Checks workflow (ariebovenberg/whenever)

The Checks workflow from ariebovenberg/whenever, explained and optimized by Latchkey.

CI health: F - at risk

Point runs-on at Latchkey and get caching, run de-duplication, job timeouts, SHA-pinned actions, self-healing for flaky steps, and up to 58% lower cost, applied automatically.

Grade your own workflow free or run it on Latchkey →

Source: ariebovenberg/whenever.github/workflows/checks.ymlLicense MITView source

What it does

This is the Checks workflow from the ariebovenberg/whenever repository, a real project running GitHub Actions. It is shown here with attribution under its MIT license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

workflow (.yml)

name: Checks

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:

env:
  RUST_BACKTRACE: 1
  # We rely on setup-python action to install Python,
  # because it does better caching and works with 32-bit Python on Windows.
  UV_PYTHON_DOWNLOADS: never
  UV_NO_MANAGED_PYTHON: "true"

jobs:
  test-rust:
    name: Test Rust (internal tests)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: "1.93"
      # even though we only test rust, we need CPython to link against
      - uses: actions/setup-python@v6
        with:
          python-version: "3.14"
      - name: Build and test
        run: |
          cargo test
  test-rust-ext:
    name: Test ubuntu, ${{ matrix.python-version }} Rust extension
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: [
          # NOTE: 3.10, 3.14t are absent since we test them in the OS job matrix
          "3.11",
          "3.12",
          "3.13",
          "3.14",
          "3.15",
          "3.15t"
        ]
    steps:
      - uses: actions/checkout@v7
      - uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: "1.93"
      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
      - uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}
          allow-prereleases: true

      # Testing without integrations (e.g. pydantic, time_machine) to ensure there's no accidental dependency on them
      - name: Test (debug, no dependency integrations)
        shell: bash
        run: |
          uv sync --locked --group test
          uv run pytest tests/ -s -v

      # Testing with integrations to ensure they work
      - name: Test (debug, all dependency integrations)
        if: ${{ matrix.python-version != '3.15' && matrix.python-version != '3.15t' }}
        shell: bash
        run: |
          uv sync --locked --group test --group integrations
          uv run pytest tests/ -s -v
      # Release mode sometimes surfaces issues not seen in debug
      - name: Test (release mode)
        shell: bash
        run: |
          uv sync --locked --reinstall-package whenever --no-editable --group test
          uv run pytest tests/ -s -v
      - run: |
          sudo apt-get install -y tzdata  # for the zdump command
          uv run python scripts/smoketest_*.py

  test-os:
    name: Test ${{ matrix.os }}, ${{matrix.python-version}} ${{ matrix.no_build_ext && 'pure Python' || 'Rust extension' }} ${{ matrix.architecture }}
    runs-on: ${{ matrix.os }}-latest
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu, windows, macos]
        no_build_ext: ["", "1"]
        architecture: [null]
        # To keep the matrix size reasonable, we only test oldest and newest Python versions on each OS.
        python-version: ["3.10", "3.14t"]
        include:
          # For windows, we also test 32-bit Python
          - os: windows
            architecture: x86
            no_build_ext: ""
    steps:
      - uses: actions/checkout@v7
      - uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: "1.93"
      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78

      - name: Add win32 target
        if: ${{ matrix.os == 'windows' && matrix.architecture == 'x86' }}
        run: rustup target add i686-pc-windows-msvc

      - uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}
          architecture:  ${{ matrix.architecture }}

      - name: Sync Python environment
        run: uv sync --locked --group test
        env:
          WHENEVER_NO_BUILD_RUST_EXT: ${{ matrix.no_build_ext }}

