feat(ci): Add CI
All checks were successful
Build Docker / Create Docker Image (release) Successful in 1m34s
All checks were successful
Build Docker / Create Docker Image (release) Successful in 1m34s
This commit is contained in:
95
.gitea/workflows-disabled/ci.yml
Normal file
95
.gitea/workflows-disabled/ci.yml
Normal file
@@ -0,0 +1,95 @@
|
||||
name: CI
|
||||
on:
|
||||
pull_request:
|
||||
types:
|
||||
- opened
|
||||
- edited
|
||||
- synchronize
|
||||
- reopened
|
||||
|
||||
jobs:
|
||||
ci:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Check out repository code
|
||||
uses: actions/checkout@v5.0.0
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Run Hadolint
|
||||
uses: hadolint/hadolint-action@v3.3.0
|
||||
with:
|
||||
dockerfile: Dockerfile
|
||||
output-file: hadolint.out
|
||||
format: sonarqube
|
||||
no-fail: true
|
||||
|
||||
- name: Setup Python
|
||||
uses: actions/setup-python@v6
|
||||
with:
|
||||
python-version: "3.14"
|
||||
|
||||
- name: uv cache
|
||||
uses: actions/cache@v4
|
||||
with:
|
||||
path: /tmp/.uv-cache
|
||||
key: uv-${{ runner.os }}-${{ hashFiles('uv.lock') }}
|
||||
restore-keys: |
|
||||
uv-${{ runner.os }}-${{ hashFiles('uv.lock') }}
|
||||
uv-${{ runner.os }}
|
||||
|
||||
- name: Install dependencies
|
||||
run: uv sync
|
||||
|
||||
- name: Check Import Sorting
|
||||
run: uv run isort --check app/ tests/
|
||||
|
||||
- name: Lint
|
||||
run: |
|
||||
uv run pylint --fail-under=8 --recursive=yes --output-format=parseable --output=lintreport.txt app/ tests/
|
||||
cat lintreport.txt
|
||||
|
||||
- name: Unit Test
|
||||
run: |
|
||||
uv run coverage run -m pytest -v --junitxml=testresults.xml
|
||||
uv run coverage report
|
||||
# sed -i 's@${{ gitea.workspace }}@/github/workspace@g' coverage.xml
|
||||
|
||||
- name: Minimize uv cache
|
||||
run: uv cache prune --ci
|
||||
|
||||
# - name: SonarQube Scan
|
||||
# uses: SonarSource/sonarqube-scan-action@v5.2.0
|
||||
# env:
|
||||
# SONAR_HOST_URL: ${{ secrets.SONARQUBE_HOST_URL }}
|
||||
# SONAR_TOKEN: ${{ secrets.SONARQUBE_TOKEN }}
|
||||
|
||||
- name: Set up environment for Snyk
|
||||
run: |
|
||||
uv pip freeze > requirements.txt
|
||||
mv pyproject.toml pyproject.toml.bak
|
||||
mv uv.lock uv.lock.bak
|
||||
|
||||
- name: Snyk SAST Scan
|
||||
uses: snyk/actions/python@master
|
||||
env:
|
||||
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
|
||||
with:
|
||||
# command: snyk
|
||||
args: snyk code test #--all-projects --exclude=.archive
|
||||
|
||||
# - name: Snyk Vulnerability Scan
|
||||
# uses: snyk/actions/python@master
|
||||
# continue-on-error: true # Sometimes vulns aren't immediately fixable
|
||||
# env:
|
||||
# SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
|
||||
# DEBUG: "*snyk*"
|
||||
# with:
|
||||
# # command: snyk
|
||||
# args: snyk test #--all-projects --exclude=.archive
|
||||
|
||||
- name: Reverse set up environment for Snyk
|
||||
run: |
|
||||
rm -f requirements.txt
|
||||
mv pyproject.toml.bak pyproject.toml
|
||||
mv uv.lock.bak uv.lock
|
||||
24
.gitea/workflows-disabled/snyk.yml
Normal file
24
.gitea/workflows-disabled/snyk.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
name: Snyk
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
schedule:
|
||||
- cron: "@daily"
|
||||
|
||||
jobs:
|
||||
security:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout repo
|
||||
uses: actions/checkout@v5.0.0
|
||||
|
||||
- name: Snyk
|
||||
uses: snyk/actions/python@master
|
||||
continue-on-error: true
|
||||
env:
|
||||
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
|
||||
with:
|
||||
command: monitor
|
||||
18
.gitea/workflows/build_docker.yml
Normal file
18
.gitea/workflows/build_docker.yml
Normal file
@@ -0,0 +1,18 @@
|
||||
name: Build Docker
|
||||
on:
|
||||
release:
|
||||
types:
|
||||
- published
|
||||
|
||||
jobs:
|
||||
create_docker:
|
||||
name: Create Docker Image
|
||||
uses: https://git.tainton.uk/actions/gha-workflows/.gitea/workflows/build-push-docker.yml@main
|
||||
with:
|
||||
release: ${{ gitea.event.release.name }}
|
||||
registry: ${{ vars.PACKAGES_REGISTRY_URL }}
|
||||
actions_username: ${{ vars.ACTIONS_USERNAME }}
|
||||
ghcr_username: ${{ vars.GHCR_USERNAME }}
|
||||
secrets:
|
||||
ACTIONS_TOKEN: ${{ secrets.ACTIONS_TOKEN }}
|
||||
GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }}
|
||||
16
.gitea/workflows/conventional_commit.yml
