static_code_checks.yaml

name: code checks

on:
  push:
    branches:
      - main
    paths:
      - .pre-commit-config.yaml
      - .github/workflows/static_code_checks.yaml
      - '**.py'
      - poetry.lock
      - pyproject.toml
      - '**.ipynb'
      - '**.tsx'
  pull_request:
    branches:
      - main
    paths:
      - .pre-commit-config.yaml
      - .github/workflows/static_code_checks.yaml
      - '**.py'
      - poetry.lock
      - pyproject.toml
      - '**.ipynb'
      - '**.tsx'
  workflow_dispatch:
    inputs:
      logLevel:
        description: 'Log level'
        required: true
        default: 'debug'
        type: choice
        options:
          - info
          - warning
          - debug

jobs:
  run-code-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4.2.2
      - name: Install and configure Poetry
        uses: snok/install-poetry@v1
        with:
          virtualenvs-create: true
          virtualenvs-in-project: true
      - uses: actions/setup-python@v5.3.0
        with:
          python-version: '3.10'
          cache: 'poetry'
      - name: Setup yarn
        uses: mskelton/setup-yarn@v3
      - name: Install dependencies and check code
        run: |
          yarn
          poetry env use '3.10'
          source .venv/bin/activate
          poetry install --with test --all-extras
          pre-commit run --all-files --verbose
      - name: pip-audit (gh-action-pip-audit)
        uses: pypa/gh-action-pip-audit@v1.1.0
        with:
          virtual-environment: .venv/
          # Skipping 3 cryptography issues that can't be patched because of FL4Health
          # Skipping 1 cryptography issue that can't be patched because of Flower
          # Skipping 1 torch issue that can't be ugraded because of torchvision
          ignore-vulns: |
            GHSA-3ww4-gg4f-jr7f
            GHSA-9v9h-cgj8-h64p
            GHSA-6vqw-3v5j-54x4
            GHSA-h4gh-qq45-vh27
            GHSA-pg7h-5qx3-wjr3