      - name: Install and test
        shell: bash
        run: |
          uv run pytest tests/ -s -v
          # NOTE: yes, we test twice: once with optional deps, once without
          uv sync --locked --group test --group integrations
          uv run pytest tests/ -s -v
        env:
          WHENEVER_NO_BUILD_RUST_EXT: ${{ matrix.no_build_ext }}

  test-pure-python:
    name: Test ubuntu, ${{ matrix.python-version }} pure Python
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: [
          # NOTE: 3.10, 3.14t are absent since we test them in the OS job matrix
          "3.11",
          "3.12",
          "3.13",
          "3.14",
          "3.15",
          "3.15t",
          # NOTE: If pypy/pytest fails, if could be due to
          #       https://github.com/pypy/pypy/issues/3959
          "pypy3.10",
          "pypy3.11"
        ]
    steps:
      - uses: actions/checkout@v7
      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
      - uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}
          allow-prereleases: true
      - name: Sync Python environment
        run: uv sync --locked --group test
        env:
          WHENEVER_NO_BUILD_RUST_EXT: "1"
      # NOTE: we end up running pytest twice in the following sections.
      # This is because we want to test the code with and without optional dependencies.
      - run: uv run pytest tests/
      - if: ${{ !contains(fromJSON('["pypy3.10", "pypy3.11", "3.15", "3.15t"]'), matrix.python-version) }}
        run: uv sync --locked --group test --group integrations
      # NOTE: we only care about coverage once. We arbitrarily choose one of the Python versions to run it on
      - if: ${{ matrix.python-version == '3.14' }}
        run: |
          uv run pytest tests/ --cov=whenever --cov-report term-missing
      - if: ${{ !contains(fromJSON('["pypy3.10", "pypy3.11", "3.15", "3.15t", "3.14"]'), matrix.python-version) }}
        run: |
          uv run pytest tests/
      - run: |
          sudo apt-get install -y tzdata  # for the zdump command
          uv run python scripts/smoketest_*.py

  lint:
    name: Linting
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
      - uses: actions/setup-python@v6
        with:
          python-version: '3.14'
      - uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: "1.93"
          components: "clippy, rustfmt"
      - run: uv sync --locked --group dev-extra
        env:
          WHENEVER_NO_BUILD_RUST_EXT: "1"
      - run: make ci-lint
        env:
          WHENEVER_NO_BUILD_RUST_EXT: "1"

  check-docstrings:
    name: Ensure docstrings in Rust/Python are synced
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
      - uses: actions/setup-python@v6
        with:
          python-version: '3.14'
      - run: uv sync --locked --no-install-project
        env:
          WHENEVER_NO_BUILD_RUST_EXT: "1"
      - run: |
          uv run python scripts/generate_docstrings.py > fresh_docstrings.rs
          if diff -q fresh_docstrings.rs src/docstrings.rs > /dev/null; then
              echo "OK"
          else
              echo "Rust docstrings are stale. Please run 'python scripts/generate_docstrings.py > src/docstrings.rs'";
              # output the actual diff
              diff -u fresh_docstrings.rs src/docstrings.rs
              exit 1
          fi
        env:
          WHENEVER_NO_BUILD_RUST_EXT: "1"
  typecheck:
    name: Typecheck Python code
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
      - uses: actions/setup-python@v6
        with:
          python-version: '3.14'
      - run: uv sync --locked --all-groups --no-install-project
        env:
          WHENEVER_NO_BUILD_RUST_EXT: "1"
      - run: make typecheck
        env:
          WHENEVER_NO_BUILD_RUST_EXT: "1"

  # https://github.com/marketplace/actions/alls-green#why
  all-green:
    name: Are all checks green?
    if: always()
    needs:
      - test-rust-ext
      - test-rust
      - test-os
      - test-pure-python
      - lint
      - check-docstrings
      - typecheck
    runs-on: ubuntu-latest

    steps:
    - name: Decide whether the needed jobs succeeded or failed
      uses: re-actors/alls-green@release/v1
      with:
        jobs: ${{ toJSON(needs) }}

The same workflow, on Latchkey

Estimated ~20% faster on cache hits, plus fewer wasted runs and a safer supply chain. Added and changed lines are highlighted.

name: Checks
 
on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:
 
env:
  RUST_BACKTRACE: 1
  # We rely on setup-python action to install Python,
  # because it does better caching and works with 32-bit Python on Windows.
  UV_PYTHON_DOWNLOADS: never
  UV_NO_MANAGED_PYTHON: "true"
 
