GitHub Scheduled Event Processor

name: GitHub Scheduled Event Processor

on:
  schedule:
    # These are generated/confirmed using https://crontab.cronhub.io/
    # Close stale issues, runs every day at 1am - CloseStaleIssues
    - cron: '0 1 * * *'
    # Identify stale pull requests, every Friday at 5am - IdentifyStalePullRequests
    - cron: '0 5 * * FRI'
    # Close stale pull requests, every 6 hours at 02:30 AM, 08:30 AM, 02:30 PM and 08:30 PM - CloseStalePullRequests
    - cron: '30 2,8,14,20 * * *'
    # Identify stale issues, every 6 hours at 03:30 AM, 09:30 AM, 03:30 PM and 09:30 PM - IdentifyStaleIssues
    - cron: '30 3,9,15,21 * * *'
    # Close addressed issues, every 6 hours at 04:30 AM, 10:30 AM, 04:30 PM and 10:30 PM - CloseAddressedIssues
    - cron: '30 4,10,16,22 * * *'
    # Lock closed issues, every 6 hours at 05:30 AM, 11:30 AM, 05:30 PM and 11:30 PM - LockClosedIssues
    - cron: '30 5,11,17,23 * * *'
    # Enforce max life of issues, every M,W,F at 10:00 AM PST - EnforceMaxLifeOfIssues
    # Note: GitHub uses UTC, to run at 10am PST, the cron task needs to be 6pm (1800 hours) UTC
    #       When scheduling for multiple days the numeric days 0-6 (0=Sunday) must be used.
    - cron: '0 18 * * 1,3,5'
# This removes all unnecessary permissions, the ones needed will be set below.
# https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
permissions: {}

jobs:
  event-handler:
    permissions:
      issues: write
      pull-requests: write
    name: Handle ${{ github.event.schedule }} ${{ github.event.action }} event
    runs-on: ubuntu-latest
    steps:
      # To run github-event-processor built from source, for testing purposes, uncomment everything
      # in between the Start/End-Build From Source comments and comment everything in between the
      # Start/End-Install comments
      # Start-Install
      - name: Install GitHub Event Processor
        run: >
          dotnet tool install
          Azure.Sdk.Tools.GitHubEventProcessor
          --version 1.0.0-dev.20240610.2
          --add-source https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-net/nuget/v3/index.json
          --global
        shell: bash
      # End-Install

      # Testing checkout of sources from the Azure/azure-sdk-tools repository
      # The ref: is the SHA from the pull request in that repository or the
      # refs/pull/<PRNumber>/merge for the latest on any given PR. If the repository
      # is a fork eg. <User>/azure-sdk-tools then the repository down below will
      # need to point to that fork
      # Start-Build
      # - name: Checkout tools repo for GitHub Event Processor sources
      #   uses: actions/checkout@v3
      #   with:
      #     repository: Azure/azure-sdk-tools
      #     path: azure-sdk-tools
      #     ref: <refs/pull/<PRNumber>/merge> or <sha>

      # - name: Build and install GitHubEventProcessor from sources
      #   run: |
      #     dotnet pack
      #     dotnet tool install --global --prerelease --add-source ../../../artifacts/packages/Debug Azure.Sdk.Tools.GitHubEventProcessor
      #   shell: bash
      #   working-directory: azure-sdk-tools/tools/github-event-processor/Azure.Sdk.Tools.GitHubEventProcessor
      # End-Build

      - name: Close Stale Issues Scheduled Event
        if: github.event.schedule == '0 1 * * *'
        run: |
          cat > payload.json << 'EOF'
          ${{ toJson(github.event) }}
          EOF
          github-event-processor ${{ github.event_name }} payload.json CloseStaleIssues
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Identify Stale PullRequests Scheduled Event
        if: github.event.schedule == '0 5 * * FRI'
        run: |
          cat > payload.json << 'EOF'
          ${{ toJson(github.event) }}
          EOF
          github-event-processor ${{ github.event_name }} payload.json IdentifyStalePullRequests
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Close Stale PullRequests Scheduled Event
        if: github.event.schedule == '30 2,8,14,20 * * *'
        run: |
          cat > payload.json << 'EOF'
          ${{ toJson(github.event) }}
          EOF
          github-event-processor ${{ github.event_name }} payload.json CloseStalePullRequests
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Identify Stale Issues Scheduled Event
        if: github.event.schedule == '30 3,9,15,21 * * *'
        run: |
          cat > payload.json << 'EOF'
          ${{ toJson(github.event) }}
          EOF
          github-event-processor ${{ github.event_name }} payload.json IdentifyStaleIssues
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Close Addressed Issues Scheduled Event
        if: github.event.schedule == '30 4,10,16,22 * * *'
        run: |
          cat > payload.json << 'EOF'
          ${{ toJson(github.event) }}
          EOF
          github-event-processor ${{ github.event_name }} payload.json CloseAddressedIssues
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Lock Closed Issues Scheduled Event
        if: github.event.schedule == '30 5,11,17,23 * * *'
        run: |
          cat > payload.json << 'EOF'
          ${{ toJson(github.event) }}
          EOF
          github-event-processor ${{ github.event_name }} payload.json LockClosedIssues
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Enforce Max Life of Issues Scheduled Event
        if: github.event.schedule == '0 18 * * 1,3,5'
        run: |
          cat > payload.json << 'EOF'
          ${{ toJson(github.event) }}
          EOF
          github-event-processor ${{ github.event_name }} payload.json EnforceMaxLifeOfIssues
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


on: [status]  # yamllint disable-line rule:truthy
jobs:
  circleci_artifacts_redirector_job:
    if: "${{ startsWith(github.event.context, 'ci/circleci: build_docs') }}"
    runs-on: ubuntu-20.04
    name: Run CircleCI artifacts redirector
    steps:
      - name: GitHub Action step
        uses: scientific-python/circleci-artifacts-redirector-action@master
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          api-token: ${{ secrets.CIRCLECI_TOKEN }}
          artifact-path: 0/html/sg_execution_times.html
          circleci-jobs: build_docs,build_docs_main
          job-title: Check the rendered docs here!


CodeQL

# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
#
# ******** NOTE ********
# We have attempted to detect the languages in your repository. Please check
# the `language` matrix defined below to confirm you have the correct set of
# supported CodeQL languages.
#
name: "CodeQL"

on:
  push:
    branches: [ "main" ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ "main" ]
  schedule:
    - cron: '44 14 * * 5'

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: [ 'javascript', 'python' ]
        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.

        # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
        # queries: security-extended,security-and-quality

    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
    - name: Autobuild
      uses: github/codeql-action/autobuild@v3

    # ℹ Command-line programs to run using the OS shell.
    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun

    #   If the Autobuild fails above, remove it and uncomment the following three lines.
    #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.

    # - run: |
    #   echo "Run, Build Application using script"
    #   ./location_of_script_within_repo/buildscript.sh

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3


Tests

name: 'Tests'
concurrency:
  group: ${{ github.workflow }}-${{ github.event.number }}-${{ github.event.ref }}
  cancel-in-progress: true
on:  # yamllint disable-line rule:truthy
  push:
    branches: ["main", "maint/*"]
  pull_request:
    branches: ["main", "maint/*"]

permissions:
  contents: read

jobs:
  style:
    name: Style
    runs-on: ubuntu-latest
    timeout-minutes: 3
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - uses: pre-commit/action@v3.0.1
      - run: pip install mypy numpy scipy vulture
      - run: mypy
      - run: vulture

  bandit:
    name: Bandit
    needs: style
    runs-on: ubuntu-latest
    steps:
      - uses: davidslusser/actions_python_bandit@v1.0.1
        with:
          src: "mne"
          options: "-c pyproject.toml -ll -r"
          pip_install_command: "pip install bandit[toml]"

  pytest:
    name: '${{ matrix.os }} / ${{ matrix.kind }} / ${{ matrix.python }}'
    needs: style
    timeout-minutes: 70
    continue-on-error: true
    runs-on: ${{ matrix.os }}
    defaults:
      run:
        shell: bash -el {0}
    env:
      PYTHON_VERSION: '${{ matrix.python }}'
      MKL_NUM_THREADS: '1'
      OPENBLAS_NUM_THREADS: '1'
      PYTHONUNBUFFERED: '1'
      MNE_CI_KIND: '${{ matrix.kind }}'
      CI_OS_NAME: '${{ matrix.os }}'
    strategy:
      matrix:
        include:
          - os: ubuntu-latest
            python: '3.12'
            kind: pip-pre
          - os: ubuntu-latest
            python: '3.12'
            kind: conda
          - os: macos-latest  # arm64 (Apple Silicon)
            python: '3.12'
            kind: mamba
          - os: macos-13  # latest Intel release
            python: '3.12'
            kind: mamba
          - os: windows-latest
            python: '3.10'
            kind: mamba
          - os: ubuntu-latest
            python: '3.9'
            kind: minimal
          - os: ubuntu-20.04
            python: '3.9'
            kind: old
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - run: ./tools/github_actions_env_vars.sh
      # Xvfb/OpenGL
      - uses: pyvista/setup-headless-display-action@main
        with:
          qt: true
          pyvista: false
      # Python (if pip)
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python }}
        if: startswith(matrix.kind, 'pip')
      # Python (if conda)
      - name: Remove numba and dipy
        run: |  # TODO: Remove when numba 0.59 and dipy 1.8 land on conda-forge
          sed -i '/numba/d' environment.yml
          sed -i '/dipy/d' environment.yml
          sed -i 's/- mne$/- mne-base/' environment.yml
        if: matrix.os == 'ubuntu-latest' && startswith(matrix.kind, 'conda') && matrix.python == '3.12'
      - uses: mamba-org/setup-micromamba@v1
        with:
          environment-file: ${{ env.CONDA_ENV }}
          environment-name: mne
          create-args: >-
            python=${{ env.PYTHON_VERSION }}
            mamba
        if: ${{ !startswith(matrix.kind, 'pip') }}
      # Make sure we have the right Python
      - run: python -c "import platform; assert platform.machine() == 'arm64', platform.machine()"
        if: matrix.os == 'macos-14'
      - run: ./tools/github_actions_dependencies.sh
      # Minimal commands on Linux (macOS stalls)
      - run: ./tools/get_minimal_commands.sh
        if: ${{ startswith(matrix.os, 'ubuntu') }}
      - run: ./tools/github_actions_infos.sh
      # Check Qt
      - run: ./tools/check_qt_import.sh $MNE_QT_BACKEND
        if: ${{ env.MNE_QT_BACKEND != '' }}
      - name: Run tests with no testing data
        run: MNE_SKIP_TESTING_DATASET_TESTS=true pytest -m "not (ultraslowtest or pgtest)" --tb=short --cov=mne --cov-report xml -vv -rfE mne/
        if: matrix.kind == 'minimal'
      - run: ./tools/get_testing_version.sh
      - uses: actions/cache@v4
        with:
          key: ${{ env.TESTING_VERSION }}
          path: ~/mne_data
      - run: ./tools/github_actions_download.sh
      - run: ./tools/github_actions_test.sh
      - uses: codecov/codecov-action@v4
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
        if: success()


Build

# Upload a Python Package using Twine when a release is created

name: Build
on:  # yamllint disable-line rule:truthy
  release:
    types: [published]
  push:
    branches: ["main", "maint/*"]
  pull_request:
    branches: ["main", "maint/*"]

permissions:
  contents: read

jobs:
  package:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.10'
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install build twine
      - run: python -m build --sdist --wheel
      - run: twine check --strict dist/*
      - uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist

  pypi-upload:
    needs: package
    runs-on: ubuntu-latest
    if: github.event_name == 'release'
    permissions:
      id-token: write  # for trusted publishing
    environment:
      name: pypi
      url: https://pypi.org/p/mne
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist
      - uses: pypa/gh-action-pypi-publish@release/v1
        if: github.event_name == 'release'


