Bump ip-address from 10.2.0 to 10.4.0 #2285
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI / CD | |
| on: [push, pull_request] | |
| jobs: | |
| get-backend-sha: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| backend_sha: ${{ steps.get-sha.outputs.backend_sha }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Checkout submodules | |
| run: git submodule update --init --recursive | |
| - name: Get backend sha | |
| id: get-sha | |
| run: | | |
| echo "backend_sha=$(git rev-parse @:OpenCloning_backend)" >> $GITHUB_OUTPUT | |
| check-cache: | |
| runs-on: ubuntu-latest | |
| needs: get-backend-sha | |
| outputs: | |
| cache-hit: ${{ steps.cache-check.outputs.cache-hit }} | |
| steps: | |
| - name: Verify backend SHA is not empty | |
| run: | | |
| if [ -z "${{ needs.get-backend-sha.outputs.backend_sha }}" ]; then | |
| echo "Error: backend_sha is empty" | |
| exit 1 | |
| fi | |
| # This step both checks AND saves the cache | |
| # If there's a cache hit: it restores it | |
| # If there's no cache hit: it will save any files matching the path at the end of the job | |
| - name: Check cached venv | |
| id: cache-check | |
| uses: actions/cache@v3 | |
| with: | |
| path: OpenCloning_backend/.venv | |
| key: python-venv-${{ runner.os }}-${{ needs.get-backend-sha.outputs.backend_sha }} | |
| install-python-dependencies: | |
| needs: [check-cache, get-backend-sha] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| if: needs.check-cache.outputs.cache-hit != 'true' | |
| uses: actions/checkout@v4 | |
| with: | |
| submodules: recursive | |
| - name: Install Python | |
| if: needs.check-cache.outputs.cache-hit != 'true' | |
| uses: actions/setup-python@v5.4.0 | |
| with: | |
| python-version: 3.11 | |
| - name: Install uv | |
| if: needs.check-cache.outputs.cache-hit != 'true' | |
| uses: astral-sh/setup-uv@v5 | |
| - name: Install python dependencies | |
| if: needs.check-cache.outputs.cache-hit != 'true' | |
| working-directory: OpenCloning_backend | |
| run: uv sync --locked | |
| - name: Save venv to cache | |
| if: needs.check-cache.outputs.cache-hit != 'true' | |
| uses: actions/cache@v3 | |
| with: | |
| path: OpenCloning_backend/.venv | |
| key: python-venv-${{ runner.os }}-${{ needs.get-backend-sha.outputs.backend_sha }} | |
| install-frontend-dependencies: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Cache yarn dependencies | |
| uses: actions/cache@v3 | |
| id: yarn-cache | |
| with: | |
| path: | | |
| node_modules | |
| apps/*/node_modules | |
| /home/runner/.cache/Cypress | |
| key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }} | |
| - name: Setup Node.js | |
| if: steps.yarn-cache.outputs.cache-hit != 'true' | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: "22.17" | |
| - name: Install frontend dependencies | |
| if: steps.yarn-cache.outputs.cache-hit != 'true' | |
| run: corepack enable && yarn install --immutable | |
| cypress-tests: | |
| name: Run Cypress tests | |
| needs: | |
| [ | |
| install-python-dependencies, | |
| install-frontend-dependencies, | |
| get-backend-sha, | |
| ] | |
| runs-on: ubuntu-latest | |
| env: | |
| NCBI_API_KEY: ${{ secrets.NCBI_API_KEY }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| group: [1, 2, 3, 4, "component", "unit-tests", "opencloningdb1", "opencloningdb2"] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| submodules: recursive | |
| - name: Print git tag | |
| run: | | |
| git describe --tags | |
| - name: Cache mafft | |
| id: cache-mafft | |
| uses: actions/cache@v3 | |
| with: | |
| path: /usr/bin/mafft | |
