Skip to content
.github/workflows/python.yaml

fix: vuln scan on schedule only requires brnach resolution #4

Sign in to view logs

fix: vuln scan on schedule only requires brnach resolution

fix: vuln scan on schedule only requires brnach resolution #4

Workflow file for this run

.github/workflows/python.yaml at 0db4ff9
---

Check failure on line 1 in .github/workflows/python.yaml

View workflow run for this annotation

GitHub Actions / .github/workflows/python.yaml

Invalid workflow file 

(Line: 1473, Col: 16): The expression is not closed. An unescaped ${{ sequence was found, but the closing }} sequence was not found.
name: 'Python'
on:
workflow_call:
inputs:
BRANCH:
description: Branch to run the Vulnerability scan on
required: false
type: string
DEFAULT_ONLY:
default: false
description: Should this run be for the default python version only
required: false
type: boolean
LINT:
default: true
description: Should pylint run
required: false
type: boolean
LINT_ERROR_ON_WARNING:
default: false
description: Should pylint return error on Warning
required: false
type: boolean
PYTHON_VERSION:
default: '3.11'
description: Default Python Version
required: false
type: string
PYTHON_VERSIONS:
default: '["3.10", "3.11","3.12","3.13"]'
description: Default Python Version
required: false
type: string
secrets:
WORKFLOW_TOKEN:
description: "token to clone with"
required: false
env:
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
jobs:
init:
name: Meta
runs-on: ubuntu-latest
outputs:
changed-files: ${{ steps.changed-files.outputs.project_all_changed_files }}
doc-changed-files: ${{ steps.changed-files.outputs.docs_changed_files }}
py-changed-files: ${{ steps.changed-files.outputs.all_changed_files }}
pip-any-changed: ${{ steps.changed-files-pip.outputs.any_changed}}
py-any-changed: ${{ steps.changed-files.outputs.any_changed}}
tesy-changed-files: ${{ steps.changed-files.outputs.test_changed_files }}
requirements_set: ${{ steps.requirements_set.outputs.requirements }}
matrix_python_versions: ${{ steps.matrix_python_versions.outputs.MATRIX_PYTHON_VERSIONS }}
steps:
- name: Matrix python versions
id: matrix_python_versions
run: |
if [ "${{ inputs.DEFAULT_ONLY }}" == "true" ]; then
echo 'MATRIX_PYTHON_VERSIONS=[ "${{ inputs.PYTHON_VERSION }}" ]' >> $GITHUB_OUTPUT
else
echo 'MATRIX_PYTHON_VERSIONS=${{ inputs.PYTHON_VERSIONS }}' >> $GITHUB_OUTPUT
fi;
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
# fetch-depth: 100
fetch-depth: 0
- name: Get base branch name
id: base-branch-name
shell: bash
run: |
export CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD);
if [ "${CURRENT_BRANCH}" == "development" ]; then
BASE_BRANCH=master
elif [ "${CURRENT_BRANCH}" == "feature-next-release" ]; then
BASE_BRANCH=development
elif [ "${CURRENT_BRANCH}" == "feat-next-release" ]; then
BASE_BRANCH=development
else
if [ $(git rev-parse --verify feat-next-release) ]; then
BASE_BRANCH=feat-next-release
elif [ $(git rev-parse --verify feature-next-release) ]; then
BASE_BRANCH=feature-next-release
fi
echo $BASE_BRANCH
fi;
echo "Base branch is ${BASE_BRANCH}";
echo BASE_BRANCH=${BASE_BRANCH} > $GITHUB_OUTPUT
- name: Trace
shell: bash
run: |
git log -5;
git branch;
- uses: nrwl/nx-set-shas@afb73a62d26e41464e9254689e1fd6122ee683c1 #v5.0.1
id: setSHAs
with:
main-branch-name: ${{ steps.base-branch-name.outputs.BASE_BRANCH }}
# - uses: matheusraz/ref-sha@v1
# id: get-sha
# with:
# ref: ${{ steps.base-branch-name.outputs.BASE_BRANCH }}
# length: 41
- name: Get all files that have changed
id: changed-files
if: ${{ github.ref_name != 'master' && github.ref_name != 'development' && github.ref_type != 'tag' }}
uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
with:
files: |
**.py
!app/*/tests/
!app/*/migrations/
# base_sha: ${{ steps.setSHAs.outputs.base }}
# base_sha: ${{ steps.get-sha.outputs.sha }}
# base_sha: ${{ env.NX_BASE }}
base_sha: ${{ steps.base-branch-name.outputs.BASE_BRANCH }}
- name: List all changed files
# if: steps.changed-files.outputs.any_changed == 'true'
env:
ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_and_modified_files }}
run: |
echo "changed: ${ALL_CHANGED_FILES}":
for file in ${ALL_CHANGED_FILES}; do
echo "$file was changed"
done
- name: Get pip-file-changes
id: changed-files-pip
if: ${{ github.ref_name != 'master' && github.ref_name != 'development' && github.ref_type != 'tag' }}
uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
with:
files: |
requiremen*.txt
base_sha: ${{ steps.base-branch-name.outputs.BASE_BRANCH }}
- name: List all changed pip files
# if: steps.changed-files.outputs.any_changed == 'true'
env:
ALL_CHANGED_PIP_FILES: ${{ steps.changed-files-pip.outputs.all_changed_and_modified_files }}
run: |
echo "changed: ${ALL_CHANGED_PIP_FILES}":
for file in ${ALL_CHANGED_PIP_FILES}; do
echo "$file was changed"
done
- name: Find requirements files
id: requirements_set
run: |
files=$(ls requirements*.txt | jq -R . | jq -s .)
