VENV_BIN)/activate && \
+		python -m build
+
+.PHONY: edit
+edit:
+	$(EDITOR) $(ALL_PY_SRCS)

python/pyproject.toml

@@ -8,12 +8,7 @@ description = "Python bindings for the in-toto Attestation Framework"
 readme = "README.md"
 license = "Apache-2.0"
 requires-python = "~=3.7"
-keywords = [
-    "security",
-    "software supply chain",
-    "in-toto",
-    "slsa"
-]
+keywords = ["security", "software supply chain", "in-toto", "slsa"]
 classifiers = [
     "Development Status :: 4 - Beta",
     "Intended Audience :: Developers",
@@ -40,10 +35,13 @@ dynamic = ["version"]
 Homepage = "https://in-toto.io"
 Source = "https://github.com/in-toto/attestation"
 
+[project.optional-dependencies]
+test = ["pytest", "pytest-cov", "coverage[toml]"]
+lint = ["mypy", "ruff"]
+dev = ["build", "in-toto-attestation[test,lint]"]
+
 [tool.hatch.version]
 path = "in_toto_attestation/__init__.py"
 
 [tool.hatch.build.targets.sdist]
-include = [
-    "/in_toto_attestation",
-]
+include = ["/in_toto_attestation"]