feat(ci): Add CI
All checks were successful
Build Docker / Create Docker Image (release) Successful in 1m34s
All checks were successful
Build Docker / Create Docker Image (release) Successful in 1m34s
This commit is contained in:
95
.gitea/workflows-disabled/ci.yml
Normal file
95
.gitea/workflows-disabled/ci.yml
Normal file
@@ -0,0 +1,95 @@
|
|||||||
|
name: CI
|
||||||
|
on:
|
||||||
|
pull_request:
|
||||||
|
types:
|
||||||
|
- opened
|
||||||
|
- edited
|
||||||
|
- synchronize
|
||||||
|
- reopened
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
ci:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- name: Check out repository code
|
||||||
|
uses: actions/checkout@v5.0.0
|
||||||
|
with:
|
||||||
|
fetch-depth: 0
|
||||||
|
|
||||||
|
- name: Run Hadolint
|
||||||
|
uses: hadolint/hadolint-action@v3.3.0
|
||||||
|
with:
|
||||||
|
dockerfile: Dockerfile
|
||||||
|
output-file: hadolint.out
|
||||||
|
format: sonarqube
|
||||||
|
no-fail: true
|
||||||
|
|
||||||
|
- name: Setup Python
|
||||||
|
uses: actions/setup-python@v6
|
||||||
|
with:
|
||||||
|
python-version: "3.14"
|
||||||
|
|
||||||
|
- name: uv cache
|
||||||
|
uses: actions/cache@v4
|
||||||
|
with:
|
||||||
|
path: /tmp/.uv-cache
|
||||||
|
key: uv-${{ runner.os }}-${{ hashFiles('uv.lock') }}
|
||||||
|
restore-keys: |
|
||||||
|
uv-${{ runner.os }}-${{ hashFiles('uv.lock') }}
|
||||||
|
uv-${{ runner.os }}
|
||||||
|
|
||||||
|
- name: Install dependencies
|
||||||
|
run: uv sync
|
||||||
|
|
||||||
|
- name: Check Import Sorting
|
||||||
|
run: uv run isort --check app/ tests/
|
||||||
|
|
||||||
|
- name: Lint
|
||||||
|
run: |
|
||||||
|
uv run pylint --fail-under=8 --recursive=yes --output-format=parseable --output=lintreport.txt app/ tests/
|
||||||
|
cat lintreport.txt
|
||||||
|
|
||||||
|
- name: Unit Test
|
||||||
|
run: |
|
||||||
|
uv run coverage run -m pytest -v --junitxml=testresults.xml
|
||||||
|
uv run coverage report
|
||||||
|
# sed -i 's@${{ gitea.workspace }}@/github/workspace@g' coverage.xml
|
||||||
|
|
||||||
|
- name: Minimize uv cache
|
||||||
|
run: uv cache prune --ci
|
||||||
|
|
||||||
|
# - name: SonarQube Scan
|
||||||
|
# uses: SonarSource/sonarqube-scan-action@v5.2.0
|
||||||
|
# env:
|
||||||
|
# SONAR_HOST_URL: ${{ secrets.SONARQUBE_HOST_URL }}
|
||||||
|
# SONAR_TOKEN: ${{ secrets.SONARQUBE_TOKEN }}
|
||||||
|
|
||||||
|
- name: Set up environment for Snyk
|
||||||
|
run: |
|
||||||
|
uv pip freeze > requirements.txt
|
||||||
|
mv pyproject.toml pyproject.toml.bak
|
||||||
|
mv uv.lock uv.lock.bak
|
||||||
|
|
||||||
|
- name: Snyk SAST Scan
|
||||||
|
uses: snyk/actions/python@master
|
||||||
|
env:
|
||||||
|
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
|
||||||
|
with:
|
||||||
|
# command: snyk
|
||||||
|
args: snyk code test #--all-projects --exclude=.archive
|
||||||
|
|
||||||
|
# - name: Snyk Vulnerability Scan
|
||||||
|
# uses: snyk/actions/python@master
|
||||||
|
# continue-on-error: true # Sometimes vulns aren't immediately fixable
|
||||||
|
# env:
|
||||||
|
# SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
|
||||||
|
# DEBUG: "*snyk*"
|
||||||
|
# with:
|
||||||
|
# # command: snyk
|
||||||
|
# args: snyk test #--all-projects --exclude=.archive
|
||||||
|
|
||||||
|
- name: Reverse set up environment for Snyk
|
||||||
|
run: |
|
||||||
|
rm -f requirements.txt
|
||||||
|
mv pyproject.toml.bak pyproject.toml
|
||||||
|
mv uv.lock.bak uv.lock
|
||||||
24
.gitea/workflows-disabled/snyk.yml
Normal file
24
.gitea/workflows-disabled/snyk.yml
Normal file
@@ -0,0 +1,24 @@
|
|||||||
|
name: Snyk
|
||||||
|
|
||||||
|
on:
|
||||||
|
workflow_dispatch:
|
||||||
|
push:
|
||||||