echo "requirements<<EOF" >> "$GITHUB_OUTPUT"
echo "$files" >> "$GITHUB_OUTPUT"
echo "EOF" >> "$GITHUB_OUTPUT"
lint:
name: Lint
needs:
- init
if: github.event_name != 'schedule'
runs-on: ubuntu-latest
strategy:
max-parallel: 4
matrix:
python-version: ${{ fromJson(needs.init.outputs.matrix_python_versions) }}
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
if: ${{ github.ref_name != 'master' && github.ref_name != 'development' && github.ref_type != 'tag' }}
- name: Set up Python ${{ matrix.python-version }}
if: ${{ github.ref_name != 'master' && github.ref_name != 'development' && github.ref_type != 'tag' }}
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: ${{ matrix.python-version }}
- name: Install Dependencies ${{ matrix.python-version }}
if: ${{ github.ref_name != 'master' && github.ref_name != 'development' && github.ref_type != 'tag' }}
run: |
python -m pip install --upgrade pip
pip install -r requirements.txt
pip install -r requirements_dev.txt
#
# PyLint C value
#
# [I]nformational messages that Pylint emits (do not contribute to your analysis score)
# [R]efactor for a "good practice" metric violation
# [C]onvention for coding standard violation
# [W]arning for stylistic problems, or minor programming issues
# [E]rror for important programming issues (i.e. most probably bug)
# [F]atal for errors which prevented further processing
- name: Lint ${{ matrix.python-version }}
id: lint
if: inputs.LINT && needs.init.outputs.py-any-changed
shell: bash
env:
PY_CHANGED_FILES: ${{ needs.init.outputs.py-changed-files }}
run: |
set +e;
echo "Primary Python version [${{ inputs.PYTHON_VERSION }}], Matrix Python Version [${{ matrix.python-version }}]";
if [ "${{ inputs.PYTHON_VERSION }}" != "${{ matrix.python-version }}" ]; then
echo "Only show Github annotations for primary Python version: ${{ inputs.PYTHON_VERSION }}";
pylint \
--py-version ${{ matrix.python-version }} \
${PY_CHANGED_FILES} || EXITCODE=$?
else
# available are debug, notice, warning, error
export I=debug;
export R=notice;
export C=warning;
export W=warning;
export E=error;
export F=error;
pylint --py-version ${{ matrix.python-version }} --msg-template "::${C} file={path},line={line},endLine={end_line},title={msg_id}::{msg} see <https://pylint.pycqa.org/en/latest/user_guide/messages/{category}/{symbol}.html>" ${PY_CHANGED_FILES} | envsubst;
export EXITCODE=${PIPESTATUS[0]}
# pylint \
# --py-version ${{ matrix.python-version }} \
# --msg-template "::notice \
# file={path}, \
# line={line}, \
# endLine={end_line}, \
# title={msg_id}::{msg} see https://pylint.pycqa.org/en/latest/user_guide/messages/{category}/{symbol}.html" \
# ${PY_CHANGED_FILES} || EXITCODE=$?
fi;
echo "Exit code was $EXITCODE";
if [ "${EXITCODE}" ]; then
echo "exit_code=${EXITCODE}" >> $GITHUB_OUTPUT
else
echo "exit_code=0" >> $GITHUB_OUTPUT
fi
echo "Exit code was ${EXITCODE}";
- name: Lint ${{ matrix.python-version }} Bitwise check exit code
id: lint-exit-type
if: inputs.LINT && needs.init.outputs.py-any-changed
shell: bash
env:
EXITCODE: ${{ steps.lint.outputs.exit_code }}
run: |
# Check error code for exit type
# https://pylint.pycqa.org/en/latest/user_guide/usage/run.html#exit-codes
echo "PyLint uses an exit code that is bit-encoded which is bitwise checked for the severities found. ";
if (( $EXITCODE & 1 )); then
echo "Bitwise found: fatal";
echo "fatal=true" >> $GITHUB_OUTPUT
else
echo "fatal=false" >> $GITHUB_OUTPUT
fi
if (( $EXITCODE & 2 )); then
echo "Bitwise found: error";
echo "error=true" >> $GITHUB_OUTPUT
else
echo "error=false" >> $GITHUB_OUTPUT
fi
if (( $EXITCODE & 4 )); then
echo "Bitwise found: warning";
echo "warning=true" >> $GITHUB_OUTPUT
else
echo "warning=false" >> $GITHUB_OUTPUT
fi
if (( $EXITCODE & 8 )); then
echo "Bitwise found: refactor";
echo "refactor=true" >> $GITHUB_OUTPUT
else
echo "refactor=false" >> $GITHUB_OUTPUT
fi
if (( $EXITCODE & 16 )); then
echo "Bitwise found: convention";
echo "convention=true" >> $GITHUB_OUTPUT
else
echo "convention=false" >> $GITHUB_OUTPUT
fi
if (( $EXITCODE & 32 )); then
echo "Bitwise found: usage error";
echo "usage_error=true" >> $GITHUB_OUTPUT
else
echo "usage_error=false" >> $GITHUB_OUTPUT
fi
- name: Fail on Fatal
if: steps.lint-exit-type.outputs.fatal == 'true'
shell: bash
run: |
echo "Lint exit code was ${{ steps.lint.outputs.exit_code }}"
- name: Fail on Error
if: steps.lint-exit-type.outputs.error == 'true'
shell: bash
run: |
echo "Lint exit code was ${{ steps.lint.outputs.exit_code }}"
- name: Fail on Warning
if: steps.lint-exit-type.outputs.warning == 'true'
shell: bash
run: |
echo "Lint exit code was ${{ steps.lint.outputs.exit_code }}"
- name: Fail on Refactor
if: steps.lint-exit-type.outputs.refactor == 'true'
shell: bash
run: |
echo "Lint exit code was ${{ steps.lint.outputs.exit_code }}"
- name: Fail on Convention
if: steps.lint-exit-type.outputs.convention == 'true'
shell: bash
run: |
echo "Lint exit code was ${{ steps.lint.outputs.exit_code }}"
- name: Fail on Usage Error
if: steps.lint-exit-type.outputs.usage_error == 'true'
shell: bash
run: |
echo "Lint exit code was ${{ steps.lint.outputs.exit_code }}"
unit-test:
name: Unit Test
runs-on: ubuntu-latest
needs:
- init
- lint
if: github.event_name != 'schedule'
strategy:
max-parallel: 4
matrix:
python-version: ${{ fromJson(needs.init.outputs.matrix_python_versions) }}
outputs:
unit-test-coverage: ${{ steps.run-unit-test.outputs.coverage }}
unit-test-branch_coverage: ${{ steps.run-unit-test.outputs.branch_coverage }}
continue-on-error: true
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: ${{ matrix.python-version }}
- name: Install Dependencies
run: |
python -m pip install --upgrade pip
pip install -r requirements.txt
pip install -r requirements_dev.txt
- run: |
echo "::remove-matcher owner=python::"
- name: Run Tests
id: run-unit-test
continue-on-error: true
shell: bash
run: |
pytest --cov-report xml:${PWD}/coverage.xml --cov-report html:${PWD}/coverage/ --cov-report json:${PWD}/coverage_unit.json --junit-xml=${PWD}/unit.JUnit.xml app/**/tests/unit;
