Repository navigation
162 lines (157 loc) · 6.02 KB
/
Copy pathci.yml
File metadata and controls
162 lines (157 loc) · 6.02 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
name: CI
on:
push:
paths-ignore:
- "README.md"
- "CONTRIBUTING.md"
- "renovate.json"
- ".github/ISSUE_TEMPLATE/**"
- "PULL_REQUEST_TEMPLATE.md"
- "docs/**"
pull_request:
paths-ignore:
- "README.md"
- "CONTRIBUTING.md"
- "renovate.json"
- ".github/ISSUE_TEMPLATE/**"
- "PULL_REQUEST_TEMPLATE.md"
- "docs/**"
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
lint:
name: Lint and format
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- name: Set up Python
uses: actions/setup-python@v6
with:
python-version: "3.13"
cache: pip
cache-dependency-path: requirements-dev.txt
- name: Set up Node.js
uses: actions/setup-node@v6
with:
node-version: "lts/*"
cache: npm
- name: Install Python lint dependencies
run: python -m pip install -r requirements-dev.txt
- name: Install Node.js dependencies
run: npm ci --ignore-scripts
- name: Run Black
run: black --check .
- name: Run isort
run: isort --check-only .
- name: Run Flake8
run: flake8 .
- name: Run djLint
run: djlint templates/ --check --profile=jinja
- name: Run static asset checks
run: npm run check
test:
name: Test
needs: lint
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- name: Set up Python
uses: actions/setup-python@v6
with:
python-version: "3.13"
cache: pip
cache-dependency-path: |
requirements.txt
requirements-dev.txt
- name: Install dependencies
run: python -m pip install -r requirements.txt -r requirements-dev.txt
- name: Run tests with branch coverage
run: python -m pytest --cov --cov-report=term-missing --cov-fail-under=75
build:
name: Build and publish
needs: test
if: >-
(github.event_name == 'pull_request' && github.base_ref == 'develop') ||
(github.event_name == 'push' &&
(github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/tags/')))
runs-on: ubuntu-latest
timeout-minutes: 60
permissions:
contents: read
packages: write
security-events: write
id-token: write
steps:
- name: Checkout code
uses: actions/checkout@v7
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
- name: Build image for validation
uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
with:
context: .
load: true
tags: comps-ci:${{ github.sha }}
cache-from: type=gha
cache-to: type=gha,mode=max
- name: Scan image with Trivy
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
with:
image-ref: comps-ci:${{ github.sha }}
format: sarif
output: trivy-results.sarif
- name: Upload Trivy scan results
if: always()
continue-on-error: true
uses: github/codeql-action/upload-sarif@v4
with:
sarif_file: trivy-results.sarif
- name: Generate SBOM
uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
with:
image: comps-ci:${{ github.sha }}
- name: Docker metadata
if: github.event_name == 'push'
id: meta
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
with:
images: |
ghcr.io/thezak48/comps
thezak48/comps
flavor: |
latest=${{ github.ref_type == 'tag' }}
tags: |
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}
type=semver,pattern={{major}}
type=edge,branch=develop
type=sha,format=long
type=sha
- name: Login to GHCR
if: github.event_name == 'push'
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ github.token }}
- name: Login to Docker Hub
if: github.event_name == 'push'
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
with:
registry: docker.io
username: ${{ vars.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Publish multi-platform image
if: github.event_name == 'push'
uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
with:
context: .
platforms: linux/amd64,linux/arm64
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
provenance: true
sbom: true