Changelog

name: Changelog

on:  # yamllint disable-line rule:truthy
  pull_request:
    types: [opened, synchronize, labeled, unlabeled]
    branches: ["main"]

jobs:
  changelog_checker:
    name: Check towncrier entry in doc/changes/devel/
    runs-on: ubuntu-latest
    steps:
      - uses: scientific-python/action-towncrier-changelog@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          BOT_USERNAME: changelog-bot


autofix.ci

name: autofix.ci

on:  # yamllint disable-line rule:truthy
  pull_request:
    types: [opened, synchronize, labeled, unlabeled]

permissions:
  contents: read

jobs:
  autofix:
    name: Autoupdate changelog entry
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - run: pip install --upgrade towncrier pygithub
      - run: python ./.github/actions/rename_towncrier/rename_towncrier.py
      - uses: autofix-ci/action@d3e591514b99d0fca6779455ff8338516663f7cc


Pull Request CI

# GENERATED, DO NOT EDIT!
# To change, edit `src/python/pants_release/generate_github_workflows.py` and run:
#   ./pants run src/python/pants_release/generate_github_workflows.py

concurrency:
  cancel-in-progress: true
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
env:
  PANTS_CONFIG_FILES: +['pants.ci.toml']
  RUST_BACKTRACE: all
jobs:
  bootstrap_pants_linux_arm64:
    env:
      PANTS_REMOTE_CACHE_READ: 'false'
      PANTS_REMOTE_CACHE_WRITE: 'false'
    if: (github.repository_owner == 'pantsbuild') && (needs.classify_changes.outputs.docs_only != 'true')
    name: Bootstrap Pants, test Rust (Linux-ARM64)
    needs:
    - classify_changes
    runs-on:
    - self-hosted
    - Linux
    - ARM64
    steps:
    - name: Check out code
      uses: actions/checkout@v3
      with:
        fetch-depth: 10
    - name: Install Protoc
      uses: arduino/setup-protoc@9b1ee5b22b0a3f1feb8c2ff99b32c89b3c3191e9
      with:
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        version: 23.x
    - name: Set rustup profile
      run: rustup set profile default
    - name: Cache Rust toolchain
      uses: actions/cache@v3
      with:
        key: Linux-ARM64-rustup-${{ hashFiles('src/rust/engine/rust-toolchain') }}-v2
        path: '~/.rustup/toolchains/1.78.0-*

          ~/.rustup/update-hashes

          ~/.rustup/settings.toml

          '
    - name: Cache Cargo
      uses: benjyw/rust-cache@461b9f8eee66b575bce78977bf649b8b7a8d53f1
      with:
        cache-bin: 'false'
        shared-key: engine
        workspaces: src/rust/engine
    - id: get-engine-hash
      name: Get native engine hash
      run: echo "hash=$(./build-support/bin/rust/print_engine_hash.sh)" >> $GITHUB_OUTPUT
      shell: bash
    - name: Cache native engine
      uses: actions/cache@v3
      with:
        key: Linux-ARM64-engine-${{ steps.get-engine-hash.outputs.hash }}-v1
        path: 'src/python/pants/bin/native_client

          src/python/pants/engine/internals/native_engine.so

          src/python/pants/engine/internals/native_engine.so.metadata'
    - name: Bootstrap Pants
      run: ./pants version > ${{ runner.temp }}/_pants_version.stdout && [[ -s ${{ runner.temp }}/_pants_version.stdout ]]
    - name: Run smoke tests
      run: './pants list ::

        ./pants roots

        ./pants help goals

        ./pants help targets

        ./pants help subsystems

        '
    - continue-on-error: true
      if: always()
      name: Upload pants.log
      uses: actions/upload-artifact@v3
      with:
        name: logs-bootstrap-Linux-ARM64
        path: .pants.d/workdir/*.log
    - name: Upload native binaries
      uses: actions/upload-artifact@v3
      with:
        name: native_binaries.${{ matrix.python-version }}.Linux-ARM64
        path: 'src/python/pants/bin/native_client

          src/python/pants/engine/internals/native_engine.so

          src/python/pants/engine/internals/native_engine.so.metadata'
    - env:
        TMPDIR: ${{ runner.temp }}
      if: needs.classify_changes.outputs.rust == 'true'
      name: Test Rust
      run: ./cargo test --locked --tests -- --nocapture --test-threads=8
    timeout-minutes: 60
  bootstrap_pants_linux_x86_64:
    env:
      PANTS_REMOTE_CACHE_READ: 'false'
      PANTS_REMOTE_CACHE_WRITE: 'false'
    if: (github.repository_owner == 'pantsbuild') && (needs.classify_changes.outputs.docs_only != 'true')
    name: Bootstrap Pants, test and lint Rust (Linux-x86_64)
    needs:
    - classify_changes
    runs-on:
    - ubuntu-20.04
    steps:
    - name: Check out code
      uses: actions/checkout@v3
      with:
        fetch-depth: 10
    - name: Set up Python 3.9
      uses: actions/setup-python@v4
      with:
        python-version: '3.9'
    - name: Install Protoc
      uses: arduino/setup-protoc@9b1ee5b22b0a3f1feb8c2ff99b32c89b3c3191e9
      with:
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        version: 23.x
    - name: Set rustup profile
      run: rustup set profile default
    - name: Cache Rust toolchain
      uses: actions/cache@v3
      with:
        key: Linux-x86_64-rustup-${{ hashFiles('src/rust/engine/rust-toolchain') }}-v2
        path: '~/.rustup/toolchains/1.78.0-*

          ~/.rustup/update-hashes

          ~/.rustup/settings.toml

          '
    - name: Cache Cargo
      uses: benjyw/rust-cache@461b9f8eee66b575bce78977bf649b8b7a8d53f1
      with:
        cache-bin: 'false'
        shared-key: engine
        workspaces: src/rust/engine
    - id: get-engine-hash
      name: Get native engine hash
      run: echo "hash=$(./build-support/bin/rust/print_engine_hash.sh)" >> $GITHUB_OUTPUT
      shell: bash
    - name: Cache native engine
      uses: actions/cache@v3
      with:
        key: Linux-x86_64-engine-${{ steps.get-engine-hash.outputs.hash }}-v1
        path: 'src/python/pants/bin/native_client

          src/python/pants/engine/internals/native_engine.so

          src/python/pants/engine/internals/native_engine.so.metadata'
    - name: Bootstrap Pants
      run: ./pants version > ${{ runner.temp }}/_pants_version.stdout && [[ -s ${{ runner.temp }}/_pants_version.stdout ]]
    - name: Run smoke tests
      run: './pants list ::

        ./pants roots

        ./pants help goals

        ./pants help targets

        ./pants help subsystems

        '
    - continue-on-error: true
      if: always()
      name: Upload pants.log
      uses: actions/upload-artifact@v3
      with:
        name: logs-bootstrap-Linux-x86_64
        path: .pants.d/workdir/*.log
    - name: Upload native binaries
      uses: actions/upload-artifact@v3
      with:
        name: native_binaries.${{ matrix.python-version }}.Linux-x86_64
        path: 'src/python/pants/bin/native_client

          src/python/pants/engine/internals/native_engine.so

          src/python/pants/engine/internals/native_engine.so.metadata'
    - name: Validate CI config
      run: './pants run src/python/pants_release/generate_github_workflows.py -- --check

        '
    - env:
        TMPDIR: ${{ runner.temp }}
      if: needs.classify_changes.outputs.rust == 'true'
      name: Test and lint Rust
      run: 'sudo apt-get install -y pkg-config fuse libfuse-dev

        ./build-support/bin/check_rust_pre_commit.sh

        ./cargo test --locked --all --tests --benches -- --nocapture

        ./cargo doc'
    timeout-minutes: 60
  bootstrap_pants_macos12_x86_64:
    env:
      PANTS_REMOTE_CACHE_READ: 'false'
      PANTS_REMOTE_CACHE_WRITE: 'false'
    if: (github.repository_owner == 'pantsbuild') && (needs.classify_changes.outputs.docs_only != 'true')
    name: Bootstrap Pants, test Rust (macOS12-x86_64)
    needs:
    - classify_changes
    runs-on:
    - macos-12
    steps:
    - name: Check out code
      uses: actions/checkout@v3
      with:
        fetch-depth: 10
    - name: Set up Python 3.9
      uses: actions/setup-python@v4
      with:
        python-version: '3.9'
    - name: Install Protoc
      uses: arduino/setup-protoc@9b1ee5b22b0a3f1feb8c2ff99b32c89b3c3191e9
      with:
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        version: 23.x
    - name: Set rustup profile
      run: rustup set profile default
    - name: Cache Rust toolchain
      uses: actions/cache@v3
      with:
        key: macOS12-x86_64-rustup-${{ hashFiles('src/rust/engine/rust-toolchain') }}-v2
        path: '~/.rustup/toolchains/1.78.0-*

          ~/.rustup/update-hashes

          ~/.rustup/settings.toml

          '
    - name: Cache Cargo
      uses: benjyw/rust-cache@461b9f8eee66b575bce78977bf649b8b7a8d53f1
      with:
        cache-bin: 'false'
        shared-key: engine
        workspaces: src/rust/engine
    - id: get-engine-hash
      name: Get native engine hash
      run: echo "hash=$(./build-support/bin/rust/print_engine_hash.sh)" >> $GITHUB_OUTPUT
      shell: bash
    - name: Cache native engine
      uses: actions/cache@v3
      with:
        key: macOS12-x86_64-engine-${{ steps.get-engine-hash.outputs.hash }}-v1
        path: 'src/python/pants/bin/native_client

          src/python/pants/engine/internals/native_engine.so

          src/python/pants/engine/internals/native_engine.so.metadata'
    - name: Bootstrap Pants
      run: ./pants version > ${{ runner.temp }}/_pants_version.stdout && [[ -s ${{ runner.temp }}/_pants_version.stdout ]]
    - name: Run smoke tests
      run: './pants list ::

        ./pants roots

        ./pants help goals

        ./pants help targets

        ./pants help subsystems

        '
    - continue-on-error: true
      if: always()
      name: Upload pants.log
      uses: actions/upload-artifact@v3
      with:
        name: logs-bootstrap-macOS12-x86_64
        path: .pants.d/workdir/*.log
    - name: Upload native binaries
      uses: actions/upload-artifact@v3
      with:
        name: native_binaries.${{ matrix.python-version }}.macOS12-x86_64
        path: 'src/python/pants/bin/native_client

          src/python/pants/engine/internals/native_engine.so

          src/python/pants/engine/internals/native_engine.so.metadata'
    - env:
        TMPDIR: ${{ runner.temp }}
      if: needs.classify_changes.outputs.rust == 'true'
      name: Test Rust
      run: ./cargo test --locked --tests -- --nocapture
    timeout-minutes: 60
  build_wheels_linux_arm64:
    container:
      image: ghcr.io/pantsbuild/wheel_build_aarch64:v3-8384c5cf
    env:
      MODE: debug
      PANTS_REMOTE_CACHE_READ: 'false'
      PANTS_REMOTE_CACHE_WRITE: 'false'
    if: ((github.repository_owner == 'pantsbuild') && (needs.classify_changes.outputs.release == 'true')) && (needs.classify_changes.outputs.docs_only
      != 'true')
    name: Build wheels (Linux-ARM64)
    needs:
    - classify_changes
    runs-on:
    - self-hosted
    - Linux
    - ARM64
    steps:
    - name: Check out code
      uses: actions/checkout@v3
      with:
        fetch-depth: 10
    - name: Configure Git
      run: git config --global safe.directory "$GITHUB_WORKSPACE"
    - name: Install rustup
      run: 'curl --proto ''=https'' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -v -y --default-toolchain none

        echo "${HOME}/.cargo/bin" >> $GITHUB_PATH

        '
    - name: Expose Pythons
      run: 'echo "/opt/python/cp37-cp37m/bin" >> $GITHUB_PATH