echo coverage=$(echo "$(jq -r '.totals.percent_covered' coverage_unit.json) " | awk '{printf "%.4f%%", $1"%"}') > $GITHUB_OUTPUT
echo branch_coverage=$(echo "$(jq -r '.totals.covered_branches' coverage_unit.json) $(jq -r '.totals.num_branches' coverage_unit.json)" | awk '{covered=$1; total=$2; printf "%.4f%%", (covered/total*100)"%"}') >> $GITHUB_OUTPUT
- name: Trace
run: |
echo "PWD is [${PWD}]";
ls -laR
- name: Upload Test Report
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: success() || failure()
with:
name: unit-test-results-${{ matrix.python-version }}
path: unit.JUnit.xml
- name: Upload Coverage Report
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: success() || failure()
with:
name: coverage-report-${{ matrix.python-version }}
path: coverage.xml
- name: Upload Coverage Report (json)
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: success() || failure()
with:
name: coverage-report-json-${{ matrix.python-version }}
path: coverage_unit.json
- name: Upload Coverage
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: success() || failure()
with:
name: coverage-${{ matrix.python-version }}
path: coverage/*
- name: Upload Unit Coverage (rc)
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: success() || failure()
with:
name: coverage-rc-unit-${{ matrix.python-version }}
path: .coverage
include-hidden-files: true
- name: Upload any logs
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: success() || failure()
with:
name: unit-test-centurion-logs-${{ matrix.python-version }}
path: log/*
include-hidden-files: true
- name: log file check
run: |
ls -la log/ || true;
ls -la app/log/ || true;
functional-test:
name: Functional Test
runs-on: ubuntu-latest
needs:
- init
- lint
if: github.event_name != 'schedule'
strategy:
max-parallel: 4
matrix:
python-version: ${{ fromJson(needs.init.outputs.matrix_python_versions) }}
outputs:
functional-test-coverage: ${{ steps.run-functional-test.outputs.coverage }}
functional-test-branch_coverage: ${{ steps.run-functional-test.outputs.branch_coverage }}
continue-on-error: true
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: ${{ matrix.python-version }}
- name: Install Dependencies
run: |
python -m pip install --upgrade pip
pip install -r requirements.txt
pip install -r requirements_dev.txt
- run: |
echo "::remove-matcher owner=python::"
- name: Run Tests
id: run-functional-test
continue-on-error: true
shell: bash
run: |
pytest --cov-report xml:${PWD}/functional-coverage.xml --cov-report html:${PWD}/coverage/functional/ --cov-report json:${PWD}/coverage_functional.json --junit-xml=${PWD}/functional.JUnit.xml app/**/tests/functional;
echo coverage=$(echo "$(jq -r '.totals.percent_covered' coverage_functional.json) " | awk '{printf "%.4f%%", $1"%"}') > $GITHUB_OUTPUT
echo branch_coverage=$(echo "$(jq -r '.totals.covered_branches' coverage_functional.json) $(jq -r '.totals.num_branches' coverage_functional.json)" | awk '{covered=$1; total=$2; printf "%.4f%%", (covered/total*100)"%"}') >> $GITHUB_OUTPUT
- name: Trace
run: |
echo "PWD is [${PWD}]";
ls -laR
- name: Upload Test Report
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: success() || failure()
with:
name: functional-test-results-${{ matrix.python-version }}
path: functional.JUnit.xml
- name: Upload Coverage Report
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: success() || failure()
with:
name: functional-coverage-report-${{ matrix.python-version }}
path: functional-coverage.xml
- name: Upload Coverage Report (json)
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: success() || failure()
with:
name: functional-coverage-report-json-${{ matrix.python-version }}
path: coverage_functional.json
- name: Upload Coverage
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: success() || failure()
with:
name: functional-coverage-${{ matrix.python-version }}
path: coverage/functional/*
- name: Upload Functional Coverage (rc)
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: success() || failure()
with:
name: coverage-rc-functional-${{ matrix.python-version }}
path: .coverage
include-hidden-files: true
- name: Upload any logs
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: success() || failure()
with:
name: functional-test-centurion-logs-${{ matrix.python-version }}
path: log/*
include-hidden-files: true
- name: log file check
run: |
ls -la log/ || true;
ls -la app/log/ || true;
combines_report:
name: Create Combined Test Reports
needs:
- init
- unit-test
- functional-test
if: github.event_name != 'schedule'
runs-on: ubuntu-latest
strategy:
max-parallel: 4
matrix:
python-version: ${{ fromJson(needs.init.outputs.matrix_python_versions) }}
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: ${{ matrix.python-version }}
- name: Install Dependencies
run: |
python -m pip install --upgrade pip
pip install -r requirements.txt
pip install -r requirements_dev.txt
- name: Trace 'ls -la'
shell: bash
run: |
ls -la;
- name: Download Unit Test Report
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # V8.0.1
if: success() || failure()
with:
name: coverage-rc-unit-${{ matrix.python-version }}
- name: Rename Unit Test Report
shell: bash
run: |
ls -la;
mv .coverage .coverage.unit;
- name: Download Functional Test Report
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # V8.0.1
if: success() || failure()
with:
name: coverage-rc-functional-${{ matrix.python-version }}
- name: Rename Functional Test Report
shell: bash
run: |
ls -la;
mv .coverage .coverage.functional;
- name: Trace 'ls -la'
shell: bash
run: |
ls -la;
- name: Combine Reports
shell: bash
run: |
coverage combine;
- name: Create Combined Report
shell: bash
run: |
mkdir -p artifacts;
coverage html -d artifacts;
mv .coverage artifacts/;
- name: Upload Combined Report
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: success() || failure()
with:
name: coverage-combined-unit-function-html-${{ matrix.python-version }}
path: artifacts/*
include-hidden-files: true
################################################################################################################################
