44 push :
55 branches :
66 - " **"
7- pull_request :
8- branches :
9- - master
107
118env :
129 ENV_FILE : .env
@@ -16,49 +13,78 @@ jobs:
1613 name : Get Environment Variables
1714 runs-on : ubuntu-latest
1815 outputs :
19- python-version : ${{ steps.load-env.outputs.python-version }}
16+ python-version : ${{ steps.load-internal-env.outputs.python-version }}
17+ github-actions : ${{steps.load-external-env.outputs.github-actions}}
2018 steps :
2119 - name : Checkout Code
2220 uses : actions/checkout@v3
2321
24- - name : Load Environment Variables
25- id : load-env
22+ - name : Load Project's Internal Environment Variables
23+ id : load-internal- env
2624 run : |
27- set -a
25+ set -x
2826 [ -f ${{ env.ENV_FILE }} ] && source ${{ env.ENV_FILE }}
29- echo "::set-output name=python-version::$PYTHON_VERSION"
27+ echo "python-version=$PYTHON_VERSION" >> $GITHUB_OUTPUT
28+ - name : Load External Environment Variables
29+ id : load-external-env
30+ run : |
31+ set -x
32+ if [ "$GITHUB_ACTIONS" = "true" ]; then
33+ echo "github-actions=$GITHUB_ACTIONS" >> $GITHUB_OUTPUT
34+ else
35+ echo "github-actions=false" >> $GITHUB_OUTPUT
36+ fi
3037
3138 env-setup :
3239 name : Setup Python and Install Dependencies
3340 runs-on : ubuntu-latest
3441 needs : env-vars
42+
3543 steps :
3644 - name : Checkout Code
3745 uses : actions/checkout@v3
38-
3946 - name : Set up Python
40- id : setup-python
4147 uses : actions/setup-python@v4
4248 with :
4349 python-version : ${{ needs.env-vars.outputs.python-version }}
44-
45- - name : Create Python Dev-tools Dependencies Cache
46- uses : actions/cache@v3
47- with :
48- path : ~/.cache/pip
49- key : ${{ runner.os }}-pip-dev-tools-dev-tools-${{ hashFiles('requirements.dev.txt') }}
50-
51- - name : Install Development Dependencies
52- run : pip install -r requirements.dev.txt
53-
54- - name : Create Python prod-libs Dependencies Cache
50+ - name : Create Non-root User & Install dependencies # This step does not run on github actions
51+ if : ${{ needs.env-vars.outputs.github-actions == 'false' }}
52+ run : |
53+ useradd -ms /bin/bash pyrunner
54+ mkdir -p /home/pyrunner/.cache/pip
55+ chown -R pyrunner:pyrunner /home/pyrunner
56+ chmod -R 700 /home/pyrunner/.cache/pip
57+
58+ sudo -u pyrunner bash -c "
59+ python -m venv ~/venv &&
60+ source ~/venv/bin/activate &&
61+ pip install --upgrade pip &&
62+ pip install -r requirements.txt
63+ "
64+ - name : Install Python Dependencies
65+ if : ${{ needs.env-vars.outputs.github-actions == 'true' }}
66+ run : |
67+ python -m venv ~/venv &&
68+ source ~/venv/bin/activate &&
69+ pip install --upgrade pip &&
70+ pip install -r requirements.txt
71+ - name : Verify Python Version
72+ run : |
73+ source ~/venv/bin/activate
74+ ACTUAL_VERSION=$(python --version 2>&1 | sed 's/Python //')
75+ EXPECTED_VERSION="${{ needs.env-vars.outputs.python-version }}"
76+ echo "Actual: $ACTUAL_VERSION"
77+ echo "Expected: $EXPECTED_VERSION"
78+
79+ if [ "$ACTUAL_VERSION" != "$EXPECTED_VERSION" ]; then
80+ echo "ERROR : Python version mismatch: expected $EXPECTED_VERSION, got $ACTUAL_VERSION"
81+ exit 1
82+ fi
83+ - name : Save Python Environment Cache
5584 uses : actions/cache@v3
5685 with :
57- path : ~/.cache/pip