| key: ${{ runner.os }}-mafft | |
| - name: Install mafft | |
| if: steps.cache-mafft.outputs.cache-hit != 'true' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y mafft | |
| - name: Download MARS executable | |
| run: | | |
| wget https://github.com/manulera/MARS/releases/download/v0.2/mars-Linux | |
| chmod +x mars-Linux | |
| sudo mv mars-Linux /usr/local/bin/mars | |
| - name: Install Python | |
| uses: actions/setup-python@v5.4.0 | |
| with: | |
| python-version: 3.11 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v5 | |
| - name: Restore cached venv | |
| uses: actions/cache@v3 | |
| with: | |
| path: OpenCloning_backend/.venv | |
| key: python-venv-${{ runner.os }}-${{ needs.get-backend-sha.outputs.backend_sha }} | |
| - name: run python dev server in background (not opencloningdb) | |
| if: ${{ !startsWith(matrix.group, 'opencloningdb') }} | |
| working-directory: OpenCloning_backend | |
| run: | | |
| uv run uvicorn opencloning.main:app --port 8000 & | |
| env: | |
| NCBI_API_KEY: ${{ secrets.NCBI_API_KEY }} | |
| ADDGENE_USERNAME: ${{ secrets.ADDGENE_USERNAME }} | |
| ADDGENE_PASSWORD: ${{ secrets.ADDGENE_PASSWORD }} | |
| - name: run postgres in docker | |
| if: ${{ startsWith(matrix.group, 'opencloningdb') }} | |
| working-directory: OpenCloning_backend | |
| run: | | |
| docker compose -f docker/docker-compose.postgres.yml up -d postgres | |
| - name: run python dev server in background (opencloningdb) | |
| if: ${{ startsWith(matrix.group, 'opencloningdb') }} | |
| working-directory: OpenCloning_backend | |
| run: | | |
| uv run opencloning-cli db seed | |
| uv run uvicorn opencloning_db.combined:app --port 8000 & | |
| env: | |
| NCBI_API_KEY: ${{ secrets.NCBI_API_KEY }} | |
| ADDGENE_USERNAME: ${{ secrets.ADDGENE_USERNAME }} | |
| ADDGENE_PASSWORD: ${{ secrets.ADDGENE_PASSWORD }} | |
| OPENCLONING_TESTING: "1" | |
| OPENCLONING_DB_URL: postgresql+psycopg://dbuser:dbpassword@localhost:5432/opencloning_dev | |
| OPENCLONING_JWT_SECRET: local-dev-only-jwt-secret-change-for-shared-envs | |
| OPENCLONING_RATE_LIMIT_ENABLED: false | |
| - name: check if the backend server is running | |
| if: ${{ !startsWith(matrix.group, 'opencloningdb') }} | |
| run: | | |
| for i in {1..3}; do | |
| if curl -s http://127.0.0.1:8000 > /dev/null; then | |
| echo "Backend server is up!" | |
| exit 0 | |
| fi | |
| echo "Waiting for server... ($i/3)" | |
| sleep 4 | |
| done | |
| echo "Server failed to start" | |
| exit 1 | |
| - name: check if the opencloningdb server is running | |
| if: ${{ startsWith(matrix.group, 'opencloningdb') }} | |
| run: | | |
| for i in {1..3}; do | |
| if curl -f http://127.0.0.1:8000/db/docs > /dev/null; then | |
| echo "OpenCloningDB server is up!" | |
| exit 0 | |
| fi | |
| echo "Waiting for server... ($i/3)" | |
| sleep 4 | |
| done | |
| echo "Server failed to start" | |
| exit 1 | |
| - name: Restore cached node_modules | |
| uses: actions/cache@v3 | |
| with: | |
| path: | | |
| node_modules | |
| /home/runner/.cache/Cypress | |
| apps/*/node_modules | |
| key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }} | |
| - name: enable corepack | |
| run: corepack enable | |
| - name: Cypress run E2E tests (OpenCloning) | |
| if: ${{ matrix.group != 'component' && matrix.group != 'unit-tests' && !startsWith(matrix.group, 'opencloningdb') }} | |
| uses: cypress-io/github-action@v6 | |
| env: | |
| VITE_COVERAGE: "true" | |
| VITE_LOG_LEVEL: "warn" | |
| CYPRESS_TEST_GROUP: ${{ matrix.group }} | |
| with: | |
| start: yarn start | |
| - name: Cypress run E2E tests (OpenCloningDB) | |