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 
jobs:
  test-rust:
    timeout-minutes: 30
    name: Test Rust (internal tests)
    runs-on: latchkey-small
    steps:
      - uses: actions/checkout@v7
      - uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: "1.93"
      # even though we only test rust, we need CPython to link against
      - uses: actions/setup-python@v6
        with:
          cache: 'pip'
          python-version: "3.14"
      - name: Build and test
        run: |
          cargo test
  test-rust-ext:
    timeout-minutes: 30
    name: Test ubuntu, ${{ matrix.python-version }} Rust extension
    runs-on: latchkey-small
    strategy:
      fail-fast: false
      matrix:
        python-version: [
          # NOTE: 3.10, 3.14t are absent since we test them in the OS job matrix
          "3.11",
          "3.12",
          "3.13",
          "3.14",
          "3.15",
          "3.15t"
        ]
    steps:
      - uses: actions/checkout@v7
      - uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: "1.93"
      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
      - uses: actions/setup-python@v6
        with:
          cache: 'pip'
          python-version: ${{ matrix.python-version }}
          allow-prereleases: true
 
      # Testing without integrations (e.g. pydantic, time_machine) to ensure there's no accidental dependency on them
      - name: Test (debug, no dependency integrations)
        shell: bash
        run: |
          uv sync --locked --group test
          uv run pytest tests/ -s -v
 
      # Testing with integrations to ensure they work
      - name: Test (debug, all dependency integrations)
        if: ${{ matrix.python-version != '3.15' && matrix.python-version != '3.15t' }}
        shell: bash
        run: |
          uv sync --locked --group test --group integrations
          uv run pytest tests/ -s -v
      # Release mode sometimes surfaces issues not seen in debug
      - name: Test (release mode)
        shell: bash
        run: |
          uv sync --locked --reinstall-package whenever --no-editable --group test
          uv run pytest tests/ -s -v
      - run: |
          sudo apt-get install -y tzdata  # for the zdump command
          uv run python scripts/smoketest_*.py
 
  test-os:
    timeout-minutes: 30
    name: Test ${{ matrix.os }}, ${{matrix.python-version}} ${{ matrix.no_build_ext && 'pure Python' || 'Rust extension' }} ${{ matrix.architecture }}
    runs-on: ${{ matrix.os }}-latest
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu, windows, macos]
        no_build_ext: ["", "1"]
        architecture: [null]
        # To keep the matrix size reasonable, we only test oldest and newest Python versions on each OS.
        python-version: ["3.10", "3.14t"]
        include:
          # For windows, we also test 32-bit Python
          - os: windows
            architecture: x86
            no_build_ext: ""
    steps:
      - uses: actions/checkout@v7
      - uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: "1.93"
      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
 
      - name: Add win32 target
        if: ${{ matrix.os == 'windows' && matrix.architecture == 'x86' }}
        run: rustup target add i686-pc-windows-msvc
 
      - uses: actions/setup-python@v6
        with:
          cache: 'pip'
          python-version: ${{ matrix.python-version }}
          architecture:  ${{ matrix.architecture }}
 
      - name: Sync Python environment
        run: uv sync --locked --group test
        env:
          WHENEVER_NO_BUILD_RUST_EXT: ${{ matrix.no_build_ext }}
 
      - name: Install and test
        shell: bash
        run: |
          uv run pytest tests/ -s -v
          # NOTE: yes, we test twice: once with optional deps, once without
          uv sync --locked --group test --group integrations
          uv run pytest tests/ -s -v
        env:
          WHENEVER_NO_BUILD_RUST_EXT: ${{ matrix.no_build_ext }}
 
  test-pure-python:
    timeout-minutes: 30
    name: Test ubuntu, ${{ matrix.python-version }} pure Python
    runs-on: latchkey-small
    strategy:
      fail-fast: false
      matrix:
        python-version: [
          # NOTE: 3.10, 3.14t are absent since we test them in the OS job matrix
          "3.11",
          "3.12",
          "3.13",
          "3.14",
          "3.15",
          "3.15t",
          # NOTE: If pypy/pytest fails, if could be due to
          #       https://github.com/pypy/pypy/issues/3959
          "pypy3.10",
          "pypy3.11"
        ]
    steps:
      - uses: actions/checkout@v7
      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
      - uses: actions/setup-python@v6
        with:
          cache: 'pip'
          python-version: ${{ matrix.python-version }}
          allow-prereleases: true
      - name: Sync Python environment
        run: uv sync --locked --group test
        env:
          WHENEVER_NO_BUILD_RUST_EXT: "1"
      # NOTE: we end up running pytest twice in the following sections.
      # This is because we want to test the code with and without optional dependencies.
      - run: uv run pytest tests/
      - if: ${{ !contains(fromJSON('["pypy3.10", "pypy3.11", "3.15", "3.15t"]'), matrix.python-version) }}
        run: uv sync --locked --group test --group integrations
      # NOTE: we only care about coverage once. We arbitrarily choose one of the Python versions to run it on
      - if: ${{ matrix.python-version == '3.14' }}
        run: |
          uv run pytest tests/ --cov=whenever --cov-report term-missing
      - if: ${{ !contains(fromJSON('["pypy3.10", "pypy3.11", "3.15", "3.15t", "3.14"]'), matrix.python-version) }}
        run: |
          uv run pytest tests/
      - run: |
          sudo apt-get install -y tzdata  # for the zdump command
          uv run python scripts/smoketest_*.py
 