#
# Future Plan:
#
# with command: `git diff --name-only $(git rev-parse feature-next-release) HEAD`
# to get a list of files to create a coverage html report with just the changed files.
#
################################################################################################################################
# should only run on dev/master and tag
report:
name: Create Test Reports
needs:
- init
- unit-test
if: github.event_name != 'schedule'
runs-on: ubuntu-latest
strategy:
max-parallel: 4
matrix:
python-version: ${{ fromJson(needs.init.outputs.matrix_python_versions) }}
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Trace 'ls -la'
shell: bash
run: |
ls -la;
- name: Download Test Report
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # V8.0.1
if: success() || failure()
with:
name: unit-test-results-${{ matrix.python-version }}
- name: Trace 'ls -la'
shell: bash
run: |
ls -la;
- name: Test Report
if: success() || failure()
uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
id: test-report
with:
# artifact: unit-test-results-${{ matrix.python-version }}
name: Unit Test Report [Python ${{ matrix.python-version }}]
path: '*.xml'
reporter: java-junit
use-actions-summary: false
- name: Trace 'ls -la'
if: success() || failure()
shell: bash
run: |
ls -la;
- name: Create Shields.io Endpoint.json
if: success() || failure()
shell: bash
run: |
echo '
{
"schemaVersion": 1,
"label": "Unit Test",
"message": "${{ steps.test-report.outputs.passed }} passed | ${{ steps.test-report.outputs.skipped }} skipped | ${{ steps.test-report.outputs.failed }} failed",
"logoSvg": "<svg xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" viewBox=\"0 0 162.53 196.9\"><defs><linearGradient id=\"a\" x1=\"319.46\" y1=\"219.79\" x2=\"478.86\" y2=\"82.65\" gradientTransform=\"matrix(0.56, 0, 0, -0.57, -8.96, 287.06)\" gradientUnits=\"userSpaceOnUse\"><stop offset=\"0\" stop-color=\"#5a9fd4\"/><stop offset=\"1\" stop-color=\"#306998\"/></linearGradient><linearGradient id=\"b\" x1=\"540.48\" y1=\"-0.35\" x2=\"483.56\" y2=\"80.18\" gradientTransform=\"matrix(0.56, 0, 0, -0.57, -8.96, 287.06)\" gradientUnits=\"userSpaceOnUse\"><stop offset=\"0\" stop-color=\"#ffd43b\"/><stop offset=\"1\" stop-color=\"#ffe873\"/></linearGradient><radialGradient id=\"c\" cx=\"-809.2\" cy=\"196.83\" r=\"42.46\" gradientTransform=\"matrix(0, -0.24, -1.05, 0, 463.94, 150.1)\" gradientUnits=\"userSpaceOnUse\"><stop offset=\"0\" stop-color=\"#b8b8b8\" stop-opacity=\"0.5\"/><stop offset=\"1\" stop-color=\"#7f7f7f\" stop-opacity=\"0\"/></radialGradient></defs><title>python-logo</title><path d=\"M255,157.55a111.94,111.94,0,0,0-18.73,1.6c-16.59,2.93-19.6,9.07-19.6,20.38v14.94h39.2v5H202c-11.39,0-21.37,6.85-24.49,19.88-3.6,14.93-3.76,24.25,0,39.84,2.79,11.61,9.44,19.88,20.84,19.88h13.48V261.13c0-12.94,11.2-24.35,24.49-24.35h39.16a19.75,19.75,0,0,0,19.6-19.92V179.53c0-10.62-9-18.61-19.6-20.38A122.28,122.28,0,0,0,255,157.55Zm-21.2,12a7.47,7.47,0,1,1-7.36,7.49A7.44,7.44,0,0,1,233.83,169.57Z\" transform=\"translate(-174.73 -157.55)\" style=\"fill:url(#a)\"/><path d=\"M299.95,199.45v17.41c0,13.5-11.44,24.86-24.49,24.86H236.3c-10.73,0-19.6,9.18-19.6,19.92V299c0,10.62,9.24,16.87,19.6,19.92,12.41,3.65,24.31,4.31,39.16,0,9.87-2.86,19.6-8.61,19.6-19.92V284H255.9v-5h58.76c11.39,0,15.64-7.95,19.6-19.88,4.09-12.28,3.92-24.09,0-39.84-2.82-11.34-8.19-19.88-19.6-19.88Zm-22,94.54a7.47,7.47,0,1,1-7.36,7.45A7.4,7.4,0,0,1,277.92,294Z\" transform=\"translate(-174.73 -157.55)\" style=\"fill:url(#b)\"/><path d=\"M308.88,344.26c0,5.63-23.52,10.19-52.54,10.19s-52.54-4.56-52.54-10.19,23.52-10.19,52.54-10.19S308.88,338.64,308.88,344.26Z\" transform=\"translate(-174.73 -157.55)\" style=\"opacity:0.44382017850875854;isolation:isolate;fill:url(#c)\"/></svg>",
"color": "#4584b6",
"style": "plastic"
}' > endpoint_${{ matrix.python-version }}.json
- name: Upload Badge Endpoint json
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: success() || failure()
with:
name: unit-test-shield-endpoint-${{ matrix.python-version }}
path: endpoint_${{ matrix.python-version }}.json
# should only run on dev/master and tag
functional-report:
name: Create Test Reports (Functional)
needs:
- init
- functional-test
if: github.event_name != 'schedule'
runs-on: ubuntu-latest
strategy:
max-parallel: 4
matrix:
python-version: ${{ fromJson(needs.init.outputs.matrix_python_versions) }}
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Trace 'ls -la'
shell: bash
run: |
ls -la;
- name: Download Test Report
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # V8.0.1
if: success() || failure()
with:
name: functional-test-results-${{ matrix.python-version }}
- name: Trace 'ls -la'
shell: bash
run: |
ls -la;
- name: Test Report
uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
id: test-report
with:
# artifact: functional-test-results-${{ matrix.python-version }}
name: Functional Test Report [Python ${{ matrix.python-version }}]
path: '*.xml'
reporter: java-junit
# fail-on-error: false
use-actions-summary: false
- name: Trace 'ls -la'
if: success() || failure()
shell: bash
run: |
ls -la;
- name: Create Shields.io Endpoint.json
if: success() || failure()
shell: bash
run: |
echo '
{
"schemaVersion": 1,
"label": "Functional Test",
"message": "${{ steps.test-report.outputs.passed }} passed | ${{ steps.test-report.outputs.skipped }} skipped | ${{ steps.test-report.outputs.failed }} failed",
