build(deps): update pytest requirement from >=9.1.0 to >=9.1.1 in /tests #32

Workflow file for this run

.github/workflows/docker-build.yml at ba5e45d

	name: Build and Push Docker Image

	env:
	DOCKERHUB_USER: devopsiaci
	DOCKERHUB_REPO: powerpipe
	GHCR_REGISTRY: ghcr.io
	GHCR_REPO: ${{ github.repository }}

	on:
	workflow_dispatch:
	push:
	branches:
	- main
	pull_request:
	branches:
	- main

	jobs:
	test:
	name: Test
	runs-on: ubuntu-latest
	permissions:
	contents: read
	security-events: write
	steps:
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

	- name: Lint Dockerfile
	uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
	with:
	dockerfile: Dockerfile
	config: .hadolint.yaml

	- name: Unit tests
	run: \|
	pip install -r tests/requirements.txt
	python3 -m pytest tests/ \
	--cov=compare_snapshots \
	--cov-report=term-missing \
	--cov-fail-under=90

	- name: Build test image
	uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
	with:
	context: .
	load: true
	tags: powerpipe:test

	- name: Smoke test
	run: \|
	docker run --rm powerpipe:test powerpipe --version

	- name: Container structure tests
	run: \|
	docker run --rm \
	-v "$PWD/structure-tests.yaml:/structure-tests.yaml:ro" \
	-v /var/run/docker.sock:/var/run/docker.sock \
	gcr.io/gcp-runtimes/container-structure-test:latest \
	test --image powerpipe:test --config /structure-tests.yaml

	- name: Security scan (Trivy)
	uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
	with:
	image-ref: powerpipe:test
	format: sarif
	output: trivy-results.sarif
	exit-code: "1"
	severity: CRITICAL
	ignore-unfixed: true

	- name: Upload Trivy SARIF results
	if: always()
	uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
	with:
	sarif_file: trivy-results.sarif

	behavior-check:
	name: Behavior Check
	if: github.event_name == 'pull_request'
	runs-on: ubuntu-latest
	permissions:
	contents: read
	pull-requests: write
	steps:
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

	- name: Detect version change
	id: version
	run: \|
	git fetch origin ${{ github.base_ref }} --depth=1
	OLD_VERSION=$(git show origin/${{ github.base_ref }}:Dockerfile 2>/dev/null \| grep -oP 'ARG POWERPIPE_VERSION=\K.*' \|\| echo "")
	NEW_VERSION=$(grep -oP 'ARG POWERPIPE_VERSION=\K.*' Dockerfile)
	echo "old=$OLD_VERSION" >> "$GITHUB_OUTPUT"
	echo "new=$NEW_VERSION" >> "$GITHUB_OUTPUT"
	if [ "$OLD_VERSION" != "$NEW_VERSION" ]; then
	echo "changed=true" >> "$GITHUB_OUTPUT"
	echo "Version change detected: $OLD_VERSION → $NEW_VERSION"
	else
	echo "changed=false" >> "$GITHUB_OUTPUT"
	echo "No version change"
	fi

	- name: Build test image
	if: steps.version.outputs.changed == 'true'
	uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
	with:
	context: .
	load: true
	tags: powerpipe:test

	- name: Extract CLI snapshot
	if: steps.version.outputs.changed == 'true'
	run: \|
	docker run --rm --network none \
	-v "$PWD/scripts:/scripts:ro" \
	powerpipe:test bash /scripts/extract-cli-snapshot.sh > /tmp/cli-snapshot-new.json

	- name: Extract env vars from upstream source
	if: steps.version.outputs.changed == 'true'
	run: \|
	ENV_VARS=$(bash scripts/extract-env-vars.sh "${{ steps.version.outputs.new }}")
	jq --argjson env_vars "$ENV_VARS" '. + {env_vars: $env_vars}' /tmp/cli-snapshot-new.json > /tmp/cli-snapshot-full.json

	- name: Compare snapshots
	id: diff
	if: steps.version.outputs.changed == 'true'
	run: \|
	python3 scripts/compare_snapshots.py \
	cli-snapshot.json /tmp/cli-snapshot-full.json \
	--output-md /tmp/behavior-diff.md \
	--output-json /tmp/behavior-diff.json \
	&& echo "has_changes=false" >> "$GITHUB_OUTPUT" \
	\|\| echo "has_changes=true" >> "$GITHUB_OUTPUT"

	- name: Comment on PR
	if: steps.version.outputs.changed == 'true'
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	with:
	script: \|
	const fs = require('fs');
	const md = fs.readFileSync('/tmp/behavior-diff.md', 'utf8');
	const marker = '<!-- behavior-check -->';