|
branches:
|
||||||
|
- main
|
||||||
|
schedule:
|
||||||
|
- cron: "@daily"
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
security:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- name: Checkout repo
|
||||||
|
uses: actions/checkout@v5.0.0
|
||||||
|
|
||||||
|
- name: Snyk
|
||||||
|
uses: snyk/actions/python@master
|
||||||
|
continue-on-error: true
|
||||||
|
env:
|
||||||
|
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
|
||||||
|
with:
|
||||||
|
command: monitor
|
||||||
18
.gitea/workflows/build_docker.yml
Normal file
18
.gitea/workflows/build_docker.yml
Normal file
@@ -0,0 +1,18 @@
|
|||||||
|
name: Build Docker
|
||||||
|
on:
|
||||||
|
release:
|
||||||
|
types:
|
||||||
|
- published
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
create_docker:
|
||||||
|
name: Create Docker Image
|
||||||
|
uses: https://git.tainton.uk/actions/gha-workflows/.gitea/workflows/build-push-docker.yml@main
|
||||||
|
with:
|
||||||
|
release: ${{ gitea.event.release.name }}
|
||||||
|
registry: ${{ vars.PACKAGES_REGISTRY_URL }}
|
||||||
|
actions_username: ${{ vars.ACTIONS_USERNAME }}
|
||||||
|
ghcr_username: ${{ vars.GHCR_USERNAME }}
|
||||||
|
secrets:
|
||||||
|
ACTIONS_TOKEN: ${{ secrets.ACTIONS_TOKEN }}
|
||||||
|
GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }}
|
||||||
16
.gitea/workflows/conventional_commit.yml
Normal file
16
.gitea/workflows/conventional_commit.yml
Normal file
@@ -0,0 +1,16 @@
|
|||||||
|
name: Validate PR Title
|
||||||
|
on:
|
||||||
|
pull_request:
|
||||||
|
types:
|
||||||
|
- opened
|
||||||
|
- edited
|
||||||
|
- synchronize
|
||||||
|
- reopened
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
validate:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- uses: https://git.tainton.uk/actions/conventional-commits-check-action@v1.3.0
|
||||||
|
with:
|
||||||
|
commit-message: ${{ gitea.event.pull_request.title }}
|
||||||
118
.gitea/workflows/release.yml
Normal file
118
.gitea/workflows/release.yml
Normal file
@@ -0,0 +1,118 @@
|
|||||||
|
name: Release
|
||||||
|
on:
|
||||||
|
workflow_dispatch:
|
||||||
|
schedule:
|
||||||
|
- cron: '0 9 * * 0'
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
# test:
|
||||||
|
# name: Test
|
||||||
|
# uses: https://git.tainton.uk/${{ gitea.repository }}/.gitea/workflows/ci.yml@main
|
||||||
|
|
||||||
|
tag:
|
||||||
|
name: Tag release
|
||||||
|
uses: https://git.tainton.uk/actions/gha-workflows/.gitea/workflows/release-with-tag.yaml@main
|
||||||
|
|
||||||
|
create_release:
|
||||||
|
name: Create Release
|
||||||
|
needs: tag
|
||||||
|
uses: https://git.tainton.uk/actions/gha-workflows/.gitea/workflows/create-release-preexisting-tag.yaml@main
|
||||||
|
with:
|
||||||
|
tag: ${{ needs.tag.outputs.tag_name }}
|
||||||
|
body: ${{ needs.tag.outputs.changelog }}
|
||||||
|
secrets:
|
||||||
|
ACTIONS_TOKEN: ${{ secrets.ACTIONS_TOKEN }}
|
||||||
|
|
||||||
|
# get_release_id:
|
||||||
|
# name: Get Release ID
|
||||||
|
# runs-on: ubuntu-latest
|
||||||
|
# needs: create_release
|
||||||
|
# outputs:
|
||||||
|
# releaseid: ${{ steps.getid.outputs.releaseid }}
|
||||||
|
# steps:
|
||||||
|
# - name: Get Release ID
|
||||||
|
# id: getid
|
||||||
|
# run: |
|
||||||
|
# rid=$(curl -s -X 'GET' \
|
||||||
|
# -H 'accept: application/json' \
|
||||||
|
# '${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/releases/latest' | jq -r '.id')
|
||||||
|
# echo "releaseid=$rid" >> "$GITEA_OUTPUT"
|
||||||
|
# echo "$rid"
|
||||||
|
|
||||||
|
create_docker:
|
||||||
|
name: Publish Docker Images
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
needs: [tag, create_release]
|
||||||
|
steps:
|
||||||
|