"logoSvg": "<svg xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" viewBox=\"0 0 162.53 196.9\"><defs><linearGradient id=\"a\" x1=\"319.46\" y1=\"219.79\" x2=\"478.86\" y2=\"82.65\" gradientTransform=\"matrix(0.56, 0, 0, -0.57, -8.96, 287.06)\" gradientUnits=\"userSpaceOnUse\"><stop offset=\"0\" stop-color=\"#5a9fd4\"/><stop offset=\"1\" stop-color=\"#306998\"/></linearGradient><linearGradient id=\"b\" x1=\"540.48\" y1=\"-0.35\" x2=\"483.56\" y2=\"80.18\" gradientTransform=\"matrix(0.56, 0, 0, -0.57, -8.96, 287.06)\" gradientUnits=\"userSpaceOnUse\"><stop offset=\"0\" stop-color=\"#ffd43b\"/><stop offset=\"1\" stop-color=\"#ffe873\"/></linearGradient><radialGradient id=\"c\" cx=\"-809.2\" cy=\"196.83\" r=\"42.46\" gradientTransform=\"matrix(0, -0.24, -1.05, 0, 463.94, 150.1)\" gradientUnits=\"userSpaceOnUse\"><stop offset=\"0\" stop-color=\"#b8b8b8\" stop-opacity=\"0.5\"/><stop offset=\"1\" stop-color=\"#7f7f7f\" stop-opacity=\"0\"/></radialGradient></defs><title>python-logo</title><path d=\"M255,157.55a111.94,111.94,0,0,0-18.73,1.6c-16.59,2.93-19.6,9.07-19.6,20.38v14.94h39.2v5H202c-11.39,0-21.37,6.85-24.49,19.88-3.6,14.93-3.76,24.25,0,39.84,2.79,11.61,9.44,19.88,20.84,19.88h13.48V261.13c0-12.94,11.2-24.35,24.49-24.35h39.16a19.75,19.75,0,0,0,19.6-19.92V179.53c0-10.62-9-18.61-19.6-20.38A122.28,122.28,0,0,0,255,157.55Zm-21.2,12a7.47,7.47,0,1,1-7.36,7.49A7.44,7.44,0,0,1,233.83,169.57Z\" transform=\"translate(-174.73 -157.55)\" style=\"fill:url(#a)\"/><path d=\"M299.95,199.45v17.41c0,13.5-11.44,24.86-24.49,24.86H236.3c-10.73,0-19.6,9.18-19.6,19.92V299c0,10.62,9.24,16.87,19.6,19.92,12.41,3.65,24.31,4.31,39.16,0,9.87-2.86,19.6-8.61,19.6-19.92V284H255.9v-5h58.76c11.39,0,15.64-7.95,19.6-19.88,4.09-12.28,3.92-24.09,0-39.84-2.82-11.34-8.19-19.88-19.6-19.88Zm-22,94.54a7.47,7.47,0,1,1-7.36,7.45A7.4,7.4,0,0,1,277.92,294Z\" transform=\"translate(-174.73 -157.55)\" style=\"fill:url(#b)\"/><path d=\"M308.88,344.26c0,5.63-23.52,10.19-52.54,10.19s-52.54-4.56-52.54-10.19,23.52-10.19,52.54-10.19S308.88,338.64,308.88,344.26Z\" transform=\"translate(-174.73 -157.55)\" style=\"opacity:0.44382017850875854;isolation:isolate;fill:url(#c)\"/></svg>",
"color": "#4584b6",
"style": "plastic"
}' > endpoint_functional_${{ matrix.python-version }}.json
- name: Upload Badge Endpoint json
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: success() || failure()
with:
name: functional-test-shield-endpoint-${{ matrix.python-version }}
path: endpoint_functional_${{ matrix.python-version }}.json
coverage-report:
name: Create Coverage report
needs:
- unit-test
if: github.event_name != 'schedule'
runs-on: ubuntu-latest
strategy:
max-parallel: 4
matrix:
python-version: [ "${{ inputs.PYTHON_VERSION }}" ]
steps:
- name: Run Tests
shell: bash
run: |
ls -l;
- name: Download Coverage Artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # V8.0.1
with:
name: coverage-report-${{ matrix.python-version }}
github-token: ${{ github.token }}
- name: ls
shell: bash
if: success() || failure()
run: |
ls -l;
- name: Code Coverage Report
uses: irongut/CodeCoverageSummary@v1.3.0
with:
filename: coverage.xml
badge: true
fail_below_min: true
format: markdown
hide_branch_rate: false
hide_complexity: false
indicators: true
output: both
thresholds: '60 85'
- name: ls
shell: bash
if: success() || failure()
run: |
ls -l;
- name: create status check/comment for code coverage results
id: jest_coverage_check
uses: im-open/process-code-coverage-summary@e2984f897702d68619d358a834d80a74aa0d9840 # v2.3.1
if: success() || failure()
with:
github-token: ${{ github.token }}
summary-file: code-coverage-results.md
create-pr-comment: true
update-comment-if-one-exists: true
update-comment-key: "${{ env.GITHUB-JOB }}_${{ env.GITHUB-ACTION }}"
- name: Upload Coverage Summary
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: success() || failure()
with:
name: code-coverage-results-${{ matrix.python-version }}
path: code-coverage-results.md
coverage-report-functional:
name: Create Coverage report (Functional)
needs:
- functional-test
if: github.event_name != 'schedule'
runs-on: ubuntu-latest
strategy:
max-parallel: 4
matrix:
python-version: [ "${{ inputs.PYTHON_VERSION }}" ]
steps:
- name: Run Tests
shell: bash
run: |
ls -l;
- name: Download Coverage Artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # V8.0.1
if: success() || failure()
with:
name: functional-coverage-report-${{ matrix.python-version }}
github-token: ${{ github.token }}
- name: ls
shell: bash
if: success() || failure()
run: |
ls -l;
- name: Code Coverage Report
uses: irongut/CodeCoverageSummary@v1.3.0
with:
filename: functional-coverage.xml
badge: true
fail_below_min: true
format: markdown
hide_branch_rate: false
hide_complexity: false
indicators: true
output: both
thresholds: '60 85'
- name: ls
shell: bash
if: success() || failure()
run: |
ls -l;
- name: create status check/comment for code coverage results
id: jest_coverage_check
uses: im-open/process-code-coverage-summary@e2984f897702d68619d358a834d80a74aa0d9840 # v2.3.1
if: success() || failure()
with:
github-token: ${{ github.token }}
summary-file: code-coverage-results.md
check-name: 'Functional Code Coverage'
create-pr-comment: true
update-comment-if-one-exists: true
update-comment-key: "${{ env.GITHUB-JOB }}_${{ env.GITHUB-ACTION }}"
- name: Upload Coverage Summary
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: success() || failure()
with:
name: functional-code-coverage-results-${{ matrix.python-version }}
path: code-coverage-results.md
badge-endpoint:
name: Publish Badge endpoint files
if: >-
(github.ref_name == 'master' || github.ref_name == 'development')
&&
github.event_name != 'schedule'
&&
github.repository == 'nofusscomputing/centurion_erp'
needs:
- unit-test
- report
strategy:
max-parallel: 4
matrix:
python-version: [ "${{ inputs.PYTHON_VERSION }}" ]
runs-on: ubuntu-latest
steps:
- name: Checkout Endpoint Repo
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
repository: 'nofusscomputing/.github'
ref: 'master'
token: ${{ secrets.WORKFLOW_TOKEN }}
path: 'endpoint_publish'
fetch-depth: '1'
show-progress: true
submodules: false
- name: Create Publish Directories
shell: bash
run: |
echo "[Debug] PWD[${PWD}]";
cd endpoint_publish;
echo "[Debug] PWD[${PWD}]";
mkdir -p repositories/${{ github.repository }}/${{ github.ref_name }};
ls -la;
- name: Create Publish Directories
shell: bash
run: |
echo "[Debug] PWD[${PWD}]";
# cd repositories/${{ github.repository }}/${{ github.ref_name }};
echo "[Debug] PWD[${PWD}]";
- name: Download Badge Endpoint json
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # V8.0.1
with:
name: unit-test-shield-endpoint-${{ matrix.python-version }}
- name: Add endpoint file
shell: bash
run: |
echo "[Debug] PWD[${PWD}]";
echo "[Debug] **************************** - cd endpoint_publish";
cd endpoint_publish;
echo "[Debug] **************************** - ls -la";
ls -la
echo "[Debug] ****************************";
echo "[Debug] PWD[${PWD}]";
echo "[Debug] **************************** - ls -la ../";
ls -la ../
echo "[Debug] **************************** - cp ../endpoint_${{ matrix.python-version }}.json repositories/${{ github.repository }}/${{ github.ref_name }}/badge_endpoint_unit_test.json";
cp ../endpoint_${{ matrix.python-version }}.json repositories/${{ github.repository }}/${{ github.ref_name }}/badge_endpoint_unit_test.json;
echo "[Debug] **************************** - ls -la repositories/${{ github.repository }}/${{ github.ref_name }}/";
ls -la repositories/${{ github.repository }}/${{ github.ref_name }}/;
- name: Create Shields.io Endpoint.json for coverage
if: success() || failure()
shell: bash
run: |
echo "[Debug] PWD[${PWD}]";
cd endpoint_publish;
echo "[Debug] ****************************";
echo "[Debug] PWD[${PWD}]";
echo "[Debug] **************************** - create file";
echo '
{
"schemaVersion": 1,
"label": "Unit Test Coverage",
"message": "${{ needs.unit-test.outputs.unit-test-coverage }} Line | ${{ needs.unit-test.outputs.unit-test-branch_coverage }} Branch",
"logoSvg": "<svg xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" viewBox=\"0 0 162.53 196.9\"><defs><linearGradient id=\"a\" x1=\"319.46\" y1=\"219.79\" x2=\"478.86\" y2=\"82.65\" gradientTransform=\"matrix(0.56, 0, 0, -0.57, -8.96, 287.06)\" gradientUnits=\"userSpaceOnUse\"><stop offset=\"0\" stop-color=\"#5a9fd4\"/><stop offset=\"1\" stop-color=\"#306998\"/></linearGradient><linearGradient id=\"b\" x1=\"540.48\" y1=\"-0.35\" x2=\"483.56\" y2=\"80.18\" gradientTransform=\"matrix(0.56, 0, 0, -0.57, -8.96, 287.06)\" gradientUnits=\"userSpaceOnUse\"><stop offset=\"0\" stop-color=\"#ffd43b\"/><stop offset=\"1\" stop-color=\"#ffe873\"/></linearGradient><radialGradient id=\"c\" cx=\"-809.2\" cy=\"196.83\" r=\"42.46\" gradientTransform=\"matrix(0, -0.24, -1.05, 0, 463.94, 150.1)\" gradientUnits=\"userSpaceOnUse\"><stop offset=\"0\" stop-color=\"#b8b8b8\" stop-opacity=\"0.5\"/><stop offset=\"1\" stop-color=\"#7f7f7f\" stop-opacity=\"0\"/></radialGradient></defs><title>python-logo</title><path d=\"M255,157.55a111.94,111.94,0,0,0-18.73,1.6c-16.59,2.93-19.6,9.07-19.6,20.38v14.94h39.2v5H202c-11.39,0-21.37,6.85-24.49,19.88-3.6,14.93-3.76,24.25,0,39.84,2.79,11.61,9.44,19.88,20.84,19.88h13.48V261.13c0-12.94,11.2-24.35,24.49-24.35h39.16a19.75,19.75,0,0,0,19.6-19.92V179.53c0-10.62-9-18.61-19.6-20.38A122.28,122.28,0,0,0,255,157.55Zm-21.2,12a7.47,7.47,0,1,1-7.36,7.49A7.44,7.44,0,0,1,233.83,169.57Z\" transform=\"translate(-174.73 -157.55)\" style=\"fill:url(#a)\"/><path d=\"M299.95,199.45v17.41c0,13.5-11.44,24.86-24.49,24.86H236.3c-10.73,0-19.6,9.18-19.6,19.92V299c0,10.62,9.24,16.87,19.6,19.92,12.41,3.65,24.31,4.31,39.16,0,9.87-2.86,19.6-8.61,19.6-19.92V284H255.9v-5h58.76c11.39,0,15.64-7.95,19.6-19.88,4.09-12.28,3.92-24.09,0-39.84-2.82-11.34-8.19-19.88-19.6-19.88Zm-22,94.54a7.47,7.47,0,1,1-7.36,7.45A7.4,7.4,0,0,1,277.92,294Z\" transform=\"translate(-174.73 -157.55)\" style=\"fill:url(#b)\"/><path d=\"M308.88,344.26c0,5.63-23.52,10.19-52.54,10.19s-52.54-4.56-52.54-10.19,23.52-10.19,52.54-10.19S308.88,338.64,308.88,344.26Z\" transform=\"translate(-174.73 -157.55)\" style=\"opacity:0.44382017850875854;isolation:isolate;fill:url(#c)\"/></svg>",
"color": "#4584b6",
"style": "plastic"
}' > repositories/${{ github.repository }}/${{ github.ref_name }}/badge_endpoint_coverage.json;
echo "[Debug] **************************** cat repositories/${{ github.repository }}/${{ github.ref_name }}/badge_endpoint_coverage.json";
cat repositories/${{ github.repository }}/${{ github.ref_name }}/badge_endpoint_coverage.json;
- name: Configure git
shell: bash
run: |
git config --global user.email "helpdesk@nofusscomputing.com";
git config --global user.name "nfc-bot";
- name: Git add
id: git-add
shell: bash
run: |
echo "[Debug] PWD[${PWD}]";
echo "[Debug] ****************************";
cd endpoint_publish;
echo "[Debug] ****************************";
ls -la
echo "[Debug] ****************************";
echo "[Debug] PWD[${PWD}]";
echo "[Debug] ****************************";
git status;
echo "[Debug] ****************************";
if [ "$(git status -s)" ]; then
echo "changed=true" > $GITHUB_OUTPUT;
echo "[Info] Changes need to be committed";
else
echo "changed=false" > $GITHUB_OUTPUT;
echo "[Info] NO changes to be committed";
fi
echo "[Debug] ****************************";
git add .