	// Find and update existing comment, or create new one
	const { data: comments } = await github.rest.issues.listComments({
	owner: context.repo.owner,
	repo: context.repo.repo,
	issue_number: context.issue.number,
	});
	const existing = comments.find(c => c.body.includes(marker));

	const body = `${marker}\n${md}`;
	if (existing) {
	await github.rest.issues.updateComment({
	owner: context.repo.owner,
	repo: context.repo.repo,
	comment_id: existing.id,
	body,
	});
	} else {
	await github.rest.issues.createComment({
	owner: context.repo.owner,
	repo: context.repo.repo,
	issue_number: context.issue.number,
	body,
	});
	}

	release:
	name: Release
	needs: [test]
	if: github.event_name != 'pull_request'
	runs-on: ubuntu-latest
	permissions:
	attestations: write
	artifact-metadata: write
	contents: write
	id-token: write
	packages: write

	steps:
	- name: Checkout
	uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
	with:
	fetch-depth: 0

	- name: Get Powerpipe version
	id: version
	run: \|
	VERSION=$(grep -oP 'ARG POWERPIPE_VERSION=\K.*' Dockerfile)
	TAG="v${VERSION}"
	echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"
	echo "tag=${TAG}" >> "${GITHUB_OUTPUT}"
	if git rev-parse "${TAG}" >/dev/null 2>&1; then
	echo "is_new=false" >> "${GITHUB_OUTPUT}"
	echo "Tag ${TAG} already exists — skipping release"
	else
	echo "is_new=true" >> "${GITHUB_OUTPUT}"
	echo "New version detected: ${TAG}"
	fi

	- name: Create release tag
	if: steps.version.outputs.is_new == 'true'
	run: \|
	git config user.name "github-actions[bot]"
	git config user.email "github-actions[bot]@users.noreply.github.com"
	git tag -a "${{ steps.version.outputs.tag }}" \
	-m "Release ${{ steps.version.outputs.tag }}"
	git push origin "${{ steps.version.outputs.tag }}"
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	- name: Create GitHub Release
	if: steps.version.outputs.is_new == 'true'
	run: \|
	gh release create "${{ steps.version.outputs.tag }}" \
	--title "${{ steps.version.outputs.tag }}" \
	--generate-notes \
	--latest
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	- name: Set Docker metadata
	id: meta
	if: steps.version.outputs.is_new == 'true'
	uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
	with:
	images: \|
	${{ env.DOCKERHUB_USER }}/${{ env.DOCKERHUB_REPO }}
	${{ env.GHCR_REGISTRY }}/${{ env.GHCR_REPO }}
	labels: \|
	org.opencontainers.image.maintainer='amartingarcia,ialejandro'
	org.opencontainers.image.title='Powerpipe'
	org.opencontainers.image.description='Powerpipe — Dashboards for DevOps'
	org.opencontainers.image.vendor='devops-ia'
	tags: \|
	type=raw,value=${{ steps.version.outputs.tag }}

	- name: Set up QEMU
	if: steps.version.outputs.is_new == 'true'
	uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0

	- name: Set up Docker Buildx
	if: steps.version.outputs.is_new == 'true'
	uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

	- name: Cache Docker layers
	if: steps.version.outputs.is_new == 'true'
	uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
	with:
	path: /tmp/.buildx-cache
	key: ${{ runner.os }}-buildx-${{ github.sha }}
	restore-keys: \|
	${{ runner.os }}-buildx-

	- name: "[DOCKERHUB] Log in"
	if: steps.version.outputs.is_new == 'true'
	uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
	with:
	username: ${{ secrets.DOCKERHUB_USERNAME }}
	password: ${{ secrets.DOCKERHUB_PASSWORD }}

	- name: "[GHCR] Log in"
	if: steps.version.outputs.is_new == 'true'
	continue-on-error: true
	uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
	with:
	registry: ${{ env.GHCR_REGISTRY }}
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}

	- name: Build and push Docker image
	id: push
	if: steps.version.outputs.is_new == 'true'
	uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
	with:
	cache-from: type=local,src=/tmp/.buildx-cache
	cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
	context: .
	labels: ${{ steps.meta.outputs.labels }}
	platforms: linux/amd64,linux/arm64
	push: true
	sbom: true
	tags: ${{ steps.meta.outputs.tags }}

	- name: "[DOCKERHUB] Update registry description"
	if: steps.version.outputs.is_new == 'true'
	uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
	with:
	username: ${{ secrets.DOCKERHUB_USERNAME }}
	password: ${{ secrets.DOCKERHUB_PASSWORD }}
	repository: ${{ env.DOCKERHUB_USER }}/${{ env.DOCKERHUB_REPO }}

	- name: "[GHCR] Generate artifact attestation"
	if: steps.version.outputs.is_new == 'true'
	continue-on-error: true
	uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
	with:
	subject-name: ${{ env.GHCR_REGISTRY }}/${{ env.GHCR_REPO }}
	subject-digest: ${{ steps.push.outputs.digest }}
	push-to-registry: true

	- name: Move Docker cache
	if: steps.version.outputs.is_new == 'true'
	run: \|
	rm -rf /tmp/.buildx-cache
	mv /tmp/.buildx-cache-new /tmp/.buildx-cache

Navigation Menu

Uh oh!

build(deps): update pytest requirement from >=9.1.0 to >=9.1.1 in /tests #32

Workflow file

build(deps): update pytest requirement from >=9.1.0 to >=9.1.1 in /tests #32

Uh oh!

Workflow file for this run