        echo "/opt/python/cp38-cp38/bin" >> $GITHUB_PATH

        echo "/opt/python/cp39-cp39/bin" >> $GITHUB_PATH

        '
    - name: Install Protoc
      uses: arduino/setup-protoc@9b1ee5b22b0a3f1feb8c2ff99b32c89b3c3191e9
      with:
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        version: 23.x
    - env:
        PANTS_CONFIG_FILES: +['pants.ci.toml','pants.ci.aarch64.toml']
      name: Build wheels
      run: ./pants run src/python/pants_release/release.py -- build-wheels
    - env:
        PANTS_CONFIG_FILES: +['pants.ci.toml','pants.ci.aarch64.toml']
      name: Build Pants PEX
      run: ./pants package src/python/pants:pants-pex
    - continue-on-error: true
      if: always()
      name: Upload pants.log
      uses: actions/upload-artifact@v3
      with:
        name: logs-wheels-and-pex-Linux-ARM64
        path: .pants.d/workdir/*.log
    timeout-minutes: 90
  build_wheels_linux_x86_64:
    container:
      image: quay.io/pypa/manylinux2014_x86_64:latest
    env:
      MODE: debug
      PANTS_REMOTE_CACHE_READ: 'false'
      PANTS_REMOTE_CACHE_WRITE: 'false'
    if: ((github.repository_owner == 'pantsbuild') && (needs.classify_changes.outputs.release == 'true')) && (needs.classify_changes.outputs.docs_only
      != 'true')
    name: Build wheels (Linux-x86_64)
    needs:
    - classify_changes
    runs-on:
    - ubuntu-20.04
    steps:
    - name: Check out code
      uses: actions/checkout@v3
      with:
        fetch-depth: 10
    - name: Configure Git
      run: git config --global safe.directory "$GITHUB_WORKSPACE"
    - name: Install rustup
      run: 'curl --proto ''=https'' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -v -y --default-toolchain none

        echo "${HOME}/.cargo/bin" >> $GITHUB_PATH

        '
    - name: Expose Pythons
      run: 'echo "/opt/python/cp37-cp37m/bin" >> $GITHUB_PATH

        echo "/opt/python/cp38-cp38/bin" >> $GITHUB_PATH

        echo "/opt/python/cp39-cp39/bin" >> $GITHUB_PATH

        '
    - name: Install Protoc
      uses: arduino/setup-protoc@9b1ee5b22b0a3f1feb8c2ff99b32c89b3c3191e9
      with:
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        version: 23.x
    - name: Install Go
      uses: actions/setup-go@v3
      with:
        go-version: 1.19.5
    - env:
        PANTS_PROCESS_EXECUTION_LOCAL_PARALLELISM: '1'
      name: Build wheels
      run: ./pants run src/python/pants_release/release.py -- build-wheels
    - env:
        PANTS_PROCESS_EXECUTION_LOCAL_PARALLELISM: '1'
      name: Build Pants PEX
      run: ./pants package src/python/pants:pants-pex
    - continue-on-error: true
      if: always()
      name: Upload pants.log
      uses: actions/upload-artifact@v3
      with:
        name: logs-wheels-and-pex-Linux-x86_64
        path: .pants.d/workdir/*.log
    timeout-minutes: 90
  build_wheels_macos10_15_x86_64:
    env:
      MODE: debug
      PANTS_REMOTE_CACHE_READ: 'false'
      PANTS_REMOTE_CACHE_WRITE: 'false'
    if: ((github.repository_owner == 'pantsbuild') && (needs.classify_changes.outputs.release == 'true')) && (needs.classify_changes.outputs.docs_only
      != 'true')
    name: Build wheels (macOS10-15-x86_64)
    needs:
    - classify_changes
    runs-on:
    - self-hosted
    - macOS-10.15-X64
    steps:
    - name: Check out code
      uses: actions/checkout@v3
      with:
        fetch-depth: 10
    - name: Install Protoc
      uses: arduino/setup-protoc@9b1ee5b22b0a3f1feb8c2ff99b32c89b3c3191e9
      with:
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        version: 23.x
    - name: Set rustup profile
      run: rustup set profile default
    - name: Cache Rust toolchain
      uses: actions/cache@v3
      with:
        key: macOS10-15-x86_64-rustup-${{ hashFiles('src/rust/engine/rust-toolchain') }}-v2
        path: '~/.rustup/toolchains/1.78.0-*

          ~/.rustup/update-hashes

          ~/.rustup/settings.toml

          '
    - name: Cache Cargo
      uses: benjyw/rust-cache@461b9f8eee66b575bce78977bf649b8b7a8d53f1
      with:
        cache-bin: 'false'
        shared-key: engine
        workspaces: src/rust/engine
    - name: Install Protoc
      uses: arduino/setup-protoc@9b1ee5b22b0a3f1feb8c2ff99b32c89b3c3191e9
      with:
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        version: 23.x
    - name: Install Go
      uses: actions/setup-go@v3
      with:
        go-version: 1.19.5
    - env:
        ARCHFLAGS: -arch x86_64
      name: Build wheels
      run: ./pants run src/python/pants_release/release.py -- build-wheels
    - env:
        ARCHFLAGS: -arch x86_64
      name: Build Pants PEX
      run: ./pants package src/python/pants:pants-pex
    - continue-on-error: true
      if: always()
      name: Upload pants.log
      uses: actions/upload-artifact@v3
      with:
        name: logs-wheels-and-pex-macOS10-15-x86_64
        path: .pants.d/workdir/*.log
    timeout-minutes: 90
  build_wheels_macos11_arm64:
    env:
      MODE: debug
      PANTS_REMOTE_CACHE_READ: 'false'
      PANTS_REMOTE_CACHE_WRITE: 'false'
    if: ((github.repository_owner == 'pantsbuild') && (needs.classify_changes.outputs.release == 'true')) && (needs.classify_changes.outputs.docs_only
      != 'true')
    name: Build wheels (macOS11-ARM64)
    needs:
    - classify_changes
    runs-on:
    - self-hosted
    - macOS-11-ARM64
    steps:
    - name: Check out code
      uses: actions/checkout@v3
      with:
        fetch-depth: 10
    - name: Install Protoc
      uses: arduino/setup-protoc@9b1ee5b22b0a3f1feb8c2ff99b32c89b3c3191e9
      with:
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        version: 23.x
    - name: Set rustup profile
      run: rustup set profile default
    - name: Cache Rust toolchain
      uses: actions/cache@v3
      with:
        key: macOS11-ARM64-rustup-${{ hashFiles('src/rust/engine/rust-toolchain') }}-v2
        path: '~/.rustup/toolchains/1.78.0-*

          ~/.rustup/update-hashes

          ~/.rustup/settings.toml

          '
    - name: Cache Cargo
      uses: benjyw/rust-cache@461b9f8eee66b575bce78977bf649b8b7a8d53f1
      with:
        cache-bin: 'false'
        shared-key: engine
        workspaces: src/rust/engine
    - name: Install Protoc
      uses: arduino/setup-protoc@9b1ee5b22b0a3f1feb8c2ff99b32c89b3c3191e9
      with:
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        version: 23.x
    - name: Install Go
      uses: actions/setup-go@v3
      with:
        go-version: 1.19.5
    - env:
        ARCHFLAGS: -arch arm64
      name: Build wheels
      run: ./pants run src/python/pants_release/release.py -- build-wheels
    - env:
        ARCHFLAGS: -arch arm64
      name: Build Pants PEX
      run: ./pants package src/python/pants:pants-pex
    - continue-on-error: true
      if: always()
      name: Upload pants.log
      uses: actions/upload-artifact@v3
      with:
        name: logs-wheels-and-pex-macOS11-ARM64
        path: .pants.d/workdir/*.log
    timeout-minutes: 90
  check_labels:
    if: github.repository_owner == 'pantsbuild'
    name: Ensure PR has a category label
    runs-on:
    - ubuntu-20.04
    steps:
    - env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      if: github.event_name == 'pull_request'
      name: Ensure category label
      uses: mheap/github-action-required-labels@v4.0.0
      with:
        count: 1
        labels: category:new feature, category:user api change, category:plugin api change, category:performance, category:bugfix,
          category:documentation, category:internal
        mode: exactly
  check_release_notes:
    if: github.repository_owner == 'pantsbuild'
    name: Ensure PR has release notes
    needs:
    - classify_changes
    runs-on:
    - ubuntu-20.04
    steps:
    - env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      if: github.event_name == 'pull_request' && !needs.classify_changes.outputs.notes
      name: Ensure appropriate label
      uses: mheap/github-action-required-labels@v4.0.0
      with:
        count: 1
        labels: release-notes:not-required, category:internal
        message: "\nPlease do one of:\n\n- add release notes to the appropriate file in `docs/notes`\n\n- label this PR with\
          \ `release-notes:not-required` if it does not need them (for\n  instance, if this is fixing a minor typo in documentation)\n\
          \n- label this PR with `category:internal` if it's an internal change\n\nFeel free to ask a maintainer for help\
          \ if you are not sure what is appropriate!\n"
        mode: minimum
  classify_changes:
    if: github.repository_owner == 'pantsbuild'
    name: Classify changes
    outputs:
      ci_config: ${{ steps.classify.outputs.ci_config }}
      docs: ${{ steps.classify.outputs.docs }}
      docs_only: ${{ steps.classify.outputs.docs_only }}
      notes: ${{ steps.classify.outputs.notes }}
      other: ${{ steps.classify.outputs.other }}
      release: ${{ steps.classify.outputs.release }}
      rust: ${{ steps.classify.outputs.rust }}
    runs-on:
    - ubuntu-20.04
    steps:
    - name: Check out code
      uses: actions/checkout@v3
      with:
        fetch-depth: 10
    - id: classify
      name: Classify changed files
      run: "if [[ -z $GITHUB_EVENT_PULL_REQUEST_BASE_SHA ]]; then\n  # push: compare to the immediate parent, which should\
        \ already be fetched\n  # (checkout's fetch_depth defaults to 10)\n  comparison_sha=$(git rev-parse HEAD^)\nelse\n\
        \  # pull request: compare to the base branch, ensuring that commit exists\n  git fetch --depth=1 \"$GITHUB_EVENT_PULL_REQUEST_BASE_SHA\"\
        \n  comparison_sha=\"$GITHUB_EVENT_PULL_REQUEST_BASE_SHA\"\nfi\necho \"comparison_sha=$comparison_sha\"\n\naffected=$(git\
        \ diff --name-only \"$comparison_sha\" HEAD | python build-support/bin/classify_changed_files.py)\necho \"Affected:\"\
        \nif [[ \"${affected}\" == \"docs\" || \"${affected}\" == \"docs notes\" ]]; then\n  echo \"docs_only=true\" | tee\
        \ -a $GITHUB_OUTPUT\nfi\nfor i in ${affected}; do\n  echo \"${i}=true\" | tee -a $GITHUB_OUTPUT\ndone\n"
  lint_python:
    if: (github.repository_owner == 'pantsbuild') && (needs.classify_changes.outputs.docs_only != 'true')
    name: Lint Python and Shell
    needs:
    - bootstrap_pants_linux_x86_64
    - classify_changes
    runs-on:
    - ubuntu-20.04
    steps:
    - name: Check out code
      uses: actions/checkout@v3
      with:
        fetch-depth: 10
    - env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      name: Launch bazel-remote
      run: "mkdir -p ~/bazel-remote\nif [[ -z \"${AWS_ACCESS_KEY_ID}\" ]]; then\n  CACHE_WRITE=false\n  # If no secret read/write\
        \ creds, use hard-coded read-only creds, so that\n  # cross-fork PRs can at least read from the cache.\n  # These\
        \ creds are hard-coded here in this public repo, which makes the bucket\n  # world-readable. But since putting raw\
        \ AWS tokens in a public repo, even\n  # deliberately, is icky, we base64-them. This will at least help hide from\n\
        \  # automated scanners that look for checked in AWS keys.\n  # Not that it would be terrible if we were scanned,\
        \ since this is public\n  # on purpose, but it's best not to draw attention.\n  AWS_ACCESS_KEY_ID=$(echo 'QUtJQVY2QTZHN1JRVkJJUVM1RUEK'\
        \ | base64 -d)\n  AWS_SECRET_ACCESS_KEY=$(echo 'd3dOQ1k1eHJJWVVtejZBblV6M0l1endXV0loQWZWcW9GZlVjMDlKRwo=' | base64\
        \ -d)\nelse\n  CACHE_WRITE=true\nfi\ndocker run --detach -u 1001:1000                   -v ~/bazel-remote:/data  \
        \                 -p 9092:9092                   buchgr/bazel-remote-cache:v2.4.1                   --s3.auth_method=access_key\
        \                   --s3.access_key_id=\"${AWS_ACCESS_KEY_ID}\"                   --s3.secret_access_key=\"${AWS_SECRET_ACCESS_KEY}\"\
        \                   --s3.bucket=cache.pantsbuild.org                   --s3.endpoint=s3.us-east-1.amazonaws.com  \
        \                 --max_size 30\necho \"PANTS_REMOTE_STORE_ADDRESS=grpc://localhost:9092\" >> \"$GITHUB_ENV\"\necho\
        \ \"PANTS_REMOTE_CACHE_READ=true\" >> \"$GITHUB_ENV\"\necho \"PANTS_REMOTE_CACHE_WRITE=${CACHE_WRITE}\" >> \"$GITHUB_ENV\"\
        \n"
    - name: Set up Python 3.9
      uses: actions/setup-python@v4
      with:
        python-version: '3.9'
    - name: Download native binaries
      uses: actions/download-artifact@v3
      with:
        name: native_binaries.${{ matrix.python-version }}.Linux-x86_64
        path: src/python/pants
    - name: Make native-client runnable
      run: chmod +x src/python/pants/bin/native_client
    - name: Lint
      run: './pants lint check ::