- name: Git commit
if: ${{ steps.git-add.outputs.changed == 'true' }}
shell: bash
run: |
echo "[Debug] PWD[${PWD}]";
echo "[Debug] ****************************";
cd endpoint_publish;
echo "[Debug] ****************************";
ls -la
echo "[Debug] ****************************";
echo "[Debug] PWD[${PWD}]";
echo "[Debug] ****************************";
git commit -m "chore: add badge endpount file ${{ github.repository }}/${{ github.ref_name }}"
- name: git push
if: ${{ steps.git-add.outputs.changed == 'true' }}
shell: bash
run: |
echo "[Debug] PWD[${PWD}]";
echo "[Debug] ****************************";
cd endpoint_publish;
echo "[Debug] ****************************";
ls -la
echo "[Debug] ****************************";
echo "[Debug] PWD[${PWD}]";
echo "[Debug] ****************************";
git push
badge-endpoint-functional:
name: Publish Badge endpoint files (Functional)
if: >-
(github.ref_name == 'master' || github.ref_name == 'development')
&&
github.event_name != 'schedule'
&&
github.repository == 'nofusscomputing/centurion_erp'
needs:
- functional-test
- functional-report
strategy:
max-parallel: 4
matrix:
python-version: [ "${{ inputs.PYTHON_VERSION }}" ]
runs-on: ubuntu-latest
steps:
- name: Checkout Endpoint Repo
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
repository: 'nofusscomputing/.github'
ref: 'master'
token: ${{ secrets.WORKFLOW_TOKEN }}
path: 'endpoint_publish'
fetch-depth: '1'
show-progress: true
submodules: false
- name: Create Publish Directories
shell: bash
run: |
echo "[Debug] PWD[${PWD}]";
cd endpoint_publish;
echo "[Debug] PWD[${PWD}]";
mkdir -p repositories/${{ github.repository }}/${{ github.ref_name }};
ls -la;
- name: Create Publish Directories
shell: bash
run: |
echo "[Debug] PWD[${PWD}]";
# cd repositories/${{ github.repository }}/${{ github.ref_name }};
echo "[Debug] PWD[${PWD}]";
- name: Download Badge Endpoint json
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # V8.0.1
with:
name: functional-test-shield-endpoint-${{ matrix.python-version }}
- name: Add endpoint file
shell: bash
run: |
echo "[Debug] PWD[${PWD}]";
echo "[Debug] **************************** - cd endpoint_publish";
cd endpoint_publish;
echo "[Debug] **************************** - ls -la";
ls -la
echo "[Debug] ****************************";
echo "[Debug] PWD[${PWD}]";
echo "[Debug] **************************** - ls -la ../";
ls -la ../
echo "[Debug] **************************** - cp ../endpoint_functional_${{ matrix.python-version }}.json repositories/${{ github.repository }}/${{ github.ref_name }}/badge_endpoint_functional_test.json";
cp ../endpoint_functional_${{ matrix.python-version }}.json repositories/${{ github.repository }}/${{ github.ref_name }}/badge_endpoint_functional_test.json;
echo "[Debug] **************************** - ls -la repositories/${{ github.repository }}/${{ github.ref_name }}/";
ls -la repositories/${{ github.repository }}/${{ github.ref_name }}/;
- name: Create Shields.io Endpoint.json for coverage
if: success() || failure()
shell: bash
run: |
echo "[Debug] PWD[${PWD}]";
cd endpoint_publish;
echo "[Debug] ****************************";
echo "[Debug] PWD[${PWD}]";
echo "[Debug] **************************** - create file";
echo '
{
"schemaVersion": 1,
"label": "Functional Test Coverage",
"message": "${{ needs.functional-test.outputs.functional-test-coverage }} Line | ${{ needs.functional-test.outputs.functional-test-branch_coverage }} Branch",
"logoSvg": "<svg xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" viewBox=\"0 0 162.53 196.9\"><defs><linearGradient id=\"a\" x1=\"319.46\" y1=\"219.79\" x2=\"478.86\" y2=\"82.65\" gradientTransform=\"matrix(0.56, 0, 0, -0.57, -8.96, 287.06)\" gradientUnits=\"userSpaceOnUse\"><stop offset=\"0\" stop-color=\"#5a9fd4\"/><stop offset=\"1\" stop-color=\"#306998\"/></linearGradient><linearGradient id=\"b\" x1=\"540.48\" y1=\"-0.35\" x2=\"483.56\" y2=\"80.18\" gradientTransform=\"matrix(0.56, 0, 0, -0.57, -8.96, 287.06)\" gradientUnits=\"userSpaceOnUse\"><stop offset=\"0\" stop-color=\"#ffd43b\"/><stop offset=\"1\" stop-color=\"#ffe873\"/></linearGradient><radialGradient id=\"c\" cx=\"-809.2\" cy=\"196.83\" r=\"42.46\" gradientTransform=\"matrix(0, -0.24, -1.05, 0, 463.94, 150.1)\" gradientUnits=\"userSpaceOnUse\"><stop offset=\"0\" stop-color=\"#b8b8b8\" stop-opacity=\"0.5\"/><stop offset=\"1\" stop-color=\"#7f7f7f\" stop-opacity=\"0\"/></radialGradient></defs><title>python-logo</title><path d=\"M255,157.55a111.94,111.94,0,0,0-18.73,1.6c-16.59,2.93-19.6,9.07-19.6,20.38v14.94h39.2v5H202c-11.39,0-21.37,6.85-24.49,19.88-3.6,14.93-3.76,24.25,0,39.84,2.79,11.61,9.44,19.88,20.84,19.88h13.48V261.13c0-12.94,11.2-24.35,24.49-24.35h39.16a19.75,19.75,0,0,0,19.6-19.92V179.53c0-10.62-9-18.61-19.6-20.38A122.28,122.28,0,0,0,255,157.55Zm-21.2,12a7.47,7.47,0,1,1-7.36,7.49A7.44,7.44,0,0,1,233.83,169.57Z\" transform=\"translate(-174.73 -157.55)\" style=\"fill:url(#a)\"/><path d=\"M299.95,199.45v17.41c0,13.5-11.44,24.86-24.49,24.86H236.3c-10.73,0-19.6,9.18-19.6,19.92V299c0,10.62,9.24,16.87,19.6,19.92,12.41,3.65,24.31,4.31,39.16,0,9.87-2.86,19.6-8.61,19.6-19.92V284H255.9v-5h58.76c11.39,0,15.64-7.95,19.6-19.88,4.09-12.28,3.92-24.09,0-39.84-2.82-11.34-8.19-19.88-19.6-19.88Zm-22,94.54a7.47,7.47,0,1,1-7.36,7.45A7.4,7.4,0,0,1,277.92,294Z\" transform=\"translate(-174.73 -157.55)\" style=\"fill:url(#b)\"/><path d=\"M308.88,344.26c0,5.63-23.52,10.19-52.54,10.19s-52.54-4.56-52.54-10.19,23.52-10.19,52.54-10.19S308.88,338.64,308.88,344.26Z\" transform=\"translate(-174.73 -157.55)\" style=\"opacity:0.44382017850875854;isolation:isolate;fill:url(#c)\"/></svg>",
"color": "#4584b6",
"style": "plastic"
}' > repositories/${{ github.repository }}/${{ github.ref_name }}/badge_endpoint_coverage_functional.json;
echo "[Debug] **************************** cat repositories/${{ github.repository }}/${{ github.ref_name }}/badge_endpoint_coverage_functional.json";
cat repositories/${{ github.repository }}/${{ github.ref_name }}/badge_endpoint_coverage_functional.json;
- name: Configure git
shell: bash
run: |
git config --global user.email "helpdesk@nofusscomputing.com";
git config --global user.name "nfc-bot";
- name: Git add
id: git-add
shell: bash
run: |
echo "[Debug] PWD[${PWD}]";
echo "[Debug] ****************************";
cd endpoint_publish;
echo "[Debug] ****************************";
ls -la
echo "[Debug] ****************************";
echo "[Debug] PWD[${PWD}]";
echo "[Debug] ****************************";
git status;
echo "[Debug] ****************************";
if [ "$(git status -s)" ]; then
echo "changed=true" > $GITHUB_OUTPUT;
echo "[Info] Changes need to be committed";
else
echo "changed=false" > $GITHUB_OUTPUT;
echo "[Info] NO changes to be committed";
fi
echo "[Debug] ****************************";
git add .
