Merge branch 'develop' into notification #32
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: webuddhist-worker | |
| on: [ push, pull_request, workflow_dispatch ] | |
| jobs: | |
| gitleaks: | |
| name: Gitleaks Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Run Gitleaks | |
| uses: dhsathiya/gitleaks-action@main | |
| with: | |
| config: .gitleaks.toml | |
| fail: true | |
| verbose: true | |
| - name: Upload Gitleaks Report (Optional) | |
| if: failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: gitleaks-report | |
| path: gitleaks-report.json | |
| buildDockerImage: | |
| name: Build and Dockerize | |
| runs-on: ubuntu-latest | |
| needs: [ gitleaks ] | |
| if: success() | |
| outputs: | |
| image_name: ${{ steps.set-tag.outputs.image_name }} | |
| image_tag: ${{ steps.set-tag.outputs.image_tag }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.repository_owner }} | |
| password: ${{ secrets.PECHA_REPO }} | |
| - name: Set image name and tag | |
| id: set-tag | |
| run: | | |
| echo "IMAGE_NAME=webuddhist-worker" >> $GITHUB_ENV | |
| echo "image_name=webuddhist-worker" >> $GITHUB_OUTPUT | |
| if [[ -n "${{ github.ref }}" && "${{ github.ref }}" =~ ^refs/tags/ ]]; then | |
| tagNumber=$(echo "${{ github.ref }}" | sed 's#refs/tags/##') | |
| echo "IMAGE_TAG=$tagNumber" >> $GITHUB_ENV | |
| echo "image_tag=$tagNumber" >> $GITHUB_OUTPUT | |
| else | |
| calculatedSha=$(git rev-parse --short ${{ github.sha }}) | |
| tagNumber=${{ github.run_id }}-$calculatedSha | |
| echo "IMAGE_TAG=$tagNumber" >> $GITHUB_ENV | |
| echo "image_tag=$tagNumber" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Confirm image name and tag | |
| run: | | |
| echo "Image Name: ${{ env.IMAGE_NAME }}" | |
| echo "Image Tag: ${{ env.IMAGE_TAG }}" | |
| - name: Build Docker image in Github container registry | |
| run: | | |
| lower_owner=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]') | |
| docker build -t ghcr.io/$lower_owner/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} . | |
| - name: Push Docker image to GHCR | |
| run: | | |
| lower_owner=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]') | |
| docker push ghcr.io/$lower_owner/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} | |
| test: | |
| name: Run Tests | |
| runs-on: ubuntu-latest | |
| needs: [ buildDockerImage ] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.12' | |
| - name: Install Poetry | |
| uses: snok/install-poetry@v1 | |
| with: | |
| version: 1.7.1 | |
| virtualenvs-create: true | |
| virtualenvs-in-project: true | |
| - name: Install dependencies | |
| run: | | |
| poetry config virtualenvs.create false --local | |
| poetry install --no-interaction --with dev | |
| - name: Run tests with coverage | |
| run: | | |
| poetry run pytest --cov=worker_api --cov-report=xml | |
| sonarqube: | |
| name: SonarQube Scan | |
| runs-on: ubuntu-latest | |
| needs: [ buildDockerImage ] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.12' | |
| - name: Install Poetry | |
| uses: snok/install-poetry@v1 | |
| with: | |
| version: 1.7.1 | |
| virtualenvs-create: true | |
| virtualenvs-in-project: true | |
| - name: Install dependencies | |
| run: | | |
| poetry config virtualenvs.create false --local | |
| poetry install --no-interaction --with dev | |
| - name: Run tests with coverage | |
| run: | | |
| poetry run pytest --cov=worker_api --cov-report=xml | |
| - name: SonarQube Scan | |
| uses: SonarSource/sonarqube-scan-action@v5 | |
| env: | |
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} | |