ci.yml

name: CI

on: [push]

jobs:
  editorconfig-checker:
    name: editorconfig-checker
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - uses: editorconfig-checker/action-editorconfig-checker@main
    - run: editorconfig-checker

  flake8:
    name: flake8
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Setup Python
        uses: actions/setup-python@v1
        with:
          python-version: 3.10.13
          architecture: x64
      - name: Install flake8
        run: pip install flake8
      - name: Run flake8
        uses: suo/flake8-github-action@releases/v1
        with:
          checkName: 'flake8'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  markdown-lint:
    name: markdown-lint
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - run: npx markdown-cli *.md

  unittest:
    name: unittest
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Setup Python
        uses: actions/setup-python@v1
        with:
          python-version: 3.10.13
          architecture: x64
      - name: Execute Unit Tests
        run: python3 -m unittest src/test_task_manager.py

  sonar-cloud:
    needs: [editorconfig-checker, markdown-lint, flake8, unittest]
    name: sonar-cloud
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      - name: Setup Python
        uses: actions/setup-python@v2
        with:
          python-version: ${{ matrix.python }}
      - name: Install tox and any other packages
        run: pip install tox
      - name: Run tox
        run: tox -e py
      - name: SonarCloud Scan
        uses: sonarsource/sonarcloud-github-action@master
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          organization: anailieva
          project: anailieva_task-manager

  snyk:
    needs: [editorconfig-checker, markdown-lint, flake8, unittest]
    name: snyk
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      - name: Snyk test
        working-directory: ./src/
        run: |
          npm install -g snyk
          pip install -r requirements.txt
          snyk test
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

  gitleaks:
    needs: [editorconfig-checker, markdown-lint, flake8, unittest]
    name: gitleaks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  sql:
    needs: [sonar-cloud, snyk, gitleaks]
    name: sql
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres
        env:
          POSTGRES_DB: db
          POSTGRES_USER: user
          POSTGRES_PASSWORD: password
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    steps:
      - uses: actions/checkout@v2
      - uses: joshuaavalon/flyway-action@v3.0.0
        with:
          url: jdbc:postgresql://postgres:5432/db
          user: user
          password: password

  docker-build:
    needs: [sql]
    name: docker-build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      - name: Build docker image
        uses: docker/build-push-action@v3
        with:
          push: false
          tags: anailieva/python:latest

  trivy:
    needs: [sql]
    name: trivy
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'anailieva/python:latest'
          format: 'table'
          exit-code: '1'
          severity: 'CRITICAL'

  docker-push:
    needs: [trivy, docker-build]
    name: docker-push
    runs-on: ubuntu-latest
    permissions:
      packages: write
    steps:
      - name: Login to DockerHub
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Push docker image
        uses: docker/build-push-action@v3
        with:
          push: true
          tags: anailieva/python:latest