actions/gha-workflows
5
1
Fork 0
Code Issues Pull Requests Actions Packages Releases Activity

Compare commits

base: actions:main
Branches Tags
actions:main
..
compare: actions:8512e850adea2605e67cc9dcd42effdfac10d2f8
Branches Tags
actions:main

1 Commits
main ... 8512e850ad

Author SHA1 Message Date
Renovate [BOT]
8512e850ad chore(deps): update actions/setup-python action to v6 2025-09-09 13:11:41 +00:00
20 changed files with 255 additions and 305 deletions
Expand all files Collapse all files

2
.gitea/workflows/build-push-docker.yml
View File

@@ -43,7 +43,7 @@ jobs:
REPO: ${{ gitea.repository }} REPO: ${{ gitea.repository }}
- name: Check out repository - name: Check out repository
uses: actions/checkout@v6.0.2 uses: actions/checkout@v4.3.0
with: with:
fetch-depth: 0 fetch-depth: 0
ref: ${{ inputs.release }} ref: ${{ inputs.release }}

2
.gitea/workflows/changelog.yaml
View File

@@ -19,7 +19,7 @@ jobs:
clean_changelog: ${{ steps.get_next_version.outputs.clean_changelog }} clean_changelog: ${{ steps.get_next_version.outputs.clean_changelog }}
steps: steps:
- name: Check out repository - name: Check out repository
uses: actions/checkout@v6.0.2 uses: actions/checkout@v4.3.0
with: with:
fetch-depth: 0 fetch-depth: 0

26
.gitea/workflows/ci-docker.yml
View File

@@ -12,26 +12,26 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Check out repository code - name: Check out repository code
uses: actions/checkout@v6.0.2 uses: actions/checkout@v4.3.0
with: with:
fetch-depth: 0 fetch-depth: 0
- uses: hadolint/hadolint-action@v3.3.0 - uses: hadolint/hadolint-action@v3.2.0
with: with:
dockerfile: Dockerfile dockerfile: Dockerfile
output-file: hadolint.out output-file: hadolint.out
format: sonarqube format: sonarqube
no-fail: true no-fail: true
# - name: SonarQube Cloud Scan - name: SonarQube Cloud Scan
# uses: SonarSource/sonarqube-scan-action@v7.0.0 uses: SonarSource/sonarqube-scan-action@v5.3.1
# env: env:
# SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
# - name: Snyk Vulnerability Scan - name: Snyk Vulnerability Scan
# uses: snyk/actions/python@master uses: snyk/actions/python@master
# continue-on-error: true # Sometimes vulns aren't immediately fixable continue-on-error: true # Sometimes vulns aren't immediately fixable
# env: env:
# SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
# with: with:
# args: test --all-projects args: test --all-projects

38
.gitea/workflows/ci-python-poetry-with-docker.yml
View File

@@ -6,11 +6,11 @@ on:
type: string type: string
default: "3.11" default: "3.11"
description: "Version of Python to use for testing environment" description: "Version of Python to use for testing environment"
# secrets: secrets:
# SONAR_TOKEN: SONAR_TOKEN:
# required: true required: true
# SNYK_TOKEN: SNYK_TOKEN:
# required: true required: true
env: env:
PATH: ${{ env.PATH }}:/root/.poetry/bin PATH: ${{ env.PATH }}:/root/.poetry/bin
@@ -20,11 +20,11 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Check out repository code - name: Check out repository code
uses: actions/checkout@v6.0.2 uses: actions/checkout@v4.3.0
with: with:
fetch-depth: 0 fetch-depth: 0
- uses: hadolint/hadolint-action@v3.3.0 - uses: hadolint/hadolint-action@v3.2.0
with: with:
dockerfile: Dockerfile dockerfile: Dockerfile
output-file: hadolint.out output-file: hadolint.out
@@ -44,7 +44,7 @@ jobs:
poetry config virtualenvs.create true --local poetry config virtualenvs.create true --local
poetry config virtualenvs.in-project true --local poetry config virtualenvs.in-project true --local
- uses: actions/cache@v5 - uses: actions/cache@v4
name: Define cache for dependencies name: Define cache for dependencies
with: with:
path: ./.venv path: ./.venv
@@ -65,15 +65,15 @@ jobs:
poetry run coverage xml poetry run coverage xml
sed -i 's@${{ gitea.workspace }}@/github/workspace@g' coverage.xml sed -i 's@${{ gitea.workspace }}@/github/workspace@g' coverage.xml
# - name: SonarQube Cloud Scan - name: SonarQube Cloud Scan
# uses: SonarSource/sonarqube-scan-action@v7.0.0 uses: SonarSource/sonarqube-scan-action@v5.3.1
# env: env:
# SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
# - name: Snyk Vulnerability Scan - name: Snyk Vulnerability Scan
# uses: snyk/actions/python@master uses: snyk/actions/python@master
# continue-on-error: true # Sometimes vulns aren't immediately fixable continue-on-error: true # Sometimes vulns aren't immediately fixable
# env: env:
# SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
# with: with:
# args: test --all-projects args: test --all-projects