        '
    - continue-on-error: true
      if: always()
      name: Upload pants.log
      uses: actions/upload-artifact@v3
      with:
        name: logs-lint-Linux-x86_64
        path: .pants.d/workdir/*.log
    timeout-minutes: 30
  merge_ok:
    if: always()
    name: Merge OK
    needs:
    - set_merge_ok
    runs-on:
    - ubuntu-20.04
    steps:
    - run: "merge_ok=\"${{ needs.set_merge_ok.outputs.merge_ok }}\"\nif [[ \"${merge_ok}\" == \"true\" ]]; then\n    echo\
        \ \"Merge OK\"\n    exit 0\nelse\n    echo \"Merge NOT OK\"\n    exit 1\nfi\n"
  set_merge_ok:
    if: always() && !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled')
    name: Set Merge OK
    needs:
    - classify_changes
    - check_labels
    - check_release_notes
    - bootstrap_pants_linux_arm64
    - bootstrap_pants_linux_x86_64
    - bootstrap_pants_macos12_x86_64
    - build_wheels_linux_arm64
    - build_wheels_linux_x86_64
    - build_wheels_macos10_15_x86_64
    - build_wheels_macos11_arm64
    - check_labels
    - check_release_notes
    - classify_changes
    - lint_python
    - test_python_linux_arm64
    - test_python_linux_x86_64_0
    - test_python_linux_x86_64_1
    - test_python_linux_x86_64_2
    - test_python_linux_x86_64_3
    - test_python_linux_x86_64_4
    - test_python_linux_x86_64_5
    - test_python_linux_x86_64_6
    - test_python_linux_x86_64_7
    - test_python_linux_x86_64_8
    - test_python_linux_x86_64_9
    - test_python_macos12_x86_64
    outputs:
      merge_ok: ${{ steps.set_merge_ok.outputs.merge_ok }}
    runs-on:
    - ubuntu-20.04
    steps:
    - id: set_merge_ok
      run: echo 'merge_ok=true' >> ${GITHUB_OUTPUT}
  test_python_linux_arm64:
    env:
      PANTS_CONFIG_FILES: +['pants.ci.toml','pants.ci.aarch64.toml']
    if: (github.repository_owner == 'pantsbuild') && (needs.classify_changes.outputs.docs_only != 'true')
    name: Test Python (Linux-ARM64)
    needs:
    - bootstrap_pants_linux_arm64
    - classify_changes
    runs-on:
    - self-hosted
    - Linux
    - ARM64
    steps:
    - name: Check out code
      uses: actions/checkout@v3
      with:
        fetch-depth: 10
    - name: Install AdoptJDK
      uses: actions/setup-java@v3
      with:
        distribution: adopt
        java-version: '11'
    - name: Download native binaries
      uses: actions/download-artifact@v3
      with:
        name: native_binaries.${{ matrix.python-version }}.Linux-ARM64
        path: src/python/pants
    - name: Make native-client runnable
      run: chmod +x src/python/pants/bin/native_client
    - name: Run Python tests
      run: './pants --tag=+platform_specific_behavior test :: -- -m platform_specific_behavior

        '
    - continue-on-error: true
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      if: always()
      name: Upload test reports
      run: 'export S3_DST=s3://logs.pantsbuild.org/test/reports/Linux-ARM64/$(git show --no-patch --format=%cd --date=format:%Y-%m-%d)/${GITHUB_REF_NAME//\//_}/${GITHUB_RUN_ID}/${GITHUB_RUN_ATTEMPT}/${GITHUB_JOB}

        echo "Uploading test reports to ${S3_DST}"

        ./pants run ./src/python/pants_release/copy_to_s3.py                   --                   --src-prefix=dist/test/reports                   --dst-prefix=${S3_DST}                   --path=""

        '
    - continue-on-error: true
      if: always()
      name: Upload pants.log
      uses: actions/upload-artifact@v3
      with:
        name: logs-python-test-Linux-ARM64
        path: .pants.d/workdir/*.log
    timeout-minutes: 90
  test_python_linux_x86_64_0:
    env:
      PANTS_PROCESS_EXECUTION_LOCAL_PARALLELISM: '1'
    if: (github.repository_owner == 'pantsbuild') && (needs.classify_changes.outputs.docs_only != 'true')
    name: Test Python (Linux-x86_64) Shard 0/10
    needs:
    - bootstrap_pants_linux_x86_64
    - classify_changes
    runs-on:
    - ubuntu-20.04
    steps:
    - name: Check out code
      uses: actions/checkout@v3
      with:
        fetch-depth: 10
    - env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      name: Launch bazel-remote
      run: "mkdir -p ~/bazel-remote\nif [[ -z \"${AWS_ACCESS_KEY_ID}\" ]]; then\n  CACHE_WRITE=false\n  # If no secret read/write\
        \ creds, use hard-coded read-only creds, so that\n  # cross-fork PRs can at least read from the cache.\n  # These\
        \ creds are hard-coded here in this public repo, which makes the bucket\n  # world-readable. But since putting raw\
        \ AWS tokens in a public repo, even\n  # deliberately, is icky, we base64-them. This will at least help hide from\n\
        \  # automated scanners that look for checked in AWS keys.\n  # Not that it would be terrible if we were scanned,\
        \ since this is public\n  # on purpose, but it's best not to draw attention.\n  AWS_ACCESS_KEY_ID=$(echo 'QUtJQVY2QTZHN1JRVkJJUVM1RUEK'\
        \ | base64 -d)\n  AWS_SECRET_ACCESS_KEY=$(echo 'd3dOQ1k1eHJJWVVtejZBblV6M0l1endXV0loQWZWcW9GZlVjMDlKRwo=' | base64\
        \ -d)\nelse\n  CACHE_WRITE=true\nfi\ndocker run --detach -u 1001:1000                   -v ~/bazel-remote:/data  \
        \                 -p 9092:9092                   buchgr/bazel-remote-cache:v2.4.1                   --s3.auth_method=access_key\
        \                   --s3.access_key_id=\"${AWS_ACCESS_KEY_ID}\"                   --s3.secret_access_key=\"${AWS_SECRET_ACCESS_KEY}\"\
        \                   --s3.bucket=cache.pantsbuild.org                   --s3.endpoint=s3.us-east-1.amazonaws.com  \
        \                 --max_size 30\necho \"PANTS_REMOTE_STORE_ADDRESS=grpc://localhost:9092\" >> \"$GITHUB_ENV\"\necho\
        \ \"PANTS_REMOTE_CACHE_READ=true\" >> \"$GITHUB_ENV\"\necho \"PANTS_REMOTE_CACHE_WRITE=${CACHE_WRITE}\" >> \"$GITHUB_ENV\"\
        \n"
    - name: Install AdoptJDK
      uses: actions/setup-java@v3
      with:
        distribution: adopt
        java-version: '11'
    - name: Install Go
      uses: actions/setup-go@v3
      with:
        go-version: 1.19.5
    - if: runner.os == 'Linux'
      name: Download Apache `thrift` binary (Linux)
      run: 'mkdir -p "${HOME}/.thrift"

        curl --fail -L https://binaries.pantsbuild.org/bin/thrift/linux/x86_64/0.15.0/thrift -o "${HOME}/.thrift/thrift"

        chmod +x "${HOME}/.thrift/thrift"

        echo "${HOME}/.thrift" >> $GITHUB_PATH

        '
    - name: Set up Python 3.9
      uses: actions/setup-python@v4
      with:
        python-version: '3.9'
    - name: Expose Pythons
      uses: pantsbuild/actions/expose-pythons@627a8ce25d972afa03da1641be9261bbbe0e3ffe
    - name: Download native binaries
      uses: actions/download-artifact@v3
      with:
        name: native_binaries.${{ matrix.python-version }}.Linux-x86_64
        path: src/python/pants
    - name: Make native-client runnable
      run: chmod +x src/python/pants/bin/native_client
    - name: Run Python test shard 0/10
      run: './pants test --shard=0/10 ::

        '
    - continue-on-error: true
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      if: always()
      name: Upload test reports
      run: 'export S3_DST=s3://logs.pantsbuild.org/test/reports/Linux-x86_64/$(git show --no-patch --format=%cd --date=format:%Y-%m-%d)/${GITHUB_REF_NAME//\//_}/${GITHUB_RUN_ID}/${GITHUB_RUN_ATTEMPT}/${GITHUB_JOB}

        echo "Uploading test reports to ${S3_DST}"

        ./pants run ./src/python/pants_release/copy_to_s3.py                   --                   --src-prefix=dist/test/reports                   --dst-prefix=${S3_DST}                   --path=""

