sharinghub-server/.github/workflows/test.yml at main · csgroup-oss/sharinghub-server · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
name: Test

on:
  push:
    branches:
      - main
    tags:
      - "[0-9]+.[0-9]+.[0-9]+"
  pull_request:
    branches:
      - main

env:
  IMAGE_NAME: ${{ github.event.repository.name }}
  IMAGE_TAG: ${{ github.ref_name }}

jobs:
  build:
    name: Build package
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: "pip"
      - name: Update pip
        run: pip install --upgrade pip
      - name: Install build dependencies
        run: pip install build twine
      - name: Run build
        run: python -m build
      - name: Run twine check
        run: python -m twine check dist/*

  lint:
    name: Lint repository files
    runs-on: ubuntu-latest
    needs: [build]
    env:
      SKIP: "gitleaks"
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: "pip"
      - name: Update pip
        run: pip install --upgrade pip
      - name: Install dev dependencies
        run: pip install .[dev]
      - name: Run pre-commit
        uses: pre-commit/action@v3.0.1

  audit:
    name: Audit dependencies
    runs-on: ubuntu-latest
    needs: [build]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: "pip"
      - name: Update pip
        run: pip install --upgrade pip
      - name: Install audit dependencies
        run: pip install pip-audit~=2.7
      - name: Run pip-audit
        run: pip-audit --aliases --skip-editable .

  scan:
    name: Scan git history
    runs-on: ubuntu-latest
    needs: [build]
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: "pip"
      - name: Update pip
        run: pip install --upgrade pip
      - name: Install scan dependencies
        run: pip install commitizen
      - name: Run Commitizen
        run: python -m commitizen check --rev-range HEAD
      - name: Run GitLeaks
        run: docker run -v $(pwd):/repo ghcr.io/gitleaks/gitleaks:v8.21.2 detect --verbose --source="/repo"

  docker-build-and-scan:
    name: Build and scan docker image
    runs-on: ubuntu-latest
    needs: [lint, audit, scan]
    if: ${{ github.event_name != 'push' }}
    steps:
      - uses: actions/checkout@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Build image
        uses: docker/build-push-action@v6
        with:
          tags: ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}
          load: true
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1  # 0.35.0
        with:
          image-ref: ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}
          severity: "HIGH,CRITICAL"
          vuln-type: "library"
          format: "table"
          exit-code: "1"
          ignore-unfixed: true