| if: ${{ startsWith(matrix.group, 'opencloningdb') }} | |
| uses: cypress-io/github-action@v6 | |
| env: | |
| VITE_COVERAGE: "true" | |
| VITE_LOG_LEVEL: "warn" | |
| CYPRESS_TEST_GROUP: ${{ matrix.group }} | |
| with: | |
| start: yarn workspace opencloningdb dev --port 3000 | |
| - name: Cypress run component tests | |
| if: matrix.group == 'component' | |
| uses: cypress-io/github-action@v6 | |
| env: | |
| VITE_COVERAGE: "true" | |
| VITE_LOG_LEVEL: "warn" | |
| with: | |
| component: true | |
| - name: vitest unit tests | |
| if: matrix.group == 'unit-tests' | |
| run: yarn install --immutable && yarn vitest run --coverage | |
| - name: stop postgres in docker | |
| if: ${{ startsWith(matrix.group, 'opencloningdb') }} | |
| working-directory: OpenCloning_backend | |
| run: | | |
| docker compose -f docker/docker-compose.postgres.yml down -v | |
| - name: Upload coverage file | |
| uses: actions/upload-artifact@v4.6.0 | |
| with: | |
| name: coverage-${{ matrix.group }} | |
| path: coverage/coverage-final.json | |
| - name: Upload screenshots | |
| uses: actions/upload-artifact@v4.6.0 | |
| if: failure() | |
| with: | |
| name: cypress-screenshots-${{ matrix.group }} | |
| path: cypress/screenshots | |
| cypress-gather-coverage: | |
| needs: cypress-tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Download coverage files | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: coverage | |
| pattern: coverage* | |
| - name: list coverage files | |
| run: | | |
| ls coverage | |
| - name: Merge coverage reports | |
| run: | | |
| for folder in coverage/coverage-*; do | |
| mv $folder/coverage-final.json $folder.json | |
| rmdir $folder | |
| done | |
| mkdir .nyc_output | |
| mv coverage/*.json .nyc_output | |
| rm -rf coverage | |
| npx nyc report --reporter json --report-dir coverage | |
| # Remove the absolute path from the coverage file | |
| sed -i "s|\"$(pwd)/|\"|g" coverage/coverage-final.json | |
| - name: Upload results to Codecov | |
| uses: codecov/codecov-action@v4 | |
| with: | |
| file: coverage/coverage-final.json | |
| # Update docker image when committing to master branch if tests pass | |
| push_to_registry: | |
| name: Push Docker image to Docker Hub | |
| runs-on: ubuntu-latest | |
| # Only run if the branch is master | |
| if: github.ref == 'refs/heads/master' | |
| steps: | |
| - name: Check out the repo | |
| uses: actions/checkout@v3 | |
| - name: Log in to Docker Hub | |
| uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9 | |
| with: | |
| username: ${{ secrets.DOCKER_USERNAME }} | |
| password: ${{ secrets.DOCKER_PASSWORD }} | |
| - name: Extract metadata (tags, labels) for Docker | |
| id: meta | |
| uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38 | |
| with: | |
| images: manulera/opencloningfrontend | |
| - name: Build and push Docker image | |
| uses: docker/build-push-action@v6.9.0 | |
| with: | |
| context: . | |
| push: true | |
| tags: manulera/opencloningfrontend:latest | |
| labels: ${{ steps.meta.outputs.labels }} | |
| - name: Build and push Docker image | |
| uses: docker/build-push-action@v6.9.0 | |
| with: | |
| context: . | |
| push: true | |
| tags: manulera/opencloningfrontend:latest-baseurl-opencloning | |
| labels: ${{ steps.meta.outputs.labels }} | |
| build-args: | | |
| BASE_URL=/opencloning/ | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: manulera/opencloningfrontend:latest | |
| format: "table" | |
| exit-code: "0" | |
| ignore-unfixed: true | |
| vuln-type: "os,library" | |
| severity: "CRITICAL,HIGH" |