36
.gitea/workflows/ci-python-poetry.yml
View File

@@ -6,11 +6,11 @@ on:
type: string type: string
default: "3.11" default: "3.11"
description: "Version of Python to use for testing environment" description: "Version of Python to use for testing environment"
# secrets: secrets:
# SONAR_TOKEN: SONAR_TOKEN:
# required: true required: true
# SNYK_TOKEN: SNYK_TOKEN:
# required: true required: true
env: env:
PATH: ${{ env.PATH }}:/root/.poetry/bin PATH: ${{ env.PATH }}:/root/.poetry/bin
@@ -20,7 +20,7 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Check out repository code - name: Check out repository code
uses: actions/checkout@v6.0.2 uses: actions/checkout@v4.3.0
with: with:
fetch-depth: 0 fetch-depth: 0
@@ -37,7 +37,7 @@ jobs:
poetry config virtualenvs.create true --local poetry config virtualenvs.create true --local
poetry config virtualenvs.in-project true --local poetry config virtualenvs.in-project true --local
- uses: actions/cache@v5 - uses: actions/cache@v4
name: Define cache for dependencies name: Define cache for dependencies
with: with:
path: ./.venv path: ./.venv
@@ -56,15 +56,15 @@ jobs:
poetry run coverage xml poetry run coverage xml
sed -i 's@${{ github.workspace }}@/github/workspace@g' coverage.xml sed -i 's@${{ github.workspace }}@/github/workspace@g' coverage.xml
# - name: SonarQube Cloud Scan - name: SonarQube Cloud Scan
# uses: SonarSource/sonarqube-scan-action@v7.0.0 uses: SonarSource/sonarqube-scan-action@v5.3.1
# env: env:
# SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
# - name: Snyk Vulnerability Scan - name: Snyk Vulnerability Scan
# uses: snyk/actions/python@master uses: snyk/actions/python@master
# continue-on-error: true # Sometimes vulns aren't immediately fixable continue-on-error: true # Sometimes vulns aren't immediately fixable
# env: env:
# SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
# with: with:
# args: test --all-projects args: test --all-projects

46
.gitea/workflows/ci-python-uv-with-docker.yml
View File

@@ -6,25 +6,25 @@ on:
type: string type: string
default: "3.11" default: "3.11"
description: "Version of Python to use for testing environment" description: "Version of Python to use for testing environment"
# secrets: secrets:
# SONAR_HOST_URL: SONAR_HOST_URL:
# required: false required: false
# SONAR_TOKEN: SONAR_TOKEN:
# required: true required: true
# SNYK_TOKEN: SNYK_TOKEN:
# required: true required: true
jobs: jobs:
ci: ci:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Check out repository code - name: Check out repository code
uses: actions/checkout@v6.0.2 uses: actions/checkout@v4.3.0
with: with:
fetch-depth: 0 fetch-depth: 0
- name: Run Hadolint - name: Run Hadolint
uses: hadolint/hadolint-action@v3.3.0 uses: hadolint/hadolint-action@v3.2.0
with: with:
dockerfile: Dockerfile dockerfile: Dockerfile
output-file: hadolint.out output-file: hadolint.out
@@ -37,7 +37,7 @@ jobs:
python-version: "${{ vars.PYTHON_VERSION }}" python-version: "${{ vars.PYTHON_VERSION }}"
- name: uv cache - name: uv cache
uses: actions/cache@v5 uses: actions/cache@v4
with: with:
path: /tmp/.uv-cache path: /tmp/.uv-cache
key: uv-${{ runner.os }}-${{ hashFiles('uv.lock') }} key: uv-${{ runner.os }}-${{ hashFiles('uv.lock') }}
@@ -62,17 +62,17 @@ jobs:
- name: Minimize uv cache - name: Minimize uv cache
run: uv cache prune --ci run: uv cache prune --ci
# - name: SonarQube Scan - name: SonarQube Scan
# uses: SonarSource/sonarqube-scan-action@v7.0.0 uses: SonarSource/sonarqube-scan-action@v5.3.1
# env: env:
# SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }} SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
# SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
# - name: Snyk Vulnerability Scan - name: Snyk Vulnerability Scan
# uses: snyk/actions/python@master uses: snyk/actions/python@master
# continue-on-error: true # Sometimes vulns aren't immediately fixable continue-on-error: true # Sometimes vulns aren't immediately fixable
# env: env:
# SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
# with: with:
# command: snyk command: snyk
# args: test --all-projects args: test --all-projects