  lint:
    timeout-minutes: 30
    name: Linting
    runs-on: latchkey-small
    steps:
      - uses: actions/checkout@v7
      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
      - uses: actions/setup-python@v6
        with:
          cache: 'pip'
          python-version: '3.14'
      - uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: "1.93"
          components: "clippy, rustfmt"
      - run: uv sync --locked --group dev-extra
        env:
          WHENEVER_NO_BUILD_RUST_EXT: "1"
      - run: make ci-lint
        env:
          WHENEVER_NO_BUILD_RUST_EXT: "1"
 
  check-docstrings:
    timeout-minutes: 30
    name: Ensure docstrings in Rust/Python are synced
    runs-on: latchkey-small
    steps:
      - uses: actions/checkout@v7
      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
      - uses: actions/setup-python@v6
        with:
          cache: 'pip'
          python-version: '3.14'
      - run: uv sync --locked --no-install-project
        env:
          WHENEVER_NO_BUILD_RUST_EXT: "1"
      - run: |
          uv run python scripts/generate_docstrings.py > fresh_docstrings.rs
          if diff -q fresh_docstrings.rs src/docstrings.rs > /dev/null; then
              echo "OK"
          else
              echo "Rust docstrings are stale. Please run 'python scripts/generate_docstrings.py > src/docstrings.rs'";
              # output the actual diff
              diff -u fresh_docstrings.rs src/docstrings.rs
              exit 1
          fi
        env:
          WHENEVER_NO_BUILD_RUST_EXT: "1"
  typecheck:
    timeout-minutes: 30
    name: Typecheck Python code
    runs-on: latchkey-small
    steps:
      - uses: actions/checkout@v7
      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
      - uses: actions/setup-python@v6
        with:
          cache: 'pip'
          python-version: '3.14'
      - run: uv sync --locked --all-groups --no-install-project
        env:
          WHENEVER_NO_BUILD_RUST_EXT: "1"
      - run: make typecheck
        env:
          WHENEVER_NO_BUILD_RUST_EXT: "1"
 
  # https://github.com/marketplace/actions/alls-green#why
  all-green:
    timeout-minutes: 30
    name: Are all checks green?
    if: always()
    needs:
      - test-rust-ext
      - test-rust
      - test-os
      - test-pure-python
      - lint
      - check-docstrings
      - typecheck
    runs-on: latchkey-small
 
    steps:
    - name: Decide whether the needed jobs succeeded or failed
      uses: re-actors/alls-green@release/v1
      with:
        jobs: ${{ toJSON(needs) }}

What changed

Run on Latchkey managed runners with one line (runs-on), which apply the fixes below automatically and self-heal transient failures. This example uses latchkey-small; pick the runner size that fits the job.
Cancel superseded runs when a branch or PR gets a newer push.
Cache dependency installs on the setup step so they are served from cache.
Add a job timeout so a hung step cannot burn hours of runner time.

2 third-party actions are referenced by a movable tag. Pin them to the commit SHA (Latchkey resolves and applies this automatically) so a repointed tag cannot change what runs.

What Latchkey heals here

This workflow has steps that commonly fail on transient issues (network, registries, flaky browsers). On Latchkey managed runners they are detected, retried, and self-healed instead of failing your build:

Dependency installs

This workflow runs 8 jobs (31 with the matrix expanded) per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.

Actions used in this workflow

actions/checkout actions/setup-python astral-sh/setup-uv