actions/gha-workflows
3
1
Fork 0
Code Issues Pull Requests Actions Packages Releases Activity

Gitea 1.23.1 2

Browse Source
This commit is contained in:
Luke Tainton 2025-01-12 18:23:24 +00:00
parent bdde495d62
commit 36e486b708
Signed by: luke
SSH Key Fingerprint: SHA256:D34npKT7UaiT/7gULqu7EPSLWWVAjTjXf4kKfJ/fQBo
6 changed files with 109 additions and 58 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
.gitea/workflows/ci-docker.yml
View File

@ -12,7 +12,7 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Check out repository code - name: Check out repository code
uses: actions/checkout@v4.1.7 uses: actions/checkout@v4.2.2
with: with:
fetch-depth: 0 fetch-depth: 0
@ -29,9 +29,9 @@ jobs:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
- name: Snyk Vulnerability Scan - name: Snyk Vulnerability Scan
uses: snyk/actions/python-3.10@master uses: snyk/actions/python@master
continue-on-error: true # To make sure that SARIF upload gets called continue-on-error: true # Sometimes vulns aren't immediately fixable
env: env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
with: with:
args: --sarif-file-output=snyk.sarif --all-projects args: test --all-projects

22
.gitea/workflows/ci-python-poetry-with-docker.yml
View File

@ -19,14 +19,8 @@ jobs:
ci: ci:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Set python-version
id: python-version
run: |
PYTHON_VERSION=${{ inputs.python-version }}
echo "value=${PYTHON_VERSION:-"3.11"}" >> $GITEA_OUTPUT
- name: Check out repository code - name: Check out repository code
uses: actions/checkout@v4.1.7 uses: actions/checkout@v4.2.2
with: with:
fetch-depth: 0 fetch-depth: 0
@ -40,17 +34,17 @@ jobs:
- name: Setup Python - name: Setup Python
uses: actions/setup-python@v5 uses: actions/setup-python@v5
with: with:
python-version: "${{ steps.python-version.outputs.value }}" python-version: "${{ inputs.python-version }}"
- name: Setup Poetry - name: Setup Poetry
uses: abatilo/actions-poetry@v4 uses: abatilo/actions-poetry@v4
- name: Setup virtual environment - name: Setup virtual environment
run: | run: |
poetry config virtualenvs.create true --local poetry config virtualenvs.create true --local
poetry config virtualenvs.in-project true --local poetry config virtualenvs.in-project true --local
- uses: actions/cache@v3 - uses: actions/cache@v4
name: Define cache for dependencies name: Define cache for dependencies
with: with:
path: ./.venv path: ./.venv
@ -77,9 +71,9 @@ jobs:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
- name: Snyk Vulnerability Scan - name: Snyk Vulnerability Scan
uses: snyk/actions/python-3.10@master uses: snyk/actions/python@master
continue-on-error: true # To make sure that SARIF upload gets called continue-on-error: true # Sometimes vulns aren't immediately fixable
env: env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
with: with:
args: --sarif-file-output=snyk.sarif --all-projects args: test --all-projects

22
.gitea/workflows/ci-python-poetry.yml
View File

@ -19,31 +19,25 @@ jobs:
ci: ci:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Set python-version
id: python-version
run: |
PYTHON_VERSION=${{ inputs.python-version }}
echo "value=${PYTHON_VERSION:-"3.11"}" >> $GITEA_OUTPUT
- name: Check out repository code - name: Check out repository code
uses: actions/checkout@v4.1.7 uses: actions/checkout@v4.2.2
with: with:
fetch-depth: 0 fetch-depth: 0
- name: Setup Python - name: Setup Python
uses: actions/setup-python@v5 uses: actions/setup-python@v5
with: with:
python-version: "${{ steps.python-version.outputs.value }}" python-version: "${{ inputs.python-version }}"
- name: Setup Poetry - name: Setup Poetry
uses: abatilo/actions-poetry@v4 uses: abatilo/actions-poetry@v4
- name: Setup virtual environment - name: Setup virtual environment
run: | run: |
poetry config virtualenvs.create true --local poetry config virtualenvs.create true --local
poetry config virtualenvs.in-project true --local poetry config virtualenvs.in-project true --local
- uses: actions/cache@v3 - uses: actions/cache@v4
name: Define cache for dependencies name: Define cache for dependencies
with: with:
path: ./.venv path: ./.venv
@ -68,9 +62,9 @@ jobs:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
- name: Snyk Vulnerability Scan - name: Snyk Vulnerability Scan
uses: snyk/actions/python-3.10@master uses: snyk/actions/python@master
continue-on-error: true # To make sure that SARIF upload gets called continue-on-error: true # Sometimes vulns aren't immediately fixable
env: env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
with: with:
args: --sarif-file-output=snyk.sarif --all-projects args: test --all-projects