- name: Update Docker configuration
|
||||||
|
continue-on-error: true
|
||||||
|
run: |
|
||||||
|
mkdir -p /etc/default
|
||||||
|
mkdir -p /etc/docker
|
||||||
|
touch -a /etc/default/docker
|
||||||
|
touch -a /etc/docker/daemon.json
|
||||||
|
echo "DOCKER_OPTS=\"--insecure-registry ${{ vars.PACKAGES_REGISTRY_URL }}\"" >> /etc/default/docker
|
||||||
|
echo "{\"insecure-registries\": [\"${{ vars.PACKAGES_REGISTRY_URL }}\"]}" > /etc/docker/daemon.json
|
||||||
|
|
||||||
|
- name: Get repo name
|
||||||
|
id: split
|
||||||
|
run: echo "repo=${REPO##*/}" >> "$GITEA_OUTPUT"
|
||||||
|
env:
|
||||||
|
REPO: ${{ gitea.repository }}
|
||||||
|
|
||||||
|
- name: Check out repository
|
||||||
|
uses: actions/checkout@v5.0.0
|
||||||
|
with:
|
||||||
|
fetch-depth: 0
|
||||||
|
ref: ${{ needs.tag.outputs.tag_name }}
|
||||||
|
|
||||||
|
- name: Set up Docker Buildx
|
||||||
|
uses: docker/setup-buildx-action@v3
|
||||||
|
|
||||||
|
- name: Log in to Gitea Container Registry
|
||||||
|
uses: docker/login-action@v3
|
||||||
|
with:
|
||||||
|
registry: ${{ vars.PACKAGES_REGISTRY_URL }}
|
||||||
|
username: ${{ vars.ACTIONS_USERNAME }}
|
||||||
|
password: ${{ secrets.ACTIONS_TOKEN }}
|
||||||
|
|
||||||
|
- name: Log in to GitHub Container Registry
|
||||||
|
uses: docker/login-action@v3
|
||||||
|
with:
|
||||||
|
registry: ghcr.io
|
||||||
|
username: ${{ vars.GHCR_USERNAME }}
|
||||||
|
password: ${{ secrets.GHCR_TOKEN }}
|
||||||
|
|
||||||
|
- name: Extract metadata (tags, labels) for Docker
|
||||||
|
id: meta
|
||||||
|
uses: docker/metadata-action@v5
|
||||||
|
with:
|
||||||
|
tags: type=semver,pattern=v{{version}},value=${{ needs.tag.outputs.tag_name }}
|
||||||
|
images: |
|
||||||
|
ghcr.io/${{ vars.GHCR_USERNAME }}/${{ steps.split.outputs.repo }}
|
||||||
|
${{ vars.PACKAGES_REGISTRY_URL }}/${{ gitea.repository }}
|
||||||
|
|
||||||
|
- name: Print metadata
|
||||||
|
run: |
|
||||||
|
printf "Annotations:\n${{ steps.meta.outputs.annotations }}"
|
||||||
|
echo ""
|
||||||
|
printf "Labels:\n${{ steps.meta.outputs.labels }}"
|
||||||
|
echo ""
|
||||||
|
printf "Tags:\n${{ steps.meta.outputs.tags }}"
|
||||||
|
|
||||||
|
- name: Build images
|
||||||
|
uses: docker/build-push-action@v6
|
||||||
|
with:
|
||||||
|
context: .
|
||||||
|
push: false
|
||||||
|
load: true
|
||||||
|
annotations: ${{ steps.meta.outputs.annotations }}
|
||||||
|
labels: ${{ steps.meta.outputs.labels }}
|
||||||
|
tags: ${{ steps.meta.outputs.tags }}
|
||||||
|
|
||||||
|
- name: Push images
|
||||||
|
run: |
|
||||||
|
strtags="${{ steps.meta.outputs.tags }}"
|
||||||
|
readarray -t lines <<<"$strtags"
|
||||||
|
for element in "${lines[@]}"; do docker push "$element"; done
|
||||||
|
unset strtags lines
|
||||||
23
renovate.json
Normal file
23
renovate.json
Normal file
@@ -0,0 +1,23 @@
|
|||||||
|
{
|
||||||
|
"assignAutomerge": false,
|
||||||
|
"assigneesFromCodeOwners": false,
|
||||||
|
"dependencyDashboardAutoclose": true,
|
||||||
|
"extends": ["config:recommended"],
|
||||||
|
"ignorePaths": ["**/.archive/**"],
|
||||||
|
"labels": ["type/dependencies"],
|
||||||
|
"platformCommit": "enabled",
|
||||||
|
"rebaseWhen": "behind-base-branch",
|
||||||
|
"rollbackPrs": true,
|
||||||
|
"semanticCommits": "enabled",
|
||||||
|
"semanticCommitScope": "deps",
|
||||||
|
"semanticCommitType": "feat",
|
||||||
|
"vulnerabilityAlerts": {
|
||||||
|
"commitMessagePrefix": "[SECURITY] ",
|
||||||
|
"enabled": true,
|
||||||
|
"labels": ["security"],
|
||||||
|
"prCreation": "immediate"
|
||||||
|
},
|
||||||
|
"lockFileMaintenance": {
|
||||||
|
"enabled": true
|
||||||
|
}
|
||||||
|
}
|
||||||
Reference in New Issue
Block a user