Python CI Workflow Skill

Overview

This skill covers Python CI patterns for unit tests/build/scans and optional artifact uploads.

The Dojo360 workflow (python-ci.yml) exists, but for new implementations the recommended approach is to use the UHG CI Workflows reusable workflows from uhg-pipelines/ci-workflows (pip/poetry variants).

Workflow Reference

Recommended (Use This)

Repository: uhg-pipelines/ci-workflows
Workflows:

• .github/workflows/python-pip-ci.yml@v2
• .github/workflows/python-poetry-ci.yml@v2

Legacy (Dojo360)

Repository: dojo360/pipelines-workflows
Workflow: .github/workflows/python-ci.yml
Docs: https://github.com/dojo360/pipelines-workflows/tree/main/web/python-ci/index.md

Key Features

• Runs Python unit tests and quality scans
• Supports pip or Poetry based projects
• Artifactory integration via jfrog-project-key
• Optional artifact upload (coverage, dist/, build outputs)
• Optional Docker build/publish if you pass Docker inputs

Prerequisites

• Python project (pip: requirements.txt or Poetry: pyproject.toml)
• Artifactory project/repositories provisioned
• If building containers:
  • Dockerfile must use Optum golden images (no public base images)
  • Runner must have Docker available

Common Inputs (UHG reusable workflows)

Input	Type	Description
jfrog-project-key	string	JFrog project key (routes to the correct SaaS Artifactory repos)
working-directory	string	Where your Python project lives (default: .)
python-version	string	Python version (Poetry workflow commonly uses this)
source-dir	string	Source directory (pip workflow)
test-dir	string	Test directory (pip workflow)
artifact-upload	boolean	Enable artifact upload (pip workflow)
docker-tags	string	Image tag(s) to publish when doing Docker builds
docker-context	string	Docker build context
docker-dockerfile	string	Dockerfile path

Secrets

UHG reusable workflows generally handle Artifactory auth via OIDC + EPL actions, but you may still need:

• Repo/org secrets required by your org’s scanning configuration
• If you enable scanners that require tokens (e.g., Sonar), ensure those secrets exist

Templates

See ready-to-copy examples in .github/skills/github-workflows-dojo360-python-ci/templates/:

• basic-python-pip-ci.yml
• basic-python-poetry-ci.yml
• python-pip-ci-with-docker-build.yml

Notes / Gotchas

• If you build container images, ensure your Dockerfile uses Optum golden images (see .github/instructions/docker.instructions.md).
• If your Python service is containerized, consider using the patterns in .github/skills/python-container/.