75
.gitea/workflows/ci-python-uv-with-docker.yml Normal file
View File

@ -0,0 +1,75 @@
name: Python w/ UV + Docker CI
on:
workflow_call:
inputs:
python-version:
type: string
default: "3.11"
description: "Version of Python to use for testing environment"
secrets:
SONAR_TOKEN:
required: true
SNYK_TOKEN:
required: true
jobs:
ci:
runs-on: ubuntu-latest
steps:
- name: Check out repository code
uses: actions/checkout@v4.2.2
with:
fetch-depth: 0
- name: Run Hadolint
uses: hadolint/hadolint-action@v3.1.0
with:
dockerfile: Dockerfile
output-file: hadolint.out
format: sonarqube
no-fail: true
- name: Setup Python
uses: actions/setup-python@v5
with:
python-version: "${{ vars.PYTHON_VERSION }}"
- name: uv cache
uses: actions/cache@v4
with:
path: /tmp/.uv-cache
key: uv-${{ runner.os }}-${{ hashFiles('uv.lock') }}
restore-keys: |
uv-${{ runner.os }}-${{ hashFiles('uv.lock') }}
uv-${{ runner.os }}
- name: Install dependencies
run: uv sync
- name: Lint
run: |
uv run pylint --fail-under=8 --recursive=yes --output-format=parseable --output=lintreport.txt app/ tests/
cat lintreport.txt
- name: Unit Test
run: |
uv run coverage run -m pytest -v --junitxml=testresults.xml
uv run coverage xml
sed -i 's@${{ gitea.workspace }}@/github/workspace@g' coverage.xml
- name: Minimize uv cache
run: uv cache prune --ci
- name: SonarQube Cloud Scan
uses: SonarSource/sonarqube-scan-action@v4.2.1
env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
- name: Snyk Vulnerability Scan
uses: snyk/actions/python@master
continue-on-error: true # Sometimes vulns aren't immediately fixable
env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
with:
command: snyk
args: test --all-projects

20
.gitea/workflows/ci-python-with-docker.yml
View File

@ -16,14 +16,8 @@ jobs:
ci: ci:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Set python-version
id: python-version
run: |
PYTHON_VERSION=${{ inputs.python-version }}
echo "value=${PYTHON_VERSION:-"3.11"}" >> $GITEA_OUTPUT
- name: Check out repository code - name: Check out repository code
uses: actions/checkout@v4.1.7 uses: actions/checkout@v4.2.2
with: with:
fetch-depth: 0 fetch-depth: 0
@ -37,12 +31,12 @@ jobs:
- name: Setup Python - name: Setup Python
uses: actions/setup-python@v5 uses: actions/setup-python@v5
with: with:
python-version: "${{ steps.python-version.outputs.value }}" python-version: "${{ inputs.python-version }}"
- name: Update Pip - name: Update Pip
run: pip install -U pip run: pip install -U pip
- uses: actions/cache@v3 - uses: actions/cache@v4
name: Define cache for dependencies name: Define cache for dependencies
with: with:
path: . path: .
@ -69,9 +63,9 @@ jobs:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
- name: Snyk Vulnerability Scan - name: Snyk Vulnerability Scan
uses: snyk/actions/python-3.10@master uses: snyk/actions/python@master
continue-on-error: true # To make sure that SARIF upload gets called continue-on-error: true # Sometimes vulns aren't immediately fixable
env: env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
with: with:
args: --sarif-file-output=snyk.sarif --all-projects args: test --all-projects

20
.gitea/workflows/ci-python.yml
View File

@ -16,26 +16,20 @@ jobs:
ci: ci:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Set python-version
id: python-version
run: |
PYTHON_VERSION=${{ inputs.python-version }}
echo "value=${PYTHON_VERSION:-"3.11"}" >> $GITEA_OUTPUT
- name: Check out repository code - name: Check out repository code
uses: actions/checkout@v4.1.7 uses: actions/checkout@v4.2.2
with: with:
fetch-depth: 0 fetch-depth: 0
- name: Setup Python - name: Setup Python
uses: actions/setup-python@v5 uses: actions/setup-python@v5
with: with:
python-version: "${{ steps.python-version.outputs.value }}" python-version: "${{ inputs.python-version }}"
- name: Update Pip - name: Update Pip
run: pip install -U pip run: pip install -U pip
- uses: actions/cache@v3 - uses: actions/cache@v4
name: Define cache for dependencies name: Define cache for dependencies
with: with:
path: . path: .
@ -62,9 +56,9 @@ jobs:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
- name: Snyk Vulnerability Scan - name: Snyk Vulnerability Scan
uses: snyk/actions/python-3.10@master uses: snyk/actions/python@master
continue-on-error: true # To make sure that SARIF upload gets called continue-on-error: true # Sometimes vulns aren't immediately fixable
env: env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
with: with:
args: --sarif-file-output=snyk.sarif --all-projects args: test --all-projects