        '
    - continue-on-error: true
      if: always()
      name: Upload pants.log
      uses: actions/upload-artifact@v3
      with:
        name: logs-python-test-0_10-Linux-x86_64
        path: .pants.d/workdir/*.log
    timeout-minutes: 90
  test_python_linux_x86_64_1:
    env:
      PANTS_PROCESS_EXECUTION_LOCAL_PARALLELISM: '1'
    if: (github.repository_owner == 'pantsbuild') && (needs.classify_changes.outputs.docs_only != 'true')
    name: Test Python (Linux-x86_64) Shard 1/10
    needs:
    - bootstrap_pants_linux_x86_64
    - classify_changes
    runs-on:
    - ubuntu-20.04
    steps:
    - name: Check out code
      uses: actions/checkout@v3
      with:
        fetch-depth: 10
    - env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      name: Launch bazel-remote
      run: "mkdir -p ~/bazel-remote\nif [[ -z \"${AWS_ACCESS_KEY_ID}\" ]]; then\n  CACHE_WRITE=false\n  # If no secret read/write\
        \ creds, use hard-coded read-only creds, so that\n  # cross-fork PRs can at least read from the cache.\n  # These\
        \ creds are hard-coded here in this public repo, which makes the bucket\n  # world-readable. But since putting raw\
        \ AWS tokens in a public repo, even\n  # deliberately, is icky, we base64-them. This will at least help hide from\n\
        \  # automated scanners that look for checked in AWS keys.\n  # Not that it would be terrible if we were scanned,\
        \ since this is public\n  # on purpose, but it's best not to draw attention.\n  AWS_ACCESS_KEY_ID=$(echo 'QUtJQVY2QTZHN1JRVkJJUVM1RUEK'\
        \ | base64 -d)\n  AWS_SECRET_ACCESS_KEY=$(echo 'd3dOQ1k1eHJJWVVtejZBblV6M0l1endXV0loQWZWcW9GZlVjMDlKRwo=' | base64\
        \ -d)\nelse\n  CACHE_WRITE=true\nfi\ndocker run --detach -u 1001:1000                   -v ~/bazel-remote:/data  \
        \                 -p 9092:9092                   buchgr/bazel-remote-cache:v2.4.1                   --s3.auth_method=access_key\
        \                   --s3.access_key_id=\"${AWS_ACCESS_KEY_ID}\"                   --s3.secret_access_key=\"${AWS_SECRET_ACCESS_KEY}\"\
        \                   --s3.bucket=cache.pantsbuild.org                   --s3.endpoint=s3.us-east-1.amazonaws.com  \
        \                 --max_size 30\necho \"PANTS_REMOTE_STORE_ADDRESS=grpc://localhost:9092\" >> \"$GITHUB_ENV\"\necho\
        \ \"PANTS_REMOTE_CACHE_READ=true\" >> \"$GITHUB_ENV\"\necho \"PANTS_REMOTE_CACHE_WRITE=${CACHE_WRITE}\" >> \"$GITHUB_ENV\"\
        \n"
    - name: Install AdoptJDK
      uses: actions/setup-java@v3
      with:
        distribution: adopt
        java-version: '11'
    - name: Install Go
      uses: actions/setup-go@v3
      with:
        go-version: 1.19.5
    - if: runner.os == 'Linux'
      name: Download Apache `thrift` binary (Linux)
      run: 'mkdir -p "${HOME}/.thrift"

        curl --fail -L https://binaries.pantsbuild.org/bin/thrift/linux/x86_64/0.15.0/thrift -o "${HOME}/.thrift/thrift"

        chmod +x "${HOME}/.thrift/thrift"

        echo "${HOME}/.thrift" >> $GITHUB_PATH

        '
    - name: Set up Python 3.9
      uses: actions/setup-python@v4
      with:
        python-version: '3.9'
    - name: Expose Pythons
      uses: pantsbuild/actions/expose-pythons@627a8ce25d972afa03da1641be9261bbbe0e3ffe
    - name: Download native binaries
      uses: actions/download-artifact@v3
      with:
        name: native_binaries.${{ matrix.python-version }}.Linux-x86_64
        path: src/python/pants
    - name: Make native-client runnable
      run: chmod +x src/python/pants/bin/native_client
    - name: Run Python test shard 1/10
      run: './pants test --shard=1/10 ::

        '
    - continue-on-error: true
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      if: always()
      name: Upload test reports
      run: 'export S3_DST=s3://logs.pantsbuild.org/test/reports/Linux-x86_64/$(git show --no-patch --format=%cd --date=format:%Y-%m-%d)/${GITHUB_REF_NAME//\//_}/${GITHUB_RUN_ID}/${GITHUB_RUN_ATTEMPT}/${GITHUB_JOB}

        echo "Uploading test reports to ${S3_DST}"

        ./pants run ./src/python/pants_release/copy_to_s3.py                   --                   --src-prefix=dist/test/reports                   --dst-prefix=${S3_DST}                   --path=""

        '
    - continue-on-error: true
      if: always()
      name: Upload pants.log
      uses: actions/upload-artifact@v3
      with:
        name: logs-python-test-1_10-Linux-x86_64
        path: .pants.d/workdir/*.log
    timeout-minutes: 90
  test_python_linux_x86_64_2:
    env:
      PANTS_PROCESS_EXECUTION_LOCAL_PARALLELISM: '1'
    if: (github.repository_owner == 'pantsbuild') && (needs.classify_changes.outputs.docs_only != 'true')
    name: Test Python (Linux-x86_64) Shard 2/10
    needs:
    - bootstrap_pants_linux_x86_64
    - classify_changes
    runs-on:
    - ubuntu-20.04
    steps:
    - name: Check out code
      uses: actions/checkout@v3
      with:
        fetch-depth: 10
    - env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      name: Launch bazel-remote
      run: "mkdir -p ~/bazel-remote\nif [[ -z \"${AWS_ACCESS_KEY_ID}\" ]]; then\n  CACHE_WRITE=false\n  # If no secret read/write\
        \ creds, use hard-coded read-only creds, so that\n  # cross-fork PRs can at least read from the cache.\n  # These\
        \ creds are hard-coded here in this public repo, which makes the bucket\n  # world-readable. But since putting raw\
        \ AWS tokens in a public repo, even\n  # deliberately, is icky, we base64-them. This will at least help hide from\n\
        \  # automated scanners that look for checked in AWS keys.\n  # Not that it would be terrible if we were scanned,\
        \ since this is public\n  # on purpose, but it's best not to draw attention.\n  AWS_ACCESS_KEY_ID=$(echo 'QUtJQVY2QTZHN1JRVkJJUVM1RUEK'\
        \ | base64 -d)\n  AWS_SECRET_ACCESS_KEY=$(echo 'd3dOQ1k1eHJJWVVtejZBblV6M0l1endXV0loQWZWcW9GZlVjMDlKRwo=' | base64\
        \ -d)\nelse\n  CACHE_WRITE=true\nfi\ndocker run --detach -u 1001:1000                   -v ~/bazel-remote:/data  \
        \                 -p 9092:9092                   buchgr/bazel-remote-cache:v2.4.1                   --s3.auth_method=access_key\
        \                   --s3.access_key_id=\"${AWS_ACCESS_KEY_ID}\"                   --s3.secret_access_key=\"${AWS_SECRET_ACCESS_KEY}\"\
        \                   --s3.bucket=cache.pantsbuild.org                   --s3.endpoint=s3.us-east-1.amazonaws.com  \
        \                 --max_size 30\necho \"PANTS_REMOTE_STORE_ADDRESS=grpc://localhost:9092\" >> \"$GITHUB_ENV\"\necho\
        \ \"PANTS_REMOTE_CACHE_READ=true\" >> \"$GITHUB_ENV\"\necho \"PANTS_REMOTE_CACHE_WRITE=${CACHE_WRITE}\" >> \"$GITHUB_ENV\"\
        \n"
    - name: Install AdoptJDK
      uses: actions/setup-java@v3
      with:
        distribution: adopt
        java-version: '11'
    - name: Install Go
      uses: actions/setup-go@v3
      with:
        go-version: 1.19.5
    - if: runner.os == 'Linux'
      name: Download Apache `thrift` binary (Linux)
      run: 'mkdir -p "${HOME}/.thrift"

        curl --fail -L https://binaries.pantsbuild.org/bin/thrift/linux/x86_64/0.15.0/thrift -o "${HOME}/.thrift/thrift"

        chmod +x "${HOME}/.thrift/thrift"

        echo "${HOME}/.thrift" >> $GITHUB_PATH

        '
    - name: Set up Python 3.9
      uses: actions/setup-python@v4
      with:
        python-version: '3.9'
    - name: Expose Pythons
      uses: pantsbuild/actions/expose-pythons@627a8ce25d972afa03da1641be9261bbbe0e3ffe
    - name: Download native binaries
      uses: actions/download-artifact@v3
      with:
        name: native_binaries.${{ matrix.python-version }}.Linux-x86_64
        path: src/python/pants
    - name: Make native-client runnable
      run: chmod +x src/python/pants/bin/native_client
    - name: Run Python test shard 2/10
      run: './pants test --shard=2/10 ::

        '
    - continue-on-error: true
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      if: always()
      name: Upload test reports
      run: 'export S3_DST=s3://logs.pantsbuild.org/test/reports/Linux-x86_64/$(git show --no-patch --format=%cd --date=format:%Y-%m-%d)/${GITHUB_REF_NAME//\//_}/${GITHUB_RUN_ID}/${GITHUB_RUN_ATTEMPT}/${GITHUB_JOB}

        echo "Uploading test reports to ${S3_DST}"

        ./pants run ./src/python/pants_release/copy_to_s3.py                   --                   --src-prefix=dist/test/reports                   --dst-prefix=${S3_DST}                   --path=""

        '
    - continue-on-error: true
      if: always()
      name: Upload pants.log
      uses: actions/upload-artifact@v3
      with:
        name: logs-python-test-2_10-Linux-x86_64
        path: .pants.d/workdir/*.log
    timeout-minutes: 90
  test_python_linux_x86_64_3:
    env:
      PANTS_PROCESS_EXECUTION_LOCAL_PARALLELISM: '1'
    if: (github.repository_owner == 'pantsbuild') && (needs.classify_changes.outputs.docs_only != 'true')
    name: Test Python (Linux-x86_64) Shard 3/10
    needs:
    - bootstrap_pants_linux_x86_64
    - classify_changes
    runs-on:
    - ubuntu-20.04
    steps:
    - name: Check out code
      uses: actions/checkout@v3
      with:
        fetch-depth: 10
    - env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      name: Launch bazel-remote
      run: "mkdir -p ~/bazel-remote\nif [[ -z \"${AWS_ACCESS_KEY_ID}\" ]]; then\n  CACHE_WRITE=false\n  # If no secret read/write\
        \ creds, use hard-coded read-only creds, so that\n  # cross-fork PRs can at least read from the cache.\n  # These\
        \ creds are hard-coded here in this public repo, which makes the bucket\n  # world-readable. But since putting raw\
        \ AWS tokens in a public repo, even\n  # deliberately, is icky, we base64-them. This will at least help hide from\n\
        \  # automated scanners that look for checked in AWS keys.\n  # Not that it would be terrible if we were scanned,\
        \ since this is public\n  # on purpose, but it's best not to draw attention.\n  AWS_ACCESS_KEY_ID=$(echo 'QUtJQVY2QTZHN1JRVkJJUVM1RUEK'\
        \ | base64 -d)\n  AWS_SECRET_ACCESS_KEY=$(echo 'd3dOQ1k1eHJJWVVtejZBblV6M0l1endXV0loQWZWcW9GZlVjMDlKRwo=' | base64\
        \ -d)\nelse\n  CACHE_WRITE=true\nfi\ndocker run --detach -u 1001:1000                   -v ~/bazel-remote:/data  \
        \                 -p 9092:9092                   buchgr/bazel-remote-cache:v2.4.1                   --s3.auth_method=access_key\
        \                   --s3.access_key_id=\"${AWS_ACCESS_KEY_ID}\"                   --s3.secret_access_key=\"${AWS_SECRET_ACCESS_KEY}\"\
        \                   --s3.bucket=cache.pantsbuild.org                   --s3.endpoint=s3.us-east-1.amazonaws.com  \
        \                 --max_size 30\necho \"PANTS_REMOTE_STORE_ADDRESS=grpc://localhost:9092\" >> \"$GITHUB_ENV\"\necho\
        \ \"PANTS_REMOTE_CACHE_READ=true\" >> \"$GITHUB_ENV\"\necho \"PANTS_REMOTE_CACHE_WRITE=${CACHE_WRITE}\" >> \"$GITHUB_ENV\"\
        \n"
    - name: Install AdoptJDK
      uses: actions/setup-java@v3
      with:
        distribution: adopt
        java-version: '11'
    - name: Install Go
      uses: actions/setup-go@v3
      with:
        go-version: 1.19.5
    - if: runner.os == 'Linux'
      name: Download Apache `thrift` binary (Linux)
      run: 'mkdir -p "${HOME}/.thrift"

        curl --fail -L https://binaries.pantsbuild.org/bin/thrift/linux/x86_64/0.15.0/thrift -o "${HOME}/.thrift/thrift"

        chmod +x "${HOME}/.thrift/thrift"

        echo "${HOME}/.thrift" >> $GITHUB_PATH

        '
    - name: Set up Python 3.9
      uses: actions/setup-python@v4
      with:
        python-version: '3.9'
    - name: Expose Pythons
      uses: pantsbuild/actions/expose-pythons@627a8ce25d972afa03da1641be9261bbbe0e3ffe
    - name: Download native binaries
      uses: actions/download-artifact@v3
      with:
        name: native_binaries.${{ matrix.python-version }}.Linux-x86_64
        path: src/python/pants
    - name: Make native-client runnable
      run: chmod +x src/python/pants/bin/native_client
    - name: Run Python test shard 3/10
      run: './pants test --shard=3/10 ::

