Merge pull request #2 from eccenca/feature/updateTemplate #11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: check | |
| # Controls when the workflow will run | |
| on: | |
| # Triggers the workflow on push or pull request events but only for the "main" and "develop" branch | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main, develop] | |
| # Allows you to run this workflow manually from the Actions tab | |
| workflow_dispatch: | |
| # Least privilege, and enough for the two reporting steps at the end of the job: | |
| # the junit report creates check runs, the coverage report writes a pull request | |
| # comment. A pull request from a fork gets a read-only token whatever is written | |
| # here, which is why both of those steps are allowed to fail. | |
| permissions: | |
| contents: read | |
| checks: write | |
| pull-requests: write | |
| jobs: | |
| check: | |
| runs-on: ubuntu-latest | |
| concurrency: testing_environment | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@v7 | |
| - name: Cache Trivy DB | |
| id: cache-trivydb | |
| uses: actions/cache@v6 | |
| with: | |
| path: .trivycache | |
| key: ${{ runner.os }}-trivydb-${{ github.run_id }} | |
| restore-keys: ${{ runner.os }}-trivydb- | |
| - name: Install Task | |
| uses: arduino/setup-task@v3 | |
| - name: Set up python | |
| id: setup-python | |
| uses: actions/setup-python@v7 | |
| with: | |
| python-version: '3.13' | |
| - name: Install and configure poetry | |
| uses: snok/install-poetry@v1 | |
| with: | |
| virtualenvs-create: true | |
| virtualenvs-in-project: true | |
| installer-parallel: true | |
| - name: mypy | |
| run: | | |
| task check:mypy | |
| - name: ruff | |
| run: | | |
| task check:ruff | |
| - name: pytest | |
| env: | |
| CMEM_BASE_URI: ${{ secrets.CMEM_BASE_URI }} | |
| OAUTH_CLIENT_SECRET: ${{ secrets.OAUTH_CLIENT_SECRET }} | |
| run: | | |
| task check:pytest | |
| - name: deptry | |
| run: | | |
| task check:deptry | |
| - name: trivy | |
| env: | |
| TRIVY_NO_PROGRESS: "true" | |
| TRIVY_CACHE_DIR: ".trivycache/" | |
| TRIVY_DISABLE_VEX_NOTICE: "true" | |
| run: | | |
| task check:trivy | |
| - name: Publish Test Report in Action | |
| uses: mikepenz/action-junit-report@v6 | |
| if: always() # always run even if the previous step fails | |
| continue-on-error: true # a fork pull request cannot be given `checks: write` | |
| with: | |
| report_paths: dist/junit-*.xml | |
| - name: Publish Test and Coverage Report as PR comment | |
| uses: xportation/junit-coverage-report@v1.0.3 | |
| if: github.event_name == 'pull_request' | |
| continue-on-error: true # a fork pull request cannot comment on itself | |
| with: | |
| junit-path: dist/junit-pytest.xml | |
| coverage-path: dist/coverage.xml | |