38
.gitea/workflows/ci-python-with-docker.yml
View File

@@ -6,22 +6,22 @@ on:
type: string type: string
default: "3.11" default: "3.11"
description: "Version of Python to use for testing environment" description: "Version of Python to use for testing environment"
# secrets: secrets:
# SONAR_TOKEN: SONAR_TOKEN:
# required: true required: true
# SNYK_TOKEN: SNYK_TOKEN:
# required: true required: true
jobs: jobs:
ci: ci:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Check out repository code - name: Check out repository code
uses: actions/checkout@v6.0.2 uses: actions/checkout@v4.3.0
with: with:
fetch-depth: 0 fetch-depth: 0
- uses: hadolint/hadolint-action@v3.3.0 - uses: hadolint/hadolint-action@v3.2.0
with: with:
dockerfile: Dockerfile dockerfile: Dockerfile
output-file: hadolint.out output-file: hadolint.out
@@ -36,7 +36,7 @@ jobs:
- name: Update Pip - name: Update Pip
run: pip install -U pip run: pip install -U pip
- uses: actions/cache@v5 - uses: actions/cache@v4
name: Define cache for dependencies name: Define cache for dependencies
with: with:
path: . path: .
@@ -57,15 +57,15 @@ jobs:
coverage xml coverage xml
sed -i 's@${{ github.workspace }}@/github/workspace@g' coverage.xml sed -i 's@${{ github.workspace }}@/github/workspace@g' coverage.xml
# - name: SonarQube Cloud Scan - name: SonarQube Cloud Scan
# uses: SonarSource/sonarqube-scan-action@v7.0.0 uses: SonarSource/sonarqube-scan-action@v5.3.1
# env: env:
# SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
# - name: Snyk Vulnerability Scan - name: Snyk Vulnerability Scan
# uses: snyk/actions/python@master uses: snyk/actions/python@master
# continue-on-error: true # Sometimes vulns aren't immediately fixable continue-on-error: true # Sometimes vulns aren't immediately fixable
# env: env:
# SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
# with: with:
# args: test --all-projects args: test --all-projects

36
.gitea/workflows/ci-python.yml
View File

@@ -6,18 +6,18 @@ on:
type: string type: string
default: "3.11" default: "3.11"
description: "Version of Python to use for testing environment" description: "Version of Python to use for testing environment"
# secrets: secrets:
# SONAR_TOKEN: SONAR_TOKEN:
# required: true required: true
# SNYK_TOKEN: SNYK_TOKEN:
# required: true required: true
jobs: jobs:
ci: ci:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Check out repository code - name: Check out repository code
uses: actions/checkout@v6.0.2 uses: actions/checkout@v4.3.0
with: with:
fetch-depth: 0 fetch-depth: 0
@@ -29,7 +29,7 @@ jobs:
- name: Update Pip - name: Update Pip
run: pip install -U pip run: pip install -U pip
- uses: actions/cache@v5 - uses: actions/cache@v4
name: Define cache for dependencies name: Define cache for dependencies
with: with:
path: . path: .
@@ -50,15 +50,15 @@ jobs:
coverage xml coverage xml
sed -i 's@${{ github.workspace }}@/github/workspace@g' coverage.xml sed -i 's@${{ github.workspace }}@/github/workspace@g' coverage.xml
# - name: SonarQube Cloud Scan - name: SonarQube Cloud Scan
# uses: SonarSource/sonarqube-scan-action@v7.0.0 uses: SonarSource/sonarqube-scan-action@v5.3.1
# env: env:
# SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
# - name: Snyk Vulnerability Scan - name: Snyk Vulnerability Scan
# uses: snyk/actions/python@master uses: snyk/actions/python@master
# continue-on-error: true # Sometimes vulns aren't immediately fixable continue-on-error: true # Sometimes vulns aren't immediately fixable
# env: env:
# SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
# with: with:
# args: test --all-projects args: test --all-projects

4
.gitea/workflows/create-release.yml
View File

@@ -19,7 +19,7 @@ jobs:
clean_changelog: ${{ steps.get_next_version.outputs.clean_changelog }} clean_changelog: ${{ steps.get_next_version.outputs.clean_changelog }}
steps: steps:
- name: Check out repository - name: Check out repository
uses: actions/checkout@v6.0.2 uses: actions/checkout@v4.3.0
with: with:
fetch-depth: 0 fetch-depth: 0
@@ -72,7 +72,7 @@ jobs:
needs: get_next_release needs: get_next_release
steps: steps:
- name: Check out repository - name: Check out repository
uses: actions/checkout@v6.0.2 uses: actions/checkout@v4.3.0
with: with:
fetch-depth: 0 fetch-depth: 0