        '
    - continue-on-error: true
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      if: always()
      name: Upload test reports
      run: 'export S3_DST=s3://logs.pantsbuild.org/test/reports/Linux-x86_64/$(git show --no-patch --format=%cd --date=format:%Y-%m-%d)/${GITHUB_REF_NAME//\//_}/${GITHUB_RUN_ID}/${GITHUB_RUN_ATTEMPT}/${GITHUB_JOB}

        echo "Uploading test reports to ${S3_DST}"

        ./pants run ./src/python/pants_release/copy_to_s3.py                   --                   --src-prefix=dist/test/reports                   --dst-prefix=${S3_DST}                   --path=""

        '
    - continue-on-error: true
      if: always()
      name: Upload pants.log
      uses: actions/upload-artifact@v3
      with:
        name: logs-python-test-3_10-Linux-x86_64
        path: .pants.d/workdir/*.log
    timeout-minutes: 90
  test_python_linux_x86_64_4:
    env:
      PANTS_PROCESS_EXECUTION_LOCAL_PARALLELISM: '1'
    if: (github.repository_owner == 'pantsbuild') && (needs.classify_changes.outputs.docs_only != 'true')
    name: Test Python (Linux-x86_64) Shard 4/10
    needs:
    - bootstrap_pants_linux_x86_64
    - classify_changes
    runs-on:
    - ubuntu-20.04
    steps:
    - name: Check out code
      uses: actions/checkout@v3
      with:
        fetch-depth: 10
    - env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      name: Launch bazel-remote
      run: "mkdir -p ~/bazel-remote\nif [[ -z \"${AWS_ACCESS_KEY_ID}\" ]]; then\n  CACHE_WRITE=false\n  # If no secret read/write\
        \ creds, use hard-coded read-only creds, so that\n  # cross-fork PRs can at least read from the cache.\n  # These\
        \ creds are hard-coded here in this public repo, which makes the bucket\n  # world-readable. But since putting raw\
        \ AWS tokens in a public repo, even\n  # deliberately, is icky, we base64-them. This will at least help hide from\n\
        \  # automated scanners that look for checked in AWS keys.\n  # Not that it would be terrible if we were scanned,\
        \ since this is public\n  # on purpose, but it's best not to draw attention.\n  AWS_ACCESS_KEY_ID=$(echo 'QUtJQVY2QTZHN1JRVkJJUVM1RUEK'\
        \ | base64 -d)\n  AWS_SECRET_ACCESS_KEY=$(echo 'd3dOQ1k1eHJJWVVtejZBblV6M0l1endXV0loQWZWcW9GZlVjMDlKRwo=' | base64\
        \ -d)\nelse\n  CACHE_WRITE=true\nfi\ndocker run --detach -u 1001:1000                   -v ~/bazel-remote:/data  \
        \                 -p 9092:9092                   buchgr/bazel-remote-cache:v2.4.1                   --s3.auth_method=access_key\
        \                   --s3.access_key_id=\"${AWS_ACCESS_KEY_ID}\"                   --s3.secret_access_key=\"${AWS_SECRET_ACCESS_KEY}\"\
        \                   --s3.bucket=cache.pantsbuild.org                   --s3.endpoint=s3.us-east-1.amazonaws.com  \
        \                 --max_size 30\necho \"PANTS_REMOTE_STORE_ADDRESS=grpc://localhost:9092\" >> \"$GITHUB_ENV\"\necho\
        \ \"PANTS_REMOTE_CACHE_READ=true\" >> \"$GITHUB_ENV\"\necho \"PANTS_REMOTE_CACHE_WRITE=${CACHE_WRITE}\" >> \"$GITHUB_ENV\"\
        \n"
    - name: Install AdoptJDK
      uses: actions/setup-java@v3
      with:
        distribution: adopt
        java-version: '11'
    - name: Install Go
      uses: actions/setup-go@v3
      with:
        go-version: 1.19.5
    - if: runner.os == 'Linux'
      name: Download Apache `thrift` binary (Linux)
      run: 'mkdir -p "${HOME}/.thrift"

        curl --fail -L https://binaries.pantsbuild.org/bin/thrift/linux/x86_64/0.15.0/thrift -o "${HOME}/.thrift/thrift"

        chmod +x "${HOME}/.thrift/thrift"

        echo "${HOME}/.thrift" >> $GITHUB_PATH

        '
    - name: Set up Python 3.9
      uses: actions/setup-python@v4
      with:
        python-version: '3.9'
    - name: Expose Pythons
      uses: pantsbuild/actions/expose-pythons@627a8ce25d972afa03da1641be9261bbbe0e3ffe
    - name: Download native binaries
      uses: actions/download-artifact@v3
      with:
        name: native_binaries.${{ matrix.python-version }}.Linux-x86_64
        path: src/python/pants
    - name: Make native-client runnable
      run: chmod +x src/python/pants/bin/native_client
    - name: Run Python test shard 4/10
      run: './pants test --shard=4/10 ::

        '
    - continue-on-error: true
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      if: always()
      name: Upload test reports
      run: 'export S3_DST=s3://logs.pantsbuild.org/test/reports/Linux-x86_64/$(git show --no-patch --format=%cd --date=format:%Y-%m-%d)/${GITHUB_REF_NAME//\//_}/${GITHUB_RUN_ID}/${GITHUB_RUN_ATTEMPT}/${GITHUB_JOB}

        echo "Uploading test reports to ${S3_DST}"

        ./pants run ./src/python/pants_release/copy_to_s3.py                   --                   --src-prefix=dist/test/reports                   --dst-prefix=${S3_DST}                   --path=""

        '
    - continue-on-error: true
      if: always()
      name: Upload pants.log
      uses: actions/upload-artifact@v3
      with:
        name: logs-python-test-4_10-Linux-x86_64
        path: .pants.d/workdir/*.log
    timeout-minutes: 90
  test_python_linux_x86_64_5:
    env:
      PANTS_PROCESS_EXECUTION_LOCAL_PARALLELISM: '1'
    if: (github.repository_owner == 'pantsbuild') && (needs.classify_changes.outputs.docs_only != 'true')
    name: Test Python (Linux-x86_64) Shard 5/10
    needs:
    - bootstrap_pants_linux_x86_64
    - classify_changes
    runs-on:
    - ubuntu-20.04
    steps:
    - name: Check out code
      uses: actions/checkout@v3
      with:
        fetch-depth: 10
    - env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      name: Launch bazel-remote
      run: "mkdir -p ~/bazel-remote\nif [[ -z \"${AWS_ACCESS_KEY_ID}\" ]]; then\n  CACHE_WRITE=false\n  # If no secret read/write\
        \ creds, use hard-coded read-only creds, so that\n  # cross-fork PRs can at least read from the cache.\n  # These\
        \ creds are hard-coded here in this public repo, which makes the bucket\n  # world-readable. But since putting raw\
        \ AWS tokens in a public repo, even\n  # deliberately, is icky, we base64-them. This will at least help hide from\n\
        \  # automated scanners that look for checked in AWS keys.\n  # Not that it would be terrible if we were scanned,\
        \ since this is public\n  # on purpose, but it's best not to draw attention.\n  AWS_ACCESS_KEY_ID=$(echo 'QUtJQVY2QTZHN1JRVkJJUVM1RUEK'\
        \ | base64 -d)\n  AWS_SECRET_ACCESS_KEY=$(echo 'd3dOQ1k1eHJJWVVtejZBblV6M0l1endXV0loQWZWcW9GZlVjMDlKRwo=' | base64\
        \ -d)\nelse\n  CACHE_WRITE=true\nfi\ndocker run --detach -u 1001:1000                   -v ~/bazel-remote:/data  \
        \                 -p 9092:9092                   buchgr/bazel-remote-cache:v2.4.1                   --s3.auth_method=access_key\
        \                   --s3.access_key_id=\"${AWS_ACCESS_KEY_ID}\"                   --s3.secret_access_key=\"${AWS_SECRET_ACCESS_KEY}\"\
        \                   --s3.bucket=cache.pantsbuild.org                   --s3.endpoint=s3.us-east-1.amazonaws.com  \
        \                 --max_size 30\necho \"PANTS_REMOTE_STORE_ADDRESS=grpc://localhost:9092\" >> \"$GITHUB_ENV\"\necho\
        \ \"PANTS_REMOTE_CACHE_READ=true\" >> \"$GITHUB_ENV\"\necho \"PANTS_REMOTE_CACHE_WRITE=${CACHE_WRITE}\" >> \"$GITHUB_ENV\"\
        \n"
    - name: Install AdoptJDK
      uses: actions/setup-java@v3
      with:
        distribution: adopt
        java-version: '11'
    - name: Install Go
      uses: actions/setup-go@v3
      with:
        go-version: 1.19.5
    - if: runner.os == 'Linux'
      name: Download Apache `thrift` binary (Linux)
      run: 'mkdir -p "${HOME}/.thrift"

        curl --fail -L https://binaries.pantsbuild.org/bin/thrift/linux/x86_64/0.15.0/thrift -o "${HOME}/.thrift/thrift"

        chmod +x "${HOME}/.thrift/thrift"

        echo "${HOME}/.thrift" >> $GITHUB_PATH

        '
    - name: Set up Python 3.9
      uses: actions/setup-python@v4
      with:
        python-version: '3.9'
    - name: Expose Pythons
      uses: pantsbuild/actions/expose-pythons@627a8ce25d972afa03da1641be9261bbbe0e3ffe
    - name: Download native binaries
      uses: actions/download-artifact@v3
      with:
        name: native_binaries.${{ matrix.python-version }}.Linux-x86_64
        path: src/python/pants
    - name: Make native-client runnable
      run: chmod +x src/python/pants/bin/native_client
    - name: Run Python test shard 5/10
      run: './pants test --shard=5/10 ::

        '
    - continue-on-error: true
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      if: always()
      name: Upload test reports
      run: 'export S3_DST=s3://logs.pantsbuild.org/test/reports/Linux-x86_64/$(git show --no-patch --format=%cd --date=format:%Y-%m-%d)/${GITHUB_REF_NAME//\//_}/${GITHUB_RUN_ID}/${GITHUB_RUN_ATTEMPT}/${GITHUB_JOB}

        echo "Uploading test reports to ${S3_DST}"

        ./pants run ./src/python/pants_release/copy_to_s3.py                   --                   --src-prefix=dist/test/reports                   --dst-prefix=${S3_DST}                   --path=""

