mirror of
https://github.com/semantica-agi/semantica.git
synced 2026-09-05 04:00:31 +00:00
Mohd Kaif
56b174781f
Distribution and trust-signal infrastructure to make pip install semantica
frictionless in downstream CI, and to bring the release pipeline in line
with mature OSS practice.
- .github/actions/setup-semantica: reusable composite action other repos
can call to install + verify semantica in one step
- install-matrix.yml: verifies the published package installs and imports
cleanly across Ubuntu/macOS/Windows x Python 3.9-3.12, weekly and on
release; backs a new README badge
- scorecard.yml: OpenSSF Scorecard analysis, weekly and on push to main,
backing a new README badge
- release.yml: twine check gate before publish, catching a broken PyPI
long-description render before it ships
- CITATION.cff: enables GitHub's native "Cite this repository" button
- examples/ci/: copy-paste GitHub Actions, GitLab CI, and CircleCI
templates for projects adopting semantica
- GROWTH.md: tracked checklist of distribution channels, what's done vs
outstanding, with guardrails against inflating metrics artificially
Fixes folded in along the way:
- Re-pinned softprops/action-gh-release to the immutable v3.0.3 tag
instead of the floating v3, after verify-action-pins.sh caught the
mutable tag had drifted to a newer commit
- setup-semantica now passes extras/version through env vars instead of
interpolating ${{ inputs.* }} directly into the bash script, closing
a script-injection vector for callers deriving these from event data
- install-matrix now triggers on the Release workflow's completion
(workflow_run) instead of release: published, since the GitHub release
is created before the PyPI upload runs and the old trigger could race
the publish
- The workflow_run path derives the expected version from the triggering
tag and passes it into setup-semantica's version input, so pip
installs and verifies the exact release instead of whatever's latest
on PyPI at the time
- setup-semantica's pip caching is now opt-in (default disabled), since
actions/setup-python errors out with cache: 'pip' enabled when the
caller repo has no requirements.txt/pyproject.toml to key on
- examples/ci/github-actions.yml pins actions/checkout and
actions/setup-python to verified commit SHAs instead of mutable tags
- examples/ci templates guard the requirements.txt install step with
-f requirements.txt and call out pyproject.toml/Poetry/Pipenv as
alternatives, since not every project has a requirements.txt
37 lines
2.1 KiB
Markdown
37 lines
2.1 KiB
Markdown
# CI templates
|
|
|
|
Copy-paste starting points for wiring `semantica` into your own project's CI. Each file is a
|
|
complete, working config — rename it into your project (see the comment at the top of each file
|
|
for the target path) and swap the smoke-test / test step for whatever your project does with
|
|
Semantica. Each template installs `semantica` unconditionally and your own project's dependencies
|
|
only if a `requirements.txt` is present; if your project uses `pyproject.toml`, Poetry, or Pipenv
|
|
instead, adjust the marked install line (each file calls it out inline).
|
|
|
|
| File | Target path in your repo |
|
|
| ---- | ------------------------- |
|
|
| [`github-actions.yml`](github-actions.yml) | `.github/workflows/semantica.yml` |
|
|
| [`gitlab-ci.yml`](gitlab-ci.yml) | `.gitlab-ci.yml` |
|
|
| [`circleci-config.yml`](circleci-config.yml) | `.circleci/config.yml` |
|
|
|
|
If your own project is hosted on GitHub, you can skip the setup boilerplate entirely and use
|
|
Semantica's reusable composite action instead:
|
|
|
|
```yaml
|
|
- uses: semantica-agi/semantica/.github/actions/setup-semantica@main
|
|
with:
|
|
python-version: '3.11'
|
|
# extras: 'explorer,all' # optional
|
|
# version: '==0.6.7' # optional, pin an exact release
|
|
# cache: 'pip' # optional, only if your repo has a requirements.txt/pyproject.toml/etc.
|
|
```
|
|
|
|
`@main` always tracks this repo's default branch, which is convenient but — like any mutable
|
|
ref — can change out from under you between runs. For production CI, pin it to a commit SHA
|
|
instead (find one via `git rev-parse` against a tagged release, or the commit history for
|
|
[`.github/actions/setup-semantica/`](../../.github/actions/setup-semantica/)) and update the pin
|
|
deliberately when you want to pick up changes, the same way this repo's own workflows are pinned
|
|
(see [`verify-action-pins.yml`](../../.github/workflows/verify-action-pins.yml)).
|
|
|
|
It installs Python, installs `semantica`, and verifies the import (pip caching is opt-in via `cache: 'pip'`, since not every caller repo has a requirements file to key the cache on) — see
|
|
[`.github/actions/setup-semantica/action.yml`](../../.github/actions/setup-semantica/action.yml).
|