10
.gitea/workflows/docker-compose-deploy.yml
View File

@@ -24,7 +24,7 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: "[ON RUNNER] Notify Build Start" - name: "[ON RUNNER] Notify Build Start"
uses: https://git.tainton.uk/actions/pushover-action@v1.1.4 uses: https://git.tainton.uk/actions/pushover-action@v1.1.3
env: env:
PUSHOVER_APP_TOKEN: ${{ secrets.PUSHOVER_APP_TOKEN }} PUSHOVER_APP_TOKEN: ${{ secrets.PUSHOVER_APP_TOKEN }}
PUSHOVER_USER_TOKEN: ${{ secrets.PUSHOVER_USER_TOKEN }} PUSHOVER_USER_TOKEN: ${{ secrets.PUSHOVER_USER_TOKEN }}
@@ -35,7 +35,7 @@ jobs:
url_title: 'View Logs' url_title: 'View Logs'
- name: "[ON RUNNER] Checkout the repo" - name: "[ON RUNNER] Checkout the repo"
uses: actions/checkout@v6 uses: actions/checkout@v4
- name: "[ON RUNNER] Set project variables" - name: "[ON RUNNER] Set project variables"
run: | run: |
@@ -54,7 +54,7 @@ jobs:
ALLSECRETS: ${{ toJSON(secrets) }} ALLSECRETS: ${{ toJSON(secrets) }}
- name: "[ON HOST] Make directory if not exists" - name: "[ON HOST] Make directory if not exists"
uses: appleboy/ssh-action@v1.2.5 uses: appleboy/ssh-action@v1.2.2
with: with:
host: ${{ secrets.DEPLOY_HOST }} host: ${{ secrets.DEPLOY_HOST }}
username: ${{ secrets.DEPLOY_USERNAME }} username: ${{ secrets.DEPLOY_USERNAME }}
@@ -74,7 +74,7 @@ jobs:
target: "${{ env.project_folder }}/" target: "${{ env.project_folder }}/"
- name: "[ON HOST] Deploy Stack" - name: "[ON HOST] Deploy Stack"
uses: appleboy/ssh-action@v1.2.5 uses: appleboy/ssh-action@v1.2.2
with: with:
host: ${{ secrets.DEPLOY_HOST }} host: ${{ secrets.DEPLOY_HOST }}
username: ${{ secrets.DEPLOY_USERNAME }} username: ${{ secrets.DEPLOY_USERNAME }}
@@ -85,7 +85,7 @@ jobs:
docker compose --env-file .env up --detach docker compose --env-file .env up --detach
- name: "[ON RUNNER] Notify Build End" - name: "[ON RUNNER] Notify Build End"
uses: https://git.tainton.uk/actions/pushover-action@v1.1.4 uses: https://git.tainton.uk/actions/pushover-action@v1.1.3
env: env:
PUSHOVER_APP_TOKEN: ${{ secrets.PUSHOVER_APP_TOKEN }} PUSHOVER_APP_TOKEN: ${{ secrets.PUSHOVER_APP_TOKEN }}
PUSHOVER_USER_TOKEN: ${{ secrets.PUSHOVER_USER_TOKEN }} PUSHOVER_USER_TOKEN: ${{ secrets.PUSHOVER_USER_TOKEN }}

6
.gitea/workflows/docker-compose-remove.yml
View File

@@ -24,7 +24,7 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: "[ON RUNNER] Notify Build Start" - name: "[ON RUNNER] Notify Build Start"
uses: https://git.tainton.uk/actions/pushover-action@v1.1.4 uses: https://git.tainton.uk/actions/pushover-action@v1.1.3
env: env:
PUSHOVER_APP_TOKEN: ${{ secrets.PUSHOVER_APP_TOKEN }} PUSHOVER_APP_TOKEN: ${{ secrets.PUSHOVER_APP_TOKEN }}
PUSHOVER_USER_TOKEN: ${{ secrets.PUSHOVER_USER_TOKEN }} PUSHOVER_USER_TOKEN: ${{ secrets.PUSHOVER_USER_TOKEN }}
@@ -41,7 +41,7 @@ jobs:
echo "project_folder=/home/${{ secrets.DEPLOY_USERNAME }}/$projectname" >> $GITEA_ENV echo "project_folder=/home/${{ secrets.DEPLOY_USERNAME }}/$projectname" >> $GITEA_ENV
- name: "[ON HOST] Remove Stack" - name: "[ON HOST] Remove Stack"
uses: appleboy/ssh-action@v1.2.5 uses: appleboy/ssh-action@v1.2.2
with: with:
host: ${{ secrets.DEPLOY_HOST }} host: ${{ secrets.DEPLOY_HOST }}
username: ${{ secrets.DEPLOY_USERNAME }} username: ${{ secrets.DEPLOY_USERNAME }}
@@ -54,7 +54,7 @@ jobs:
rm -rf ${{ env.project_folder }} rm -rf ${{ env.project_folder }}
- name: "[ON RUNNER] Notify Build End" - name: "[ON RUNNER] Notify Build End"
uses: https://git.tainton.uk/actions/pushover-action@v1.1.4 uses: https://git.tainton.uk/actions/pushover-action@v1.1.3
env: env:
PUSHOVER_APP_TOKEN: ${{ secrets.PUSHOVER_APP_TOKEN }} PUSHOVER_APP_TOKEN: ${{ secrets.PUSHOVER_APP_TOKEN }}
PUSHOVER_USER_TOKEN: ${{ secrets.PUSHOVER_USER_TOKEN }} PUSHOVER_USER_TOKEN: ${{ secrets.PUSHOVER_USER_TOKEN }}