        '
    - continue-on-error: true
      if: always()
      name: Upload pants.log
      uses: actions/upload-artifact@v3
      with:
        name: logs-python-test-5_10-Linux-x86_64
        path: .pants.d/workdir/*.log
    timeout-minutes: 90
  test_python_linux_x86_64_6:
    env:
      PANTS_PROCESS_EXECUTION_LOCAL_PARALLELISM: '1'
    if: (github.repository_owner == 'pantsbuild') && (needs.classify_changes.outputs.docs_only != 'true')
    name: Test Python (Linux-x86_64) Shard 6/10
    needs:
    - bootstrap_pants_linux_x86_64
    - classify_changes
    runs-on:
    - ubuntu-20.04
    steps:
    - name: Check out code
      uses: actions/checkout@v3
      with:
        fetch-depth: 10
    - env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      name: Launch bazel-remote
      run: "mkdir -p ~/bazel-remote\nif [[ -z \"${AWS_ACCESS_KEY_ID}\" ]]; then\n  CACHE_WRITE=false\n  # If no secret read/write\
        \ creds, use hard-coded read-only creds, so that\n  # cross-fork PRs can at least read from the cache.\n  # These\
        \ creds are hard-coded here in this public repo, which makes the bucket\n  # world-readable. But since putting raw\
        \ AWS tokens in a public repo, even\n  # deliberately, is icky, we base64-them. This will at least help hide from\n\
        \  # automated scanners that look for checked in AWS keys.\n  # Not that it would be terrible if we were scanned,\
        \ since this is public\n  # on purpose, but it's best not to draw attention.\n  AWS_ACCESS_KEY_ID=$(echo 'QUtJQVY2QTZHN1JRVkJJUVM1RUEK'\
        \ | base64 -d)\n  AWS_SECRET_ACCESS_KEY=$(echo 'd3dOQ1k1eHJJWVVtejZBblV6M0l1endXV0loQWZWcW9GZlVjMDlKRwo=' | base64\
        \ -d)\nelse\n  CACHE_WRITE=true\nfi\ndocker run --detach -u 1001:1000                   -v ~/bazel-remote:/data  \
        \                 -p 9092:9092                   buchgr/bazel-remote-cache:v2.4.1                   --s3.auth_method=access_key\
        \                   --s3.access_key_id=\"${AWS_ACCESS_KEY_ID}\"                   --s3.secret_access_key=\"${AWS_SECRET_ACCESS_KEY}\"\
        \                   --s3.bucket=cache.pantsbuild.org                   --s3.endpoint=s3.us-east-1.amazonaws.com  \
        \                 --max_size 30\necho \"PANTS_REMOTE_STORE_ADDRESS=grpc://localhost:9092\" >> \"$GITHUB_ENV\"\necho\
        \ \"PANTS_REMOTE_CACHE_READ=true\" >> \"$GITHUB_ENV\"\necho \"PANTS_REMOTE_CACHE_WRITE=${CACHE_WRITE}\" >> \"$GITHUB_ENV\"\
        \n"
    - name: Install AdoptJDK
      uses: actions/setup-java@v3
      with:
        distribution: adopt
        java-version: '11'
    - name: Install Go
      uses: actions/setup-go@v3
      with:
        go-version: 1.19.5
    - if: runner.os == 'Linux'
      name: Download Apache `thrift` binary (Linux)
      run: 'mkdir -p "${HOME}/.thrift"

        curl --fail -L https://binaries.pantsbuild.org/bin/thrift/linux/x86_64/0.15.0/thrift -o "${HOME}/.thrift/thrift"

        chmod +x "${HOME}/.thrift/thrift"

        echo "${HOME}/.thrift" >> $GITHUB_PATH

        '
    - name: Set up Python 3.9
      uses: actions/setup-python@v4
      with:
        python-version: '3.9'
    - name: Expose Pythons
      uses: pantsbuild/actions/expose-pythons@627a8ce25d972afa03da1641be9261bbbe0e3ffe
    - name: Download native binaries
      uses: actions/download-artifact@v3
      with:
        name: native_binaries.${{ matrix.python-version }}.Linux-x86_64
        path: src/python/pants
    - name: Make native-client runnable
      run: chmod +x src/python/pants/bin/native_client
    - name: Run Python test shard 6/10
      run: './pants test --shard=6/10 ::

        '
    - continue-on-error: true
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      if: always()
      name: Upload test reports
      run: 'export S3_DST=s3://logs.pantsbuild.org/test/reports/Linux-x86_64/$(git show --no-patch --format=%cd --date=format:%Y-%m-%d)/${GITHUB_REF_NAME//\//_}/${GITHUB_RUN_ID}/${GITHUB_RUN_ATTEMPT}/${GITHUB_JOB}

        echo "Uploading test reports to ${S3_DST}"

        ./pants run ./src/python/pants_release/copy_to_s3.py                   --                   --src-prefix=dist/test/reports                   --dst-prefix=${S3_DST}                   --path=""

        '
    - continue-on-error: true
      if: always()
      name: Upload pants.log
      uses: actions/upload-artifact@v3
      with:
        name: logs-python-test-6_10-Linux-x86_64
        path: .pants.d/workdir/*.log
    timeout-minutes: 90
  test_python_linux_x86_64_7:
    env:
      PANTS_PROCESS_EXECUTION_LOCAL_PARALLELISM: '1'
    if: (github.repository_owner == 'pantsbuild') && (needs.classify_changes.outputs.docs_only != 'true')
    name: Test Python (Linux-x86_64) Shard 7/10
    needs:
    - bootstrap_pants_linux_x86_64
    - classify_changes
    runs-on:
    - ubuntu-20.04
    steps:
    - name: Check out code
      uses: actions/checkout@v3
      with:
        fetch-depth: 10
    - env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      name: Launch bazel-remote
      run: "mkdir -p ~/bazel-remote\nif [[ -z \"${AWS_ACCESS_KEY_ID}\" ]]; then\n  CACHE_WRITE=false\n  # If no secret read/write\
        \ creds, use hard-coded read-only creds, so that\n  # cross-fork PRs can at least read from the cache.\n  # These\
        \ creds are hard-coded here in this public repo, which makes the bucket\n  # world-readable. But since putting raw\
        \ AWS tokens in a public repo, even\n  # deliberately, is icky, we base64-them. This will at least help hide from\n\
        \  # automated scanners that look for checked in AWS keys.\n  # Not that it would be terrible if we were scanned,\
        \ since this is public\n  # on purpose, but it's best not to draw attention.\n  AWS_ACCESS_KEY_ID=$(echo 'QUtJQVY2QTZHN1JRVkJJUVM1RUEK'\
        \ | base64 -d)\n  AWS_SECRET_ACCESS_KEY=$(echo 'd3dOQ1k1eHJJWVVtejZBblV6M0l1endXV0loQWZWcW9GZlVjMDlKRwo=' | base64\
        \ -d)\nelse\n  CACHE_WRITE=true\nfi\ndocker run --detach -u 1001:1000                   -v ~/bazel-remote:/data  \
        \                 -p 9092:9092                   buchgr/bazel-remote-cache:v2.4.1                   --s3.auth_method=access_key\
        \                   --s3.access_key_id=\"${AWS_ACCESS_KEY_ID}\"                   --s3.secret_access_key=\"${AWS_SECRET_ACCESS_KEY}\"\
        \                   --s3.bucket=cache.pantsbuild.org                   --s3.endpoint=s3.us-east-1.amazonaws.com  \
        \                 --max_size 30\necho \"PANTS_REMOTE_STORE_ADDRESS=grpc://localhost:9092\" >> \"$GITHUB_ENV\"\necho\
        \ \"PANTS_REMOTE_CACHE_READ=true\" >> \"$GITHUB_ENV\"\necho \"PANTS_REMOTE_CACHE_WRITE=${CACHE_WRITE}\" >> \"$GITHUB_ENV\"\
        \n"
    - name: Install AdoptJDK
      uses: actions/setup-java@v3
      with:
        distribution: adopt
        java-version: '11'
    - name: Install Go
      uses: actions/setup-go@v3
      with:
        go-version: 1.19.5
    - if: runner.os == 'Linux'
      name: Download Apache `thrift` binary (Linux)
      run: 'mkdir -p "${HOME}/.thrift"

        curl --fail -L https://binaries.pantsbuild.org/bin/thrift/linux/x86_64/0.15.0/thrift -o "${HOME}/.thrift/thrift"

        chmod +x "${HOME}/.thrift/thrift"

        echo "${HOME}/.thrift" >> $GITHUB_PATH

        '
    - name: Set up Python 3.9
      uses: actions/setup-python@v4
      with:
        python-version: '3.9'
    - name: Expose Pythons
      uses: pantsbuild/actions/expose-pythons@627a8ce25d972afa03da1641be9261bbbe0e3ffe
    - name: Download native binaries
      uses: actions/download-artifact@v3
      with:
        name: native_binaries.${{ matrix.python-version }}.Linux-x86_64
        path: src/python/pants
    - name: Make native-client runnable
      run: chmod +x src/python/pants/bin/native_client
    - name: Run Python test shard 7/10
      run: './pants test --shard=7/10 ::

        '
    - continue-on-error: true
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      if: always()
      name: Upload test reports
      run: 'export S3_DST=s3://logs.pantsbuild.org/test/reports/Linux-x86_64/$(git show --no-patch --format=%cd --date=format:%Y-%m-%d)/${GITHUB_REF_NAME//\//_}/${GITHUB_RUN_ID}/${GITHUB_RUN_ATTEMPT}/${GITHUB_JOB}

        echo "Uploading test reports to ${S3_DST}"

        ./pants run ./src/python/pants_release/copy_to_s3.py                   --                   --src-prefix=dist/test/reports                   --dst-prefix=${S3_DST}                   --path=""

        '
    - continue-on-error: true
      if: always()
      name: Upload pants.log
      uses: actions/upload-artifact@v3
      with:
        name: logs-python-test-7_10-Linux-x86_64
        path: .pants.d/workdir/*.log
    timeout-minutes: 90
  test_python_linux_x86_64_8:
    env:
      PANTS_PROCESS_EXECUTION_LOCAL_PARALLELISM: '1'
    if: (github.repository_owner == 'pantsbuild') && (needs.classify_changes.outputs.docs_only != 'true')
    name: Test Python (Linux-x86_64) Shard 8/10
    needs:
    - bootstrap_pants_linux_x86_64
    - classify_changes
    runs-on:
    - ubuntu-20.04
    steps:
    - name: Check out code
      uses: actions/checkout@v3
      with:
        fetch-depth: 10
    - env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      name: Launch bazel-remote
      run: "mkdir -p ~/bazel-remote\nif [[ -z \"${AWS_ACCESS_KEY_ID}\" ]]; then\n  CACHE_WRITE=false\n  # If no secret read/write\
        \ creds, use hard-coded read-only creds, so that\n  # cross-fork PRs can at least read from the cache.\n  # These\
        \ creds are hard-coded here in this public repo, which makes the bucket\n  # world-readable. But since putting raw\
        \ AWS tokens in a public repo, even\n  # deliberately, is icky, we base64-them. This will at least help hide from\n\
        \  # automated scanners that look for checked in AWS keys.\n  # Not that it would be terrible if we were scanned,\
        \ since this is public\n  # on purpose, but it's best not to draw attention.\n  AWS_ACCESS_KEY_ID=$(echo 'QUtJQVY2QTZHN1JRVkJJUVM1RUEK'\
        \ | base64 -d)\n  AWS_SECRET_ACCESS_KEY=$(echo 'd3dOQ1k1eHJJWVVtejZBblV6M0l1endXV0loQWZWcW9GZlVjMDlKRwo=' | base64\
        \ -d)\nelse\n  CACHE_WRITE=true\nfi\ndocker run --detach -u 1001:1000                   -v ~/bazel-remote:/data  \
        \                 -p 9092:9092                   buchgr/bazel-remote-cache:v2.4.1                   --s3.auth_method=access_key\
        \                   --s3.access_key_id=\"${AWS_ACCESS_KEY_ID}\"                   --s3.secret_access_key=\"${AWS_SECRET_ACCESS_KEY}\"\
        \                   --s3.bucket=cache.pantsbuild.org                   --s3.endpoint=s3.us-east-1.amazonaws.com  \
        \                 --max_size 30\necho \"PANTS_REMOTE_STORE_ADDRESS=grpc://localhost:9092\" >> \"$GITHUB_ENV\"\necho\
        \ \"PANTS_REMOTE_CACHE_READ=true\" >> \"$GITHUB_ENV\"\necho \"PANTS_REMOTE_CACHE_WRITE=${CACHE_WRITE}\" >> \"$GITHUB_ENV\"\
        \n"
    - name: Install AdoptJDK
      uses: actions/setup-java@v3
      with:
        distribution: adopt
        java-version: '11'
    - name: Install Go
      uses: actions/setup-go@v3
      with:
        go-version: 1.19.5
    - if: runner.os == 'Linux'
      name: Download Apache `thrift` binary (Linux)
      run: 'mkdir -p "${HOME}/.thrift"

        curl --fail -L https://binaries.pantsbuild.org/bin/thrift/linux/x86_64/0.15.0/thrift -o "${HOME}/.thrift/thrift"

        chmod +x "${HOME}/.thrift/thrift"

        echo "${HOME}/.thrift" >> $GITHUB_PATH

        '
    - name: Set up Python 3.9
      uses: actions/setup-python@v4
      with:
        python-version: '3.9'
    - name: Expose Pythons
      uses: pantsbuild/actions/expose-pythons@627a8ce25d972afa03da1641be9261bbbe0e3ffe
    - name: Download native binaries
      uses: actions/download-artifact@v3
      with:
        name: native_binaries.${{ matrix.python-version }}.Linux-x86_64
        path: src/python/pants
    - name: Make native-client runnable
      run: chmod +x src/python/pants/bin/native_client
    - name: Run Python test shard 8/10
      run: './pants test --shard=8/10 ::

