openreversefeed/.github/workflows/ci.yml at main · AngelOneWealth/openreversefeed · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

jobs:
  guardrails:
    name: guardrails
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: forbidden strings
        run: python tools/check_forbidden_strings.py
      - name: notice file exists
        run: test -f NOTICE
      - name: license file exists
        run: test -f LICENSE

  library:
    name: library (python ${{ matrix.python-version }})
    runs-on: ubuntu-latest
    needs: guardrails
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.11", "3.12"]

    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_USER: ofr
          POSTGRES_PASSWORD: ofr
          POSTGRES_DB: ofr
        ports: ["5432:5432"]
        options: >-
          --health-cmd "pg_isready -U ofr"
          --health-interval 5s
          --health-timeout 3s
          --health-retries 10

    env:
      OFR_DATABASE_URL: postgresql+psycopg://ofr:ofr@localhost:5432/ofr

    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip
      - name: install
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"
      - name: ruff
        run: ruff check src tests
      - name: unit tests
        run: pytest tests/unit -v
      - name: integration tests
        run: pytest tests/integration -v -m integration

  django:
    name: django reference app
    runs-on: ubuntu-latest
    needs: guardrails

    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_USER: ofr
          POSTGRES_PASSWORD: ofr
          POSTGRES_DB: ofr
        ports: ["5432:5432"]
        options: >-
          --health-cmd "pg_isready -U ofr"
          --health-interval 5s
          --health-timeout 3s
          --health-retries 10

    env:
      OFR_DATABASE_URL: postgresql+psycopg://ofr:ofr@localhost:5432/ofr
      DJANGO_SECRET_KEY: ci-only-not-for-prod
      DJANGO_DEBUG: "0"

    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: pip
      - name: install
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"
          pip install "django>=5,<6"
      - name: alembic migrate library schema
        run: alembic upgrade head
      - name: django system check
        working-directory: examples/django_reference
        run: |
          python manage.py check
          python manage.py migrate --run-syncdb --noinput
      - name: django app boots + loads pages
        working-directory: examples/django_reference
        run: |
          python manage.py ofr_seed
          python manage.py runserver 127.0.0.1:8765 &
          SERVER_PID=$!
          sleep 3
          curl -fsS http://127.0.0.1:8765/ > /dev/null
          curl -fsS http://127.0.0.1:8765/uploads/ > /dev/null
          curl -fsS http://127.0.0.1:8765/uploads/new/ > /dev/null
          curl -fsS http://127.0.0.1:8765/corrections/ > /dev/null
          kill $SERVER_PID || true

  security:
    name: bandit security scan
    runs-on: ubuntu-latest
    needs: guardrails
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - run: pip install "bandit>=1.7,<2"
      - run: bandit -q -r src tools -x tests