2
.gitea/workflows/release-with-tag.yaml
View File

@@ -19,7 +19,7 @@ jobs:
clean_changelog: ${{ steps.get_next_version.outputs.clean_changelog }} clean_changelog: ${{ steps.get_next_version.outputs.clean_changelog }}
steps: steps:
- name: Check out repository - name: Check out repository
uses: actions/checkout@v6.0.2 uses: actions/checkout@v4.3.0
with: with:
fetch-depth: 0 fetch-depth: 0

2
.github/workflows/build-push-attest-docker.yml vendored
View File

@@ -24,7 +24,7 @@ jobs:
success: ${{ steps.set_flag.outputs.success }} success: ${{ steps.set_flag.outputs.success }}
steps: steps:
- name: Check out the repo - name: Check out the repo
uses: actions/checkout@v6 uses: actions/checkout@v4
with: with:
ref: ${{ inputs.release }} ref: ${{ inputs.release }}

49
.github/workflows/ci-docker.yml vendored
View File

@@ -1,43 +1,40 @@
name: Docker CI name: Docker CI
on: on:
workflow_call: workflow_call:
# secrets: secrets:
# SONAR_TOKEN: SONAR_TOKEN:
# required: true required: true
# SNYK_TOKEN: SNYK_TOKEN:
# required: true required: true
jobs: jobs:
ci: ci:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Check out repository code - name: Check out repository code
uses: actions/checkout@v6.0.2 uses: actions/checkout@v4.3.0
with: with:
fetch-depth: 0 fetch-depth: 0
- uses: hadolint/hadolint-action@v3.2.0
- uses: hadolint/hadolint-action@v3.3.0
with: with:
dockerfile: Dockerfile dockerfile: Dockerfile
output-file: hadolint.out output-file: hadolint.out
format: sonarqube format: sonarqube
no-fail: true no-fail: true
- name: SonarQube Cloud Scan
uses: SonarSource/sonarqube-scan-action@v5.3.1
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
- name: Snyk Vulnerability Scan
uses: snyk/actions/python-3.10@master
continue-on-error: true # To make sure that SARIF upload gets called
env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
with:
args: --sarif-file-output=snyk.sarif --all-projects
- name: Upload result to GitHub Code Scanning
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: snyk.sarif
# - name: SonarQube Cloud Scan
# uses: SonarSource/sonarqube-scan-action@v7.0.0
# env:
# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
# - name: Snyk Vulnerability Scan
# uses: snyk/actions/python-3.10@master
# continue-on-error: true # To make sure that SARIF upload gets called
# env:
# SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
# with:
# args: --sarif-file-output=snyk.sarif --all-projects
# - name: Upload result to GitHub Code Scanning
# uses: github/codeql-action/upload-sarif@v4
# with:
# sarif_file: snyk.sarif

