ci: test on Python 3.8-3.12 - #29
Merged
Merged
Conversation
Adds a Python version matrix (3.8-3.12) to the backend test workflow, plus concurrency/permissions hygiene. requirements.txt gains python_version-conditioned pins (mirroring scipion-pyworkflow's own scheme) so 3.8 behavior is untouched while numpy, matplotlib, scikit-image, and pydantic get versions that actually ship wheels for 3.9-3.12. fastapi-mail is pinned to 1.3.1 on Python >=3.11 since its aioredis dependency (used only by an unused email-checker feature) crashes on 3.11+ once asyncio.TimeoutError became an alias of builtins.TimeoutError; 1.3.1 is the last release still on Pydantic v1. Verified locally: 1218 tests pass on 3.8, 3.9, and 3.10. 3.11/3.12 are left for the GH Actions matrix to confirm. 3.13/3.14 are out of scope here: scipion-pyworkflow/scipion-em pin numpy==1.26.1/matplotlib==3.8.1 with no upper Python bound, and those have no wheels past cp312 - that needs its own branch in those repos.
…decision The confirmation email was never actually wired up end to end (the signup call site was already commented out), and the team has decided not to pursue it for now. This also removes app/backend/utils/email.py, which had real SMTP credentials committed in plaintext — please rotate that password regardless of this change. Dropping fastapi-mail entirely also removes it as a source of aioredis (unmaintained, crashes on Python >=3.11), simplifying the Python version matrix work without needing the fastapi-mail 1.3.1 pin/API-rename dance. /auth/resend-code still rotates the verification code (kept for API compatibility) but no longer tries to email it.
martin-s-a
added a commit
that referenced
this pull request
Aug 3, 2026
* ci: test on Python 3.8-3.12, add conditional deps for newer versions Adds a Python version matrix (3.8-3.12) to the backend test workflow, plus concurrency/permissions hygiene. requirements.txt gains python_version-conditioned pins (mirroring scipion-pyworkflow's own scheme) so 3.8 behavior is untouched while numpy, matplotlib, scikit-image, and pydantic get versions that actually ship wheels for 3.9-3.12. fastapi-mail is pinned to 1.3.1 on Python >=3.11 since its aioredis dependency (used only by an unused email-checker feature) crashes on 3.11+ once asyncio.TimeoutError became an alias of builtins.TimeoutError; 1.3.1 is the last release still on Pydantic v1. Verified locally: 1218 tests pass on 3.8, 3.9, and 3.10. 3.11/3.12 are left for the GH Actions matrix to confirm. 3.13/3.14 are out of scope here: scipion-pyworkflow/scipion-em pin numpy==1.26.1/matplotlib==3.8.1 with no upper Python bound, and those have no wheels past cp312 - that needs its own branch in those repos. * ci: declare httpx explicitly, was only transitive via fastapi-mail<1.2 * remove verification-email sending: never worked, dropped per product decision The confirmation email was never actually wired up end to end (the signup call site was already commented out), and the team has decided not to pursue it for now. This also removes app/backend/utils/email.py, which had real SMTP credentials committed in plaintext — please rotate that password regardless of this change. Dropping fastapi-mail entirely also removes it as a source of aioredis (unmaintained, crashes on Python >=3.11), simplifying the Python version matrix work without needing the fastapi-mail 1.3.1 pin/API-rename dance. /auth/resend-code still rotates the verification code (kept for API compatibility) but no longer tries to email it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ScipionAPI backend tests,fail-fast: falseso every version reports independently.requirements.txtgetspython_version-conditioned pins fornumpy,matplotlib,scikit-image, andpydantic, mirroring the schemescipion-pyworkflowalready uses — Python 3.8 keeps its exact original pins, untouched.fastapi-mailis pinned to1.3.1on Python >=3.11 (still on Pydantic v1, unlike 1.4+) because itsaioredisdependency — pulled in only for an email-checker feature we don't use — crashes on Python 3.11+ (asyncio.TimeoutErrorbecame an alias ofbuiltins.TimeoutError, andaioredisinherits from both).pip checkas an explicit step beforepytest, plusconcurrency(cancel superseded runs) andpermissions: contents: read.Scope
3.13/3.14 are intentionally not included:
scipion-pyworkflow/scipion-empinnumpy==1.26.1/matplotlib==3.8.1with no upper Python bound, and neither has wheels past cp312. Extending to 3.13/3.14 needs its own branch in those repos (and likely numpy 2.x, which has real breaking API changes) — separate follow-up.Test plan