cloud-platform/.github/workflows/ci.yml at 712a8579e306aff60db7f4eea9f73a0197c2e229 · imane-ait/cloud-platform · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
name: CI

on:
  push:
    branches: [ main, feat/* ]
  pull_request:
    branches: [ main ]

jobs:
  lint:
    name: Lint & Format
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install dependencies
        run: |
          pip install ruff black

      - name: Run ruff
        run: ruff check app/ --ignore B008,BLE001

      - name: Run black
        run: black --check app/

  test:
    name: Tests
    runs-on: ubuntu-latest
    needs: lint

    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_USER: fleetops
          POSTGRES_PASSWORD: fleetops
          POSTGRES_DB: fleetops
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 5s
          --health-timeout 5s
          --health-retries 5

    steps:
      - uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install dependencies
        run: pip install -r requirements.txt

      - name: Run tests
        env:
          DATABASE_URL: postgresql+asyncpg://fleetops:fleetops@localhost:5432/fleetops
        run: pytest tests/ --cov=app --cov-report=term-missing

  security:
    name: Security Scan
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install security tools
        run: pip install bandit pip-audit

      - name: Run Bandit
        run: bandit -r app/ -ll

      - name: Run pip-audit
        run: |
          pip-audit -r requirements.txt \
            --ignore-vuln PYSEC-2026-161 \
            --ignore-vuln PYSEC-2026-248 \
            --ignore-vuln PYSEC-2026-249 \
            --ignore-vuln PYSEC-2026-1943 \
            --ignore-vuln PYSEC-2026-1941 \
            --ignore-vuln PYSEC-2026-2281 \
            --ignore-vuln PYSEC-2026-2280 \
            --ignore-vuln PYSEC-2026-1845
      - name: Run Gitleaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        continue-on-error: true

  trivy:
    name: Trivy Image Scan
    runs-on: ubuntu-latest
    needs: [test, security]
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4

      - name: Build image for scanning
        run: docker build -t fleetops:scan .

      - name: Run Trivy
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: fleetops:scan
          format: table
          exit-code: '0'
          severity: HIGH,CRITICAL

  sbom:
    name: Generate SBOM
    runs-on: ubuntu-latest
    needs: [test, security]
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4

      - name: Build image
        run: docker build -t fleetops:sbom .

      - name: Generate SBOM with syft
        uses: anchore/sbom-action@v0
        with:
          image: fleetops:sbom
          artifact-name: fleetops-sbom.spdx
          output-file: fleetops-sbom.spdx

      - name: Upload SBOM
        uses: actions/upload-artifact@v4
        with:
          name: fleetops-sbom
          path: fleetops-sbom.spdx
  build:
    name: Build & Push Docker Image
    runs-on: ubuntu-latest
    needs: [ test, security ]
    if: github.ref == 'refs/heads/main'

    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build and push image
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          IMAGE_TAG: ${{ github.sha }}
        run: |
          docker build -t $ECR_REGISTRY/fleetops:$IMAGE_TAG .
          docker build -t $ECR_REGISTRY/fleetops:latest .
          docker push $ECR_REGISTRY/fleetops:$IMAGE_TAG
          docker push $ECR_REGISTRY/fleetops:latest