56
.github/workflows/ci-python-poetry-with-docker.yml vendored
View File

@@ -6,11 +6,11 @@ on:
type: string type: string
default: "3.11" default: "3.11"
description: "Version of Python to use for testing environment" description: "Version of Python to use for testing environment"
# secrets: secrets:
# SONAR_TOKEN: SONAR_TOKEN:
# required: true required: true
# SNYK_TOKEN: SNYK_TOKEN:
# required: true required: true
jobs: jobs:
ci: ci:
@@ -21,56 +21,46 @@ jobs:
run: | run: |
PYTHON_VERSION=${{ inputs.python-version }} PYTHON_VERSION=${{ inputs.python-version }}
echo "value=${PYTHON_VERSION:-"3.11"}" >> $GITHUB_OUTPUT echo "value=${PYTHON_VERSION:-"3.11"}" >> $GITHUB_OUTPUT
- name: Check out repository code - name: Check out repository code
uses: actions/checkout@v6.0.2 uses: actions/checkout@v4.3.0
with: with:
fetch-depth: 0 fetch-depth: 0
- uses: hadolint/hadolint-action@v3.2.0
- uses: hadolint/hadolint-action@v3.3.0
with: with:
dockerfile: Dockerfile dockerfile: Dockerfile
output-file: hadolint.out output-file: hadolint.out
format: sonarqube format: sonarqube
no-fail: true no-fail: true
- name: Setup Python - name: Setup Python
uses: actions/setup-python@v6 uses: actions/setup-python@v6
with: with:
python-version: "${{ steps.python-version.outputs.value }}" python-version: "${{ steps.python-version.outputs.value }}"
- name: Setup Poetry - name: Setup Poetry
uses: abatilo/actions-poetry@v4 uses: abatilo/actions-poetry@v4
- name: Install dependencies - name: Install dependencies
run: poetry install run: poetry install
- name: Lint - name: Lint
run: | run: |
poetry run pylint --fail-under=8 --recursive=yes --output-format=parseable --output=lintreport.txt . poetry run pylint --fail-under=8 --recursive=yes --output-format=parseable --output=lintreport.txt .
cat lintreport.txt cat lintreport.txt
- name: Unit Test - name: Unit Test
run: | run: |
poetry run coverage run -m pytest -v --junitxml=testresults.xml poetry run coverage run -m pytest -v --junitxml=testresults.xml
poetry run coverage xml poetry run coverage xml
sed -i 's@${{ github.workspace }}@/github/workspace@g' coverage.xml sed -i 's@${{ github.workspace }}@/github/workspace@g' coverage.xml
- name: SonarQube Cloud Scan
# - name: SonarQube Cloud Scan uses: SonarSource/sonarqube-scan-action@v5.3.1
# uses: SonarSource/sonarqube-scan-action@v7.0.0 env:
# env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
# SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} - name: Snyk Vulnerability Scan
uses: snyk/actions/python-3.10@master
# - name: Snyk Vulnerability Scan continue-on-error: true # To make sure that SARIF upload gets called
# uses: snyk/actions/python-3.10@master env:
# continue-on-error: true # To make sure that SARIF upload gets called SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
# env: with:
# SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} args: --sarif-file-output=snyk.sarif --all-projects
# with: - name: Upload result to GitHub Code Scanning
# args: --sarif-file-output=snyk.sarif --all-projects uses: github/codeql-action/upload-sarif@v3
with:
# - name: Upload result to GitHub Code Scanning sarif_file: snyk.sarif
# uses: github/codeql-action/upload-sarif@v4
# with:
# sarif_file: snyk.sarif

53
.github/workflows/ci-python-poetry.yml vendored
View File

@@ -6,11 +6,11 @@ on:
type: string type: string
default: "3.11" default: "3.11"
description: "Version of Python to use for testing environment" description: "Version of Python to use for testing environment"
# secrets: secrets:
# SONAR_TOKEN: SONAR_TOKEN:
# required: true required: true
# SNYK_TOKEN: SNYK_TOKEN:
# required: true required: true
jobs: jobs:
ci: ci:
@@ -21,47 +21,38 @@ jobs:
run: | run: |
PYTHON_VERSION=${{ inputs.python-version }} PYTHON_VERSION=${{ inputs.python-version }}
echo "value=${PYTHON_VERSION:-"3.11"}" >> $GITHUB_OUTPUT echo "value=${PYTHON_VERSION:-"3.11"}" >> $GITHUB_OUTPUT
- name: Check out repository code - name: Check out repository code
uses: actions/checkout@v6.0.2 uses: actions/checkout@v4.3.0
with: with:
fetch-depth: 0 fetch-depth: 0
- name: Setup Python - name: Setup Python
uses: actions/setup-python@v6 uses: actions/setup-python@v6
with: with:
python-version: "${{ steps.python-version.outputs.value }}" python-version: "${{ steps.python-version.outputs.value }}"
- name: Setup Poetry - name: Setup Poetry
uses: abatilo/actions-poetry@v4 uses: abatilo/actions-poetry@v4
- name: Install dependencies - name: Install dependencies
run: poetry install run: poetry install
- name: Lint - name: Lint
run: poetry run pylint --fail-under=8 --recursive=yes --output-format=parseable --output=lintreport.txt . run: poetry run pylint --fail-under=8 --recursive=yes --output-format=parseable --output=lintreport.txt .
- name: Unit Test - name: Unit Test
run: | run: |
poetry run coverage run -m pytest -v --junitxml=testresults.xml poetry run coverage run -m pytest -v --junitxml=testresults.xml
poetry run coverage xml poetry run coverage xml
sed -i 's@${{ github.workspace }}@/github/workspace@g' coverage.xml sed -i 's@${{ github.workspace }}@/github/workspace@g' coverage.xml
- name: SonarQube Cloud Scan
# - name: SonarQube Cloud Scan uses: SonarSource/sonarqube-scan-action@v5.3.1
# uses: SonarSource/sonarqube-scan-action@v7.0.0 env:
# env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
# SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} - name: Snyk Vulnerability Scan
uses: snyk/actions/python-3.10@master
# - name: Snyk Vulnerability Scan continue-on-error: true # To make sure that SARIF upload gets called
# uses: snyk/actions/python-3.10@master env:
# continue-on-error: true # To make sure that SARIF upload gets called SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
# env: with:
# SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} args: --sarif-file-output=snyk.sarif --all-projects
# with: - name: Upload result to GitHub Code Scanning
# args: --sarif-file-output=snyk.sarif --all-projects uses: github/codeql-action/upload-sarif@v3
with:
# - name: Upload result to GitHub Code Scanning sarif_file: snyk.sarif
# uses: github/codeql-action/upload-sarif@v4
# with:
# sarif_file: snyk.sarif