        '
    - continue-on-error: true
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      if: always()
      name: Upload test reports
      run: 'export S3_DST=s3://logs.pantsbuild.org/test/reports/Linux-x86_64/$(git show --no-patch --format=%cd --date=format:%Y-%m-%d)/${GITHUB_REF_NAME//\//_}/${GITHUB_RUN_ID}/${GITHUB_RUN_ATTEMPT}/${GITHUB_JOB}

        echo "Uploading test reports to ${S3_DST}"

        ./pants run ./src/python/pants_release/copy_to_s3.py                   --                   --src-prefix=dist/test/reports                   --dst-prefix=${S3_DST}                   --path=""

        '
    - continue-on-error: true
      if: always()
      name: Upload pants.log
      uses: actions/upload-artifact@v3
      with:
        name: logs-python-test-8_10-Linux-x86_64
        path: .pants.d/workdir/*.log
    timeout-minutes: 90
  test_python_linux_x86_64_9:
    env:
      PANTS_PROCESS_EXECUTION_LOCAL_PARALLELISM: '1'
    if: (github.repository_owner == 'pantsbuild') && (needs.classify_changes.outputs.docs_only != 'true')
    name: Test Python (Linux-x86_64) Shard 9/10
    needs:
    - bootstrap_pants_linux_x86_64
    - classify_changes
    runs-on:
    - ubuntu-20.04
    steps:
    - name: Check out code
      uses: actions/checkout@v3
      with:
        fetch-depth: 10
    - env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      name: Launch bazel-remote
      run: "mkdir -p ~/bazel-remote\nif [[ -z \"${AWS_ACCESS_KEY_ID}\" ]]; then\n  CACHE_WRITE=false\n  # If no secret read/write\
        \ creds, use hard-coded read-only creds, so that\n  # cross-fork PRs can at least read from the cache.\n  # These\
        \ creds are hard-coded here in this public repo, which makes the bucket\n  # world-readable. But since putting raw\
        \ AWS tokens in a public repo, even\n  # deliberately, is icky, we base64-them. This will at least help hide from\n\
        \  # automated scanners that look for checked in AWS keys.\n  # Not that it would be terrible if we were scanned,\
        \ since this is public\n  # on purpose, but it's best not to draw attention.\n  AWS_ACCESS_KEY_ID=$(echo 'QUtJQVY2QTZHN1JRVkJJUVM1RUEK'\
        \ | base64 -d)\n  AWS_SECRET_ACCESS_KEY=$(echo 'd3dOQ1k1eHJJWVVtejZBblV6M0l1endXV0loQWZWcW9GZlVjMDlKRwo=' | base64\
        \ -d)\nelse\n  CACHE_WRITE=true\nfi\ndocker run --detach -u 1001:1000                   -v ~/bazel-remote:/data  \
        \                 -p 9092:9092                   buchgr/bazel-remote-cache:v2.4.1                   --s3.auth_method=access_key\
        \                   --s3.access_key_id=\"${AWS_ACCESS_KEY_ID}\"                   --s3.secret_access_key=\"${AWS_SECRET_ACCESS_KEY}\"\
        \                   --s3.bucket=cache.pantsbuild.org                   --s3.endpoint=s3.us-east-1.amazonaws.com  \
        \                 --max_size 30\necho \"PANTS_REMOTE_STORE_ADDRESS=grpc://localhost:9092\" >> \"$GITHUB_ENV\"\necho\
        \ \"PANTS_REMOTE_CACHE_READ=true\" >> \"$GITHUB_ENV\"\necho \"PANTS_REMOTE_CACHE_WRITE=${CACHE_WRITE}\" >> \"$GITHUB_ENV\"\
        \n"
    - name: Install AdoptJDK
      uses: actions/setup-java@v3
      with:
        distribution: adopt
        java-version: '11'
    - name: Install Go
      uses: actions/setup-go@v3
      with:
        go-version: 1.19.5
    - if: runner.os == 'Linux'
      name: Download Apache `thrift` binary (Linux)
      run: 'mkdir -p "${HOME}/.thrift"

        curl --fail -L https://binaries.pantsbuild.org/bin/thrift/linux/x86_64/0.15.0/thrift -o "${HOME}/.thrift/thrift"

        chmod +x "${HOME}/.thrift/thrift"

        echo "${HOME}/.thrift" >> $GITHUB_PATH

        '
    - name: Set up Python 3.9
      uses: actions/setup-python@v4
      with:
        python-version: '3.9'
    - name: Expose Pythons
      uses: pantsbuild/actions/expose-pythons@627a8ce25d972afa03da1641be9261bbbe0e3ffe
    - name: Download native binaries
      uses: actions/download-artifact@v3
      with:
        name: native_binaries.${{ matrix.python-version }}.Linux-x86_64
        path: src/python/pants
    - name: Make native-client runnable
      run: chmod +x src/python/pants/bin/native_client
    - name: Run Python test shard 9/10
      run: './pants test --shard=9/10 ::

        '
    - continue-on-error: true
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      if: always()
      name: Upload test reports
      run: 'export S3_DST=s3://logs.pantsbuild.org/test/reports/Linux-x86_64/$(git show --no-patch --format=%cd --date=format:%Y-%m-%d)/${GITHUB_REF_NAME//\//_}/${GITHUB_RUN_ID}/${GITHUB_RUN_ATTEMPT}/${GITHUB_JOB}

        echo "Uploading test reports to ${S3_DST}"

        ./pants run ./src/python/pants_release/copy_to_s3.py                   --                   --src-prefix=dist/test/reports                   --dst-prefix=${S3_DST}                   --path=""

        '
    - continue-on-error: true
      if: always()
      name: Upload pants.log
      uses: actions/upload-artifact@v3
      with:
        name: logs-python-test-9_10-Linux-x86_64
        path: .pants.d/workdir/*.log
    timeout-minutes: 90
  test_python_macos12_x86_64:
    env:
      ARCHFLAGS: -arch x86_64
    if: (github.repository_owner == 'pantsbuild') && (needs.classify_changes.outputs.docs_only != 'true')
    name: Test Python (macOS12-x86_64)
    needs:
    - bootstrap_pants_macos12_x86_64
    - classify_changes
    runs-on:
    - macos-12
    steps:
    - name: Check out code
      uses: actions/checkout@v3
      with:
        fetch-depth: 10
    - name: Install AdoptJDK
      uses: actions/setup-java@v3
      with:
        distribution: adopt
        java-version: '11'
    - name: Set up Python 3.9
      uses: actions/setup-python@v4
      with:
        python-version: '3.9'
    - name: Expose Pythons
      uses: pantsbuild/actions/expose-pythons@627a8ce25d972afa03da1641be9261bbbe0e3ffe
    - name: Download native binaries
      uses: actions/download-artifact@v3
      with:
        name: native_binaries.${{ matrix.python-version }}.macOS12-x86_64
        path: src/python/pants
    - name: Make native-client runnable
      run: chmod +x src/python/pants/bin/native_client
    - name: Run Python tests
      run: './pants --tag=+platform_specific_behavior test :: -- -m platform_specific_behavior

        '
    - continue-on-error: true
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      if: always()
      name: Upload test reports
      run: 'export S3_DST=s3://logs.pantsbuild.org/test/reports/macOS12-x86_64/$(git show --no-patch --format=%cd --date=format:%Y-%m-%d)/${GITHUB_REF_NAME//\//_}/${GITHUB_RUN_ID}/${GITHUB_RUN_ATTEMPT}/${GITHUB_JOB}

        echo "Uploading test reports to ${S3_DST}"

        ./pants run ./src/python/pants_release/copy_to_s3.py                   --                   --src-prefix=dist/test/reports                   --dst-prefix=${S3_DST}                   --path=""

        '
    - continue-on-error: true
      if: always()
      name: Upload pants.log
      uses: actions/upload-artifact@v3
      with:
        name: logs-python-test-macOS12-x86_64
        path: .pants.d/workdir/*.log
    timeout-minutes: 90
name: Pull Request CI
'on':
  pull_request: {}
  push:
    branches:
    - main
    - 2.*.x


Cargo Audit

# GENERATED, DO NOT EDIT!
# To change, edit `src/python/pants_release/generate_github_workflows.py` and run:
#   ./pants run src/python/pants_release/generate_github_workflows.py

jobs:
  audit:
    if: github.repository_owner == 'pantsbuild'
    runs-on: ubuntu-latest
    steps:
    - name: Check out code
      uses: actions/checkout@v3
      with:
        fetch-depth: 10
    - name: Cargo audit (for security vulnerabilities)
      run: './cargo install --version 0.17.5 cargo-audit

        ./cargo audit --ignore RUSTSEC-2020-0128

        '
name: Cargo Audit
'on':
  schedule:
  - cron: 11 8 * * *
  workflow_dispatch: null


Cache Comparison

# GENERATED, DO NOT EDIT!
# To change, edit `src/python/pants_release/generate_github_workflows.py` and run:
#   ./pants run src/python/pants_release/generate_github_workflows.py

jobs:
  cache_comparison:
    runs-on: ubuntu-latest
    steps:
    - name: Check out code
      uses: actions/checkout@v3
      with:
        fetch-depth: 10
    - name: Set up Python 3.9
      uses: actions/setup-python@v4
      with:
        python-version: '3.9'
    - name: Expose Pythons
      uses: pantsbuild/actions/expose-pythons@627a8ce25d972afa03da1641be9261bbbe0e3ffe
    - env:
        BASE_REF: ${{ github.event.inputs.base_ref }}
        BUILD_COMMIT: ${{ github.event.inputs.build_commit }}
        PANTS_ARGS: ${{ github.event.inputs.pants_args }}
        SOURCE_DIFFSPEC: ${{ github.event.inputs.source_diffspec }}
        SOURCE_DIFFSPEC_STEP: ${{ github.event.inputs.source_diffspec_step }}
      name: Prepare cache comparison
      run: 'MODE=debug ./pants package build-support/bin/cache_comparison.py

        git fetch --no-tags --depth=1024 origin "$BASE_REF"

        '
    - env:
        BASE_REF: ${{ github.event.inputs.base_ref }}
        BUILD_COMMIT: ${{ github.event.inputs.build_commit }}
        PANTS_ARGS: ${{ github.event.inputs.pants_args }}
        SOURCE_DIFFSPEC: ${{ github.event.inputs.source_diffspec }}
        SOURCE_DIFFSPEC_STEP: ${{ github.event.inputs.source_diffspec_step }}
      name: Run cache comparison
      run: "dist/build-support.bin/cache_comparison_py.pex \\\n  --args=\"$PANTS_ARGS\"\
        \ \\\n  --build-commit=\"$BUILD_COMMIT\" \\\n  --source-diffspec=\"$SOURCE_DIFFSPEC\"\
        \ \\\n  --source-diffspec-step=$SOURCE_DIFFSPEC_STEP\n"
    timeout-minutes: 90
name: Cache Comparison
'on':
  workflow_dispatch:
    inputs:
      base_ref:
        default: main
        required: false
        type: string
      build_commit:
        required: true
        type: string
      pants_args:
        default: 'check lint test ::'
        required: false
        type: string
      source_diffspec:
        required: true
        type: string
      source_diffspec_step:
        default: 1
        required: false
        type: int