mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-10-16 00:14:23 +00:00
Jon Young
7e194407f6
* chore(CI): import pre-commit-config.yaml from prowler-cloud/prowler * chore(CI): import pre-commit-config.yaml from prowler-cloud/prowler * chore(CI): add safety package to pre-commit * chore(CI): use poetry run to access venv for local checks * docs(repo): add community focused docs * chore(GitHub): add ISSUE_TEMPLATEs same as prowler-cloud/prowler repo * chore(CI): add pull-request.yml workflow runs on PRs and pushes to main * chore(CI): add additional workflows same as those on prowler-cloud/prowler * fix(CI): use correct path * fix(API): fix flake8 F401 failures * fix(API, Backend): format with black * fix( Backend): format with black * fix(CI): use correct path * fix(CI): move pyproject.toml * fix(CI): simplify tools with ruff * fix(CI): use ruff instead of flake8, black * fix(CI): change ruff commands for GHA * fix(CI): use correct ruff command name * fix(Backend): ruff format * fix(CI): ignore safety jinja2 vuln id 70612 and add mypy for future usage * fix(CI): set file path for hadolint * fix(CI): add dockle * fix(CI): update dockle version * fix(CI): fix hadolint errors * fix(CI): add simple tests for CI * fix(Docker): multi-stage docker build * docs(README): update docs for poetry location
94 lines
3.3 KiB
YAML
94 lines
3.3 KiB
YAML
name: pr-lint-test
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- "main"
|
|
pull_request:
|
|
branches:
|
|
- "main"
|
|
|
|
jobs:
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
matrix:
|
|
python-version: ["3.12"]
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Test if changes are in not ignored paths
|
|
id: are-non-ignored-files-changed
|
|
uses: tj-actions/changed-files@v42
|
|
with:
|
|
files: ./**
|
|
files_ignore: |
|
|
.github/**
|
|
README.md
|
|
docs/**
|
|
permissions/**
|
|
mkdocs.yml
|
|
- name: Install poetry
|
|
if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true'
|
|
run: |
|
|
python -m pip install --upgrade pip
|
|
pipx install poetry
|
|
- name: Set up Python ${{ matrix.python-version }}
|
|
if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true'
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: ${{ matrix.python-version }}
|
|
cache: "poetry"
|
|
- name: Install dependencies
|
|
if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true'
|
|
run: |
|
|
poetry install
|
|
poetry run pip list
|
|
VERSION=$(curl --silent "https://api.github.com/repos/hadolint/hadolint/releases/latest" | \
|
|
grep '"tag_name":' | \
|
|
sed -E 's/.*"v([^"]+)".*/\1/' \
|
|
) && curl -L -o /tmp/hadolint "https://github.com/hadolint/hadolint/releases/download/v${VERSION}/hadolint-Linux-x86_64" \
|
|
&& chmod +x /tmp/hadolint
|
|
|
|
- name: Poetry check
|
|
if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true'
|
|
run: |
|
|
poetry lock --check
|
|
- name: Lint with ruff
|
|
if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true'
|
|
run: |
|
|
poetry run ruff check . --exclude contrib
|
|
- name: Check Format with ruff
|
|
if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true'
|
|
run: |
|
|
poetry run ruff format --check . --exclude contrib
|
|
- name: Lint with pylint
|
|
if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true'
|
|
run: |
|
|
poetry run pylint --disable=W,C,R,E -j 0 -rn -sn src/
|
|
- name: Bandit
|
|
if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true'
|
|
run: |
|
|
poetry run bandit -q -lll -x '*_test.py,./contrib/' -r .
|
|
- name: Safety
|
|
if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true'
|
|
run: |
|
|
poetry run safety check --ignore 70612
|
|
- name: Vulture
|
|
if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true'
|
|
run: |
|
|
poetry run vulture --exclude "contrib" --min-confidence 100 .
|
|
- name: Hadolint
|
|
if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true'
|
|
run: |
|
|
/tmp/hadolint Dockerfile --ignore=DL3013
|
|
- name: Test with pytest
|
|
if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true'
|
|
run: |
|
|
poetry run pytest -n auto --cov=./src --cov-report=xml tests
|
|
- name: Upload coverage reports to Codecov
|
|
if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true'
|
|
uses: codecov/codecov-action@v4
|
|
env:
|
|
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
|