56
.github/workflows/ci-python-with-docker.yml vendored
View File

@@ -6,11 +6,11 @@ on:
type: string type: string
default: "3.11" default: "3.11"
description: "Version of Python to use for testing environment" description: "Version of Python to use for testing environment"
# secrets: secrets:
# SONAR_TOKEN: SONAR_TOKEN:
# required: true required: true
# SNYK_TOKEN: SNYK_TOKEN:
# required: true required: true
jobs: jobs:
ci: ci:
@@ -21,57 +21,47 @@ jobs:
run: | run: |
PYTHON_VERSION=${{ inputs.python-version }} PYTHON_VERSION=${{ inputs.python-version }}
echo "value=${PYTHON_VERSION:-"3.11"}" >> $GITHUB_OUTPUT echo "value=${PYTHON_VERSION:-"3.11"}" >> $GITHUB_OUTPUT
- name: Check out repository code - name: Check out repository code
uses: actions/checkout@v6.0.2 uses: actions/checkout@v4.3.0
with: with:
fetch-depth: 0 fetch-depth: 0
- uses: hadolint/hadolint-action@v3.2.0
- uses: hadolint/hadolint-action@v3.3.0
with: with:
dockerfile: Dockerfile dockerfile: Dockerfile
output-file: hadolint.out output-file: hadolint.out
format: sonarqube format: sonarqube
no-fail: true no-fail: true
- name: Setup Python - name: Setup Python
uses: actions/setup-python@v6 uses: actions/setup-python@v6
with: with:
python-version: "${{ steps.python-version.outputs.value }}" python-version: "${{ steps.python-version.outputs.value }}"
- name: Update Pip - name: Update Pip
run: | run: |
pip install -U pip pip install -U pip
- name: Install dependencies - name: Install dependencies
run: | run: |
pip install -r requirements.txt pip install -r requirements.txt
pip install -r requirements-dev.txt pip install -r requirements-dev.txt
- name: Lint - name: Lint
run: pylint --fail-under=8 --recursive=yes --output-format=parseable --output=lintreport.txt . run: pylint --fail-under=8 --recursive=yes --output-format=parseable --output=lintreport.txt .
- name: Unit Test - name: Unit Test
run: | run: |
coverage run -m pytest -v --junitxml=testresults.xml coverage run -m pytest -v --junitxml=testresults.xml
coverage xml coverage xml
sed -i 's@${{ github.workspace }}@/github/workspace@g' coverage.xml sed -i 's@${{ github.workspace }}@/github/workspace@g' coverage.xml
- name: SonarQube Cloud Scan
# - name: SonarQube Cloud Scan uses: SonarSource/sonarqube-scan-action@v5.3.1
# uses: SonarSource/sonarqube-scan-action@v7.0.0 env:
# env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
# SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} - name: Snyk Vulnerability Scan
uses: snyk/actions/python-3.10@master
# - name: Snyk Vulnerability Scan continue-on-error: true # To make sure that SARIF upload gets called
# uses: snyk/actions/python-3.10@master env:
# continue-on-error: true # To make sure that SARIF upload gets called SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
# env: with:
# SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} args: --sarif-file-output=snyk.sarif --all-projects
# with: - name: Upload result to GitHub Code Scanning
# args: --sarif-file-output=snyk.sarif --all-projects uses: github/codeql-action/upload-sarif@v3
with:
# - name: Upload result to GitHub Code Scanning sarif_file: snyk.sarif
# uses: github/codeql-action/upload-sarif@v4
# with:
# sarif_file: snyk.sarif

