Additional weekly CI fixes & improvements

.github/workflows/build_release.yml

@@ -47,24 +47,21 @@ jobs:
           python -m build
           twine check --strict dist/*
 
-      - name: Install the wheel and run its tests
+      - name: Install the wheel
+        run: |
+          python -m pip install "$(ls dist/*.whl)[dev,tracking]"
+          mkdir -p /tmp/wheeltest
+
+      - name: Run the wheel's tests
         uses: aganders3/headless-gui@v2
         with:
-          # --pyargs runs the tests that shipped inside the wheel, and the cd out of
-          # the repo stops src/ shadowing the installed package - without it this
-          # would silently retest the source tree and prove nothing.
-          run: |
-            python -m pip install "$(ls dist/*.whl)[dev,tracking]"
-            mkdir -p /tmp/wheeltest && cd /tmp/wheeltest
-            # pyproject.toml is not in tmp, so pytest has no config
-            # Keep -o args in sync with [tool.pytest.ini_options].
-            python -m pytest --pyargs napari_deeplabcut._tests -q -n auto --dist loadfile \
-              -o qt_api=pyside6 \
-              -o "markers=e2e: end-to-end tests. Invoke napari viewer fixtures, slow."
+          working-directory: /tmp/wheeltest
+          shell: bash
+          run: >-
+            python -m pytest --pyargs napari_deeplabcut._tests -q -n auto --dist loadfile
+            -o qt_api=pyside6
+            -o markers=e2e
 
-      # Published by test_and_deploy.yml, so the bytes that were tested above are the
-      # bytes that reach PyPI. Artifacts are scoped to the run, so a caller's other
-      # jobs can download this.
       - name: Upload the distribution
         uses: actions/upload-artifact@v4
         with:

.github/workflows/format.yml

@@ -18,20 +18,25 @@ jobs:
 
       - name: Detect changed files
         id: changed_files
+        env:
+          BASE_REF: ${{ github.base_ref }}
         run: |
-          git fetch origin ${{ github.base_ref }}
-          CHANGED_FILES=$(git diff --name-only origin/${{ github.base_ref }}...HEAD)
+          git fetch origin "$BASE_REF"
+          CHANGED_FILES=$(git diff --name-only "origin/$BASE_REF...HEAD")
 
+          delimiter="changed_$(openssl rand -hex 16)"
           {
-            echo "changed<<EOF"
+            echo "changed<<$delimiter"
             echo "$CHANGED_FILES"
-            echo "EOF"
+            echo "$delimiter"
           } >> "$GITHUB_OUTPUT"
 
       - name: Show changed files
+        env:
+          CHANGED_FILES: ${{ steps.changed_files.outputs.changed }}
         run: |
           echo "Changed files:"
-          echo "${{ steps.changed_files.outputs.changed }}"
+          echo "$CHANGED_FILES"
 
   precommit:
     needs: detect_changes
@@ -43,7 +48,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           fetch-depth: 0
-          ref: ${{ github.head_ref }}
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Set up Python
         uses: actions/setup-python@v6

.github/workflows/test_and_deploy.yml

@@ -19,14 +19,6 @@ on:
     branches:
       - main
   workflow_dispatch:
-    inputs:
-      force_deploy:
-        # Validates the build and the installed-wheel tests, but does not publish from an
-        # untagged commit: setuptools_scm derives a local version there (0.x.devN+g<sha>)
-        # and PyPI rejects local version identifiers, so the upload step fails.
-        description: 'Force deployment even if tests fail'
-        required: true
-        type: boolean
 
 jobs:
   test:
@@ -114,24 +106,18 @@ jobs:
   build:
     # Shared with the weekly checks, so the release build is continuously exercised
     # rather than only at tag time. It also builds, checks metadata, installs the
-    # wheel and runs the suite against it - a release is blocked if any of that fails.
+    # wheel and runs the suite against it
     #
     # this will run when you have tagged a commit, starting with "v*"
     needs: [test, test-napari-floor]
-    if: |
-      always() && (
-        (github.event_name == 'workflow_dispatch' && inputs.force_deploy && github.ref == 'refs/heads/main'
-        ) ||
-        (startsWith(github.ref, 'refs/tags/v')
-          && needs.test.result == 'success'
-          && needs['test-napari-floor'].result == 'success')
-      )
+    if: startsWith(github.ref, 'refs/tags/v')
     uses: ./.github/workflows/build_release.yml
 
   deploy:
     # requires that you have put your twine API key in your
     # github secrets (see readme for details)
     needs: [build]
+    if: startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
 
     concurrency:

.github/workflows/weekly_checks.yml

@@ -10,22 +10,37 @@ on:
     # Note: Scheduled workflows only ever run on the default branch
     - cron: "0 6 * * 1" # Mondays, 06:00 UTC
   workflow_dispatch:
+    inputs:
+      simulate_failure:
+        description: "Skip the checks, fail on purpose, and open a test tracking issue"
+        required: false
+        default: false
+        type: boolean
 
 jobs:
   napari-breakage:
+    if: ${{ !inputs.simulate_failure }}
     uses: ./.github/workflows/napari_breakage.yml
 
   build-release:
+    if: ${{ !inputs.simulate_failure }}
     uses: ./.github/workflows/build_release.yml
 
+  simulate-failure:
+    # Exercises the notify job without waiting for a real failure.
+    if: ${{ inputs.simulate_failure }}
+    runs-on: ubuntu-latest
+    steps:
+      - run: exit 1
+
   notify:
     # A separate job so the notification cannot be lost to the failure it reports: a
     # step-level `if: failure()` only runs if its job reaches that step, so a dead
     # runner, a crashed step or a timeout would silently produce nothing.
     #
-    # Scheduled runs only, no issue on manual dispatch.
-    needs: [napari-breakage, build-release]
-    if: failure() && github.event_name == 'schedule'
+    # Scheduled runs only, no issue on manual dispatch unless simulating.
+    needs: [napari-breakage, build-release, simulate-failure]
+    if: failure() && (github.event_name == 'schedule' || inputs.simulate_failure)
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -38,21 +53,57 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           REPO: ${{ github.repository }}
           RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          NAPARI_RESULT: ${{ needs['napari-breakage'].result }}
+          BUILD_RESULT: ${{ needs['build-release'].result }}
+          SIMULATED: ${{ inputs.simulate_failure }}
         run: |
           set -euo pipefail
-          title="Weekly checks failing"
-          label="weekly checks"
+          if [ "$SIMULATED" = "true" ]; then
+            title="Weekly checks failing (notification test)"
+            label="weekly checks test"
+            banner="> **This is a test.** Opened by a manual dispatch with *simulate_failure* enabled, to exercise this notification. Nothing is broken - close it."
+          else
+            title="Weekly checks failing"
+            label="weekly checks"
+            banner=""
+          fi
           gh label create "$label" --repo "$REPO" --color B60205 \
             --description "Tracking issue for the weekly CI checks" --force
+
+          summary=$(printf '%s\n' \
+            "| Check | Result |" \
+            "| --- | --- |" \
+            "| napari breakage | $NAPARI_RESULT |" \
+            "| build and test release | $BUILD_RESULT |")
+
           existing=$(gh issue list --repo "$REPO" --state open --label "$label" --json number --jq '.[0].number // empty')
           if [ -n "$existing" ]; then
-            gh issue comment "$existing" --repo "$REPO" --body "Still failing: $RUN_URL"
+            comment=$(printf '%s\n' \
+              "Still failing: [run $GITHUB_RUN_ID]($RUN_URL)" \
+              "" \
+              "$summary")
+            gh issue comment "$existing" --repo "$REPO" --body "$comment"
           else
             body=$(printf '%s\n' \
-              "Weekly checks failed: $RUN_URL" \
+              "Weekly checks failed: [run $GITHUB_RUN_ID]($RUN_URL)" \
+              "" \
+              "$summary" \
+              "" \
+              "These run against napari pre-releases and the built wheel, so a failure is usually napari breaking us upstream, or a packaging problem - not a regression from a PR." \
               "" \
-              "(Run against napari pre-releases and the built wheel.)" \
+              "## Resolving" \
               "" \
-              "Close this issue once the run is fixed.")
-            gh issue create --repo "$REPO" --title "$title" --body "$body" --label "$label"
+              "1. Open the failing job from the run above and fix it on a branch." \
+              "2. Re-run that check against your branch:" \
+              "   - Actions -> napari breakage -> Run workflow -> *Plugin commit, tag or branch to test*" \
+              "   - Actions -> build and test release -> Run workflow -> *Plugin commit, tag or branch to build*" \
+              "3. Merge the fix, then dispatch Actions -> weekly checks on main" \
+              "4. Close this issue. While it stays open, later failures are added here as comments; once closed, the next failure opens a fresh one.")
+            if [ -n "$banner" ]; then
+              body=$(printf '%s\n' "$banner" "" "$body")
+            fi
+            url=$(gh issue create --repo "$REPO" --title "$title" --body "$body" --label "$label")
+            gh issue edit "$url" --repo "$REPO" \
+              --add-assignee C-Achard --add-assignee deruyter92 \
+              || echo "::warning::could not assign $url"
           fi