- name: Git commit
if: ${{ steps.git-add.outputs.changed == 'true' }}
shell: bash
run: |
echo "[Debug] PWD[${PWD}]";
echo "[Debug] ****************************";
cd endpoint_publish;
echo "[Debug] ****************************";
ls -la
echo "[Debug] ****************************";
echo "[Debug] PWD[${PWD}]";
echo "[Debug] ****************************";
git commit -m "chore: add badge endpount file ${{ github.repository }}/${{ github.ref_name }}"
- name: git push
if: ${{ steps.git-add.outputs.changed == 'true' }}
shell: bash
run: |
echo "[Debug] PWD[${PWD}]";
echo "[Debug] ****************************";
cd endpoint_publish;
echo "[Debug] ****************************";
ls -la
echo "[Debug] ****************************";
echo "[Debug] PWD[${PWD}]";
echo "[Debug] ****************************";
git push
vulnerability-scan:
name: PIP file Scan (requirements.txt)
runs-on: ubuntu-latest
needs:
- init
permissions:
contents: read # Required to checkout and read repo files
security-events: write # Required to upload SARIF files to Security tab
strategy:
fail-fast: false
matrix:
requirements: ${{ fromJSON(needs.init.outputs.requirements_set) }}
steps:
- name: Resolve branch
run: |
echo "BRANCH=${{ inputs.BRANCH || github.ref_name }}" >> $GITHUB_ENV
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
if: github.event_name == 'schedule'
with:
ref: ${{ env.BRANCH }
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
if: github.event_name != 'schedule'
- name: Run Trivy vulnerability scanner against ${{ matrix.requirements }}
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
with:
scan-type: 'fs'
ignore-unfixed: false
format: 'sarif'
output: 'trivy-results.sarif'
severity: 'LOW,MEDIUM,HIGH,CRITICAL'
scan-ref: ${{ matrix.requirements }}
exit-code: 0
- name: Upload ${{ matrix.requirements }} scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
with:
sarif_file: 'trivy-results.sarif'
- name: Upload scan results ${{ matrix.requirements }} sarif Report
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: python-scan-results-${{ matrix.requirements }}-sarif
path: trivy-results.sarif
vulnerability-report:
name: Create Reports
needs:
- init
- vulnerability-scan
if: github.event_name != 'schedule'
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
requirements: ${{ fromJSON(needs.init.outputs.requirements_set) }}
steps:
- name: Fetch scan results ${{ matrix.requirements }}(sarif Report)
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # V8.0.1
with:
name: python-scan-results-${{ matrix.requirements }}-sarif
- run: |
echo "${PWD}" || echo "couldnt PWD";
echo "1";
ls -la;
echo "2";
mkdir -p ${{ runner.temp }}/_github_home/ || echo "could not make";
echo "2.1";
ls -la ${{ runner.temp }}/_github_home/;
echo "3";
mv -f trivy-results.sarif ${{ runner.temp }}/_github_home/trivy-results.sarif;
echo "4";
ls -la ${{ runner.temp }}/_github_home/;
- name: Convert Sarif -> Markdown
if: success() || failure()
id: sarif-to-markdown
uses: 11notes/action-sarif-to-markdown@bc689850bd33a1037ea1d0a609ab4ea14b3c4396 # v1.2.0
with:
sarif_file: trivy-results.sarif
- name: Print Report
run: echo ${{ steps.sarif-to-markdown.outputs.markdown }}
- name: Create Report Artifact
run: |
ls -la ${{ runner.temp }}/_github_home/sarif.md;
echo "## PIP File Scan of \`${{ matrix.requirements }}\`" > vulnerability-report.md;
echo "" >> vulnerability-report.md;
echo ">[!tip]" >> vulnerability-report.md;
echo ">" >> vulnerability-report.md;
echo "> _If this report shows nothing, it means there was nothing found._" >> vulnerability-report.md;
echo "" >> vulnerability-report.md;
echo -n "#" >> vulnerability-report.md;
cat ${{ runner.temp }}/_github_home/sarif.md >> vulnerability-report.md;
- name: Upload scan results
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: python-vulnerability-report-${{ matrix.requirements }}
path: vulnerability-report.md
pull-request-report-comment:
if: ${{ github.ref_type != 'tag' && github.event_name != 'schedule' }}
needs:
- init
- vulnerability-scan
- vulnerability-report
runs-on: ubuntu-latest
name: Comment on Pull Request (Python Scan)
strategy:
fail-fast: false
matrix:
requirements: ${{ fromJSON(needs.init.outputs.requirements_set) }}
steps:
- name: Find Current Pull Request
uses: jwalton/gh-find-current-pr@f3d61b485d2801773f7a07b2aaa3306bd8f8e653 #v1.3.5
id: finder
# with:
# sha: ${{ github.event.pull_request.head.sha }}
- name: Fetch Vulnerability Report
if: ${{ steps.finder.outputs.pr != '' }}
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # V8.0.1
with:
name: python-vulnerability-report-${{ matrix.requirements }}
- name: Capture scan results
if: ${{ steps.finder.outputs.pr != '' }}
run: |
content=$(cat vulnerability-report.md | head -c 65000)
echo "report<<EOF" >> $GITHUB_ENV
echo "$content" >> $GITHUB_ENV
echo "EOF" >> $GITHUB_ENV
- name: Comment scan results on PR
if: ${{ steps.finder.outputs.pr != '' }}
uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
with:
number: ${{ steps.finder.outputs.pr }}
header: Python ${{ matrix.requirements }} Scan Results
message: |
${{ env.report }}