58- key : ${{ runner.os }}-pip-prod-libs-${{ hashFiles('requirements.txt') }}
59-
60- - name : Install Prod Dependencies
61- run : pip install -r requirements.txt
86+ path : ~/venv
87+ key : ${{ runner.os }}-python-venv-${{ hashFiles('requirements.txt') }}
6288
6389 lint :
6490 name : Flake8 linting
@@ -68,18 +94,16 @@ jobs:
6894 - name : Checkout Code
6995 uses : actions/checkout@v3
7096
71- - name : Restore Python Dev-tools Dependencies Cache
97+ - name : Restore Python Environment Cache
7298 uses : actions/cache@v3
7399 with :
74- path : ~/.cache/pip
75- key : ${{ runner.os }}-pip-dev-tools-${{ hashFiles('requirements.dev.txt') }}
76- restore-keys : |
77- ${{ runner.os }}-pip-dev-tools-
78- - name : Install Flake8
79- run : pip install flake8 flake8-pyproject
100+ path : ~/venv
101+ key : ${{ runner.os }}-python-venv-${{ hashFiles('requirements.txt') }}
80102
81103 - name : Run Flake8
82- run : flake8 .
104+ run : |
105+ source ~/venv/bin/activate
106+ flake8 .
83107
84108 security :
85109 name : Security Check
@@ -89,18 +113,16 @@ jobs:
89113 - name : Checkout Code
90114 uses : actions/checkout@v3
91115
92- - name : Restore Python Dev-tools Dependencies Cache
116+ - name : Restore Python Environment Cache
93117 uses : actions/cache@v3
94118 with :
95- path : ~/.cache/pip
96- key : ${{ runner.os }}-pip-dev-tools-${{ hashFiles('requirements.dev.txt') }}
97- restore-keys : |
98- ${{ runner.os }}-pip-dev-tools-
99- - name : Install Bandit
100- run : pip install bandit
119+ path : ~/venv
120+ key : ${{ runner.os }}-python-venv-${{ hashFiles('requirements.txt') }}
101121
102122 - name : Run Bandit Security Check
103- run : bandit -r .
123+ run : |
124+ source ~/venv/bin/activate
125+ bandit -r .
104126
105127 quality :
106128 name : Code Quality
@@ -110,34 +132,24 @@ jobs:
110132 - name : Checkout Code
111133 uses : actions/checkout@v3
112134
113- - name : Restore Python Dev-tools Dependencies Cache
114- uses : actions/cache@v3
115- with :
116- path : ~/.cache/pip
117- key : ${{ runner.os }}-pip-dev-tools-${{ hashFiles('requirements.dev.txt') }}
118- restore-keys : |
119- ${{ runner.os }}-pip-dev-tools-
120-
121- - name : Restore Python Prod Dependencies Cache
135+ - name : Restore Python Environment Cache
122136 uses : actions/cache@v3
123137 with :
124- path : ~/.cache/pip
125- key : ${{ runner.os }}-pip-prod-${{ hashFiles('requirements.txt') }}
126- restore-keys : |
127- ${{ runner.os }}-pip-prod-
138+ path : ~/venv
139+ key : ${{ runner.os }}-python-venv-${{ hashFiles('requirements.txt') }}
128140
129- - name : Install Pylint, Black & Pydocstyle
130- run : pip install pylint black pydocstyle
131-
132- - name : Install Prod libs
133- run : pip install -r requirements.txt
134-
135- - name : Pylint linting
136- run : pylint .
141+ - name : Run Pylint
142+ run : |
143+ source ~/venv/bin/activate
144+ pylint .
137145
138146 - name : Check Black Formatting
139- run : black --check .
147+ run : |
148+ source ~/venv/bin/activate
149+ black --check .
140150
141151 - name : Check Pydocstyle
142- run : pydocstyle .
152+ run : |
153+ source ~/venv/bin/activate
154+ pydocstyle .
143155 continue-on-error : true # Non-blocking
0 commit comments