53
.github/workflows/ci-python.yml vendored
View File

@@ -6,11 +6,11 @@ on:
type: string type: string
default: "3.11" default: "3.11"
description: "Version of Python to use for testing environment" description: "Version of Python to use for testing environment"
# secrets: secrets:
# SONAR_TOKEN: SONAR_TOKEN:
# required: true required: true
# SNYK_TOKEN: SNYK_TOKEN:
# required: true required: true
jobs: jobs:
ci: ci:
@@ -21,50 +21,41 @@ jobs:
run: | run: |
PYTHON_VERSION=${{ inputs.python-version }} PYTHON_VERSION=${{ inputs.python-version }}
echo "value=${PYTHON_VERSION:-"3.11"}" >> $GITHUB_OUTPUT echo "value=${PYTHON_VERSION:-"3.11"}" >> $GITHUB_OUTPUT
- name: Check out repository code - name: Check out repository code
uses: actions/checkout@v6.0.2 uses: actions/checkout@v4.3.0
with: with:
fetch-depth: 0 fetch-depth: 0
- name: Setup Python - name: Setup Python
uses: actions/setup-python@v6 uses: actions/setup-python@v6
with: with:
python-version: "${{ steps.python-version.outputs.value }}" python-version: "${{ steps.python-version.outputs.value }}"
- name: Update Pip - name: Update Pip
run: | run: |
pip install -U pip pip install -U pip
- name: Install dependencies - name: Install dependencies
run: | run: |
pip install -r requirements.txt pip install -r requirements.txt
pip install -r requirements-dev.txt pip install -r requirements-dev.txt
- name: Lint - name: Lint
run: pylint --fail-under=8 --recursive=yes --output-format=parseable --output=lintreport.txt . run: pylint --fail-under=8 --recursive=yes --output-format=parseable --output=lintreport.txt .
- name: Unit Test - name: Unit Test
run: | run: |
coverage run -m pytest -v --junitxml=testresults.xml coverage run -m pytest -v --junitxml=testresults.xml
coverage xml coverage xml
sed -i 's@${{ github.workspace }}@/github/workspace@g' coverage.xml sed -i 's@${{ github.workspace }}@/github/workspace@g' coverage.xml
- name: SonarQube Cloud Scan
# - name: SonarQube Cloud Scan uses: SonarSource/sonarqube-scan-action@v5.3.1
# uses: SonarSource/sonarqube-scan-action@v7.0.0 env:
# env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
# SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} - name: Snyk Vulnerability Scan
uses: snyk/actions/python-3.10@master
# - name: Snyk Vulnerability Scan continue-on-error: true # To make sure that SARIF upload gets called
# uses: snyk/actions/python-3.10@master env:
# continue-on-error: true # To make sure that SARIF upload gets called SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
# env: with:
# SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} args: --sarif-file-output=snyk.sarif --all-projects
# with: - name: Upload result to GitHub Code Scanning
# args: --sarif-file-output=snyk.sarif --all-projects uses: github/codeql-action/upload-sarif@v3
with:
# - name: Upload result to GitHub Code Scanning sarif_file: snyk.sarif
# uses: github/codeql-action/upload-sarif@v4
# with:
# sarif_file: snyk.sarif

2
.github/workflows/create-release.yml vendored
View File

@@ -17,7 +17,7 @@ jobs:
release_name: ${{ steps.tag_version.outputs.new_tag }} release_name: ${{ steps.tag_version.outputs.new_tag }}
success: ${{ steps.set_flag.outputs.success }} success: ${{ steps.set_flag.outputs.success }}
steps: steps:
- uses: actions/checkout@v6 - uses: actions/checkout@v4
with: with:
fetch-depth: 0 fetch-depth: 0

43
renovate.json
View File

@@ -1,35 +1,26 @@
{ {
"extends": [
"config:recommended"
],
"ignorePaths": [
"**/.archive/**"
],
"platformCommit": "enabled",
"dependencyDashboardAutoclose": true,
"assignAutomerge": false, "assignAutomerge": false,
"assigneesFromCodeOwners": false, "assigneesFromCodeOwners": false,
"dependencyDashboardAutoclose": true,
"extends": ["config:recommended"],
"ignorePaths": ["**/.archive/**"],
"labels": ["type/dependencies"],
"platformCommit": "enabled",
"rebaseWhen": "behind-base-branch", "rebaseWhen": "behind-base-branch",
"rollbackPrs": true, "rollbackPrs": true,
"semanticCommits": "enabled", "labels": [
"semanticCommitScope": "deps", "type/dependencies"
"semanticCommitType": "feat", ],
"osvVulnerabilityAlerts": true,
"dependencyDashboardOSVVulnerabilitySummary": "all",
"vulnerabilityAlerts": { "vulnerabilityAlerts": {
"commitMessagePrefix": "[SECURITY] ",
"enabled": true, "enabled": true,
"labels": ["security", "type/dependencies"], "labels": [
"security",
"type/dependencies"
],
"commitMessagePrefix": "[SECURITY] ",
"prCreation": "immediate" "prCreation": "immediate"
}, }
"lockFileMaintenance": {
"enabled": true
},
"packageRules": [
{
"matchDepTypes": ["devDependencies"],
"automerge": true
},
{
"matchUpdateTypes": ["patch"],
"automerge": true
}
]
} }