cloud-platform/.github/workflows/ci.yml at 648c05e5bc1a168ca05089824a49f39bdbefce0f · imane-ait/cloud-platform · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
name: CI

on:
  push:
    branches: [ main, feat/* ]
  pull_request:
    branches: [ main ]

jobs:
  lint:
    name: Lint & Format
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install dependencies
        run: |
          pip install ruff black

      - name: Run ruff
        run: ruff check app/ --ignore B008

      - name: Run black
        run: black --check app/

  test:
    name: Tests
    runs-on: ubuntu-latest
    needs: lint

    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_USER: fleetops
          POSTGRES_PASSWORD: fleetops
          POSTGRES_DB: fleetops
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 5s
          --health-timeout 5s
          --health-retries 5

    steps:
      - uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install dependencies
        run: pip install -r requirements.txt

      - name: Run tests
        env:
          DATABASE_URL: postgresql+asyncpg://fleetops:fleetops@localhost:5432/fleetops
        run: pytest tests/ --cov=app --cov-report=term-missing

  security:
    name: Security Scan
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install security tools
        run: pip install bandit pip-audit

      - name: Run Bandit
        run: bandit -r app/ -ll

      - name: Run pip-audit
        run: |
          pip-audit -r requirements.txt \
            --ignore-vuln PYSEC-2026-161 \
            --ignore-vuln PYSEC-2026-248 \
            --ignore-vuln PYSEC-2026-249 \
            --ignore-vuln PYSEC-2026-1943 \
            --ignore-vuln PYSEC-2026-1941 \
            --ignore-vuln PYSEC-2026-2281 \
            --ignore-vuln PYSEC-2026-2280 \
            --ignore-vuln PYSEC-2026-1845

  build:
    name: Build & Push Docker Image
    runs-on: ubuntu-latest
    needs: [ test, security ]
    if: github.ref == 'refs/heads/main'

    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build and push image
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          IMAGE_TAG: ${{ github.sha }}
        run: |
          docker build -t $ECR_REGISTRY/fleetops:$IMAGE_TAG .
          docker build -t $ECR_REGISTRY/fleetops:latest .
          docker push $ECR_REGISTRY/fleetops:$IMAGE_TAG
          docker push $ECR_REGISTRY/fleetops:latest