Normal file
16
.gitea/workflows/conventional_commit.yml
Normal file
@@ -0,0 +1,16 @@
|
||||
name: Validate PR Title
|
||||
on:
|
||||
pull_request:
|
||||
types:
|
||||
- opened
|
||||
- edited
|
||||
- synchronize
|
||||
- reopened
|
||||
|
||||
jobs:
|
||||
validate:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: https://git.tainton.uk/actions/conventional-commits-check-action@v1.3.0
|
||||
with:
|
||||
commit-message: ${{ gitea.event.pull_request.title }}
|
||||
118
.gitea/workflows/release.yml
Normal file
118
.gitea/workflows/release.yml
Normal file
@@ -0,0 +1,118 @@
|
||||
name: Release
|
||||
on:
|
||||
workflow_dispatch:
|
||||
schedule:
|
||||
- cron: '0 9 * * 0'
|
||||
|
||||
jobs:
|
||||
# test:
|
||||
# name: Test
|
||||
# uses: https://git.tainton.uk/${{ gitea.repository }}/.gitea/workflows/ci.yml@main
|
||||
|
||||
tag:
|
||||
name: Tag release
|
||||
uses: https://git.tainton.uk/actions/gha-workflows/.gitea/workflows/release-with-tag.yaml@main
|
||||
|
||||
create_release:
|
||||
name: Create Release
|
||||
needs: tag
|
||||
uses: https://git.tainton.uk/actions/gha-workflows/.gitea/workflows/create-release-preexisting-tag.yaml@main
|
||||
with:
|
||||
tag: ${{ needs.tag.outputs.tag_name }}
|
||||
body: ${{ needs.tag.outputs.changelog }}
|
||||
secrets:
|
||||
ACTIONS_TOKEN: ${{ secrets.ACTIONS_TOKEN }}
|
||||
|
||||
# get_release_id:
|
||||
# name: Get Release ID
|
||||
# runs-on: ubuntu-latest
|
||||
# needs: create_release
|
||||
# outputs:
|
||||
# releaseid: ${{ steps.getid.outputs.releaseid }}
|
||||
# steps:
|
||||
# - name: Get Release ID
|
||||
# id: getid
|
||||
# run: |
|
||||
# rid=$(curl -s -X 'GET' \
|
||||
# -H 'accept: application/json' \
|
||||
# '${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/releases/latest' | jq -r '.id')
|
||||
# echo "releaseid=$rid" >> "$GITEA_OUTPUT"
|
||||
# echo "$rid"
|
||||
|
||||
create_docker:
|
||||
name: Publish Docker Images
|
||||
runs-on: ubuntu-latest
|
||||
needs: [tag, create_release]
|
||||
steps:
|
||||
- name: Update Docker configuration
|
||||
continue-on-error: true
|
||||
run: |
|
||||
mkdir -p /etc/default
|
||||
mkdir -p /etc/docker
|
||||
touch -a /etc/default/docker
|
||||
touch -a /etc/docker/daemon.json
|
||||
echo "DOCKER_OPTS=\"--insecure-registry ${{ vars.PACKAGES_REGISTRY_URL }}\"" >> /etc/default/docker
|
||||
echo "{\"insecure-registries\": [\"${{ vars.PACKAGES_REGISTRY_URL }}\"]}" > /etc/docker/daemon.json
|
||||
|
||||
- name: Get repo name
|
||||
id: split
|
||||
run: echo "repo=${REPO##*/}" >> "$GITEA_OUTPUT"
|
||||
env:
|
||||
REPO: ${{ gitea.repository }}
|
||||
|
||||
- name: Check out repository
|
||||
uses: actions/checkout@v5.0.0
|
||||
with:
|
||||
fetch-depth: 0
|
||||
ref: ${{ needs.tag.outputs.tag_name }}
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
|
||||
- name: Log in to Gitea Container Registry
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ${{ vars.PACKAGES_REGISTRY_URL }}
|
||||
username: ${{ vars.ACTIONS_USERNAME }}
|
||||
password: ${{ secrets.ACTIONS_TOKEN }}
|
||||
|
||||
- name: Log in to GitHub Container Registry
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ vars.GHCR_USERNAME }}
|
||||
password: ${{ secrets.GHCR_TOKEN }}
|
||||
|
||||
- name: Extract metadata (tags, labels) for Docker
|
||||
id: meta
|
||||
uses: docker/metadata-action@v5
|
||||
with:
|
||||
tags: type=semver,pattern=v{{version}},value=${{ needs.tag.outputs.tag_name }}
|
||||
images: |
|
||||
ghcr.io/${{ vars.GHCR_USERNAME }}/${{ steps.split.outputs.repo }}
|
||||
${{ vars.PACKAGES_REGISTRY_URL }}/${{ gitea.repository }}
|
||||
|
||||
- name: Print metadata
|
||||
run: |
|
||||
printf "Annotations:\n${{ steps.meta.outputs.annotations }}"
|
||||
echo ""
|
||||
printf "Labels:\n${{ steps.meta.outputs.labels }}"
|
||||
echo ""
|
||||
printf "Tags:\n${{ steps.meta.outputs.tags }}"
|
||||
|
||||
- name: Build images
|
||||
uses: docker/build-push-action@v6
|
||||
with:
|
||||
context: .
|
||||
push: false
|
||||
load: true
|
||||
annotations: ${{ steps.meta.outputs.annotations }}
|
||||
labels: ${{ steps.meta.outputs.labels }}
|
||||
tags: ${{ steps.meta.outputs.tags }}
|
||||
|
||||
- name: Push images
|
||||
run: |
|
||||
strtags="${{ steps.meta.outputs.tags }}"
|
||||
readarray -t lines <<<"$strtags"
|
||||
for element in "${lines[@]}"; do docker push "$element"; done
|
||||
unset strtags lines
|
||||
Reference in New Issue
Block a user