Bump docker/build-push-action from 7.2.0 to 7.3.0 #147
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| workflow_dispatch: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - v* | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| build: | |
| name: Build | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Run build action | |
| uses: minvws/action-python-poetry-install@2a1cbf8c2270c5fec60acdbfebae3c072c27f1cb # v1.0.2 | |
| with: | |
| python_version: "3.14" | |
| lint: | |
| name: Run code linter | |
| runs-on: ubuntu-24.04 | |
| needs: build | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Run build action | |
| uses: minvws/action-python-poetry-install@2a1cbf8c2270c5fec60acdbfebae3c072c27f1cb # v1.0.2 | |
| with: | |
| python_version: "3.14" | |
| - name: Lint | |
| run: poetry run ruff check --select E4,E7,E9,F,I,Q | |
| - name: Lint | |
| run: poetry run ruff check --select E4,E7,E9,F,I,Q | |
| type-check: | |
| name: Check static types | |
| runs-on: ubuntu-24.04 | |
| needs: build | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Run build action | |
| uses: minvws/action-python-poetry-install@2a1cbf8c2270c5fec60acdbfebae3c072c27f1cb # v1.0.2 | |
| with: | |
| python_version: "3.14" | |
| - name: Check static types | |
| run: poetry run mypy app tests | |
| safety-check: | |
| name: Scan packages for vulnerabilities | |
| runs-on: ubuntu-24.04 | |
| needs: build | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Run build action | |
| uses: minvws/action-python-poetry-install@2a1cbf8c2270c5fec60acdbfebae3c072c27f1cb # v1.0.2 | |
| with: | |
| python_version: "3.14" | |
| - name: Scan packages for vulnerabilities | |
| run: poetry run pip-audit | |
| spelling-check: | |
| name: Run spelling check | |
| runs-on: ubuntu-24.04 | |
| needs: build | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Run build action | |
| uses: minvws/action-python-poetry-install@2a1cbf8c2270c5fec60acdbfebae3c072c27f1cb # v1.0.2 | |
| with: | |
| python_version: "3.14" | |
| - uses: codespell-project/codespell-problem-matcher@9ba2c57125d4908eade4308f32c4ff814c184633 # v1.2.0 | |
| - name: Run spelling check | |
| run: poetry run codespell . | |
| editorconfig-checker: | |
| name: format check editorconfig | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Check out code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Set up editorconfig-checker | |
| uses: editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c #v2.2.0 | |
| - name: Run editorconfig-checker | |
| run: editorconfig-checker --exclude "\\.py$" | |
| test: | |
| name: Run the tests | |
| runs-on: ubuntu-24.04 | |
| needs: build | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Run build action | |
| uses: minvws/action-python-poetry-install@2a1cbf8c2270c5fec60acdbfebae3c072c27f1cb # v1.0.2 | |
| with: | |
| python_version: "3.14" | |
| - name: install dependencies | |
| run: | | |
| sudo apt update | |
| sudo apt install -y libpq-dev build-essential postgresql-client | |
| - name: install liboprf | |
| run: | | |
| sudo apt install -y libsodium-dev | |
| git clone --depth 1 --branch v0.9.3 https://github.com/stef/liboprf.git | |
| cd liboprf/src | |
| make | |
| sudo make install | |
| sudo ldconfig | |
| - name: Run the tests | |
| env: | |
| FASTAPI_CONFIG_PATH: ./app.ci.conf | |
| run: | | |
| poetry run pytest --cov --cov-report=term --cov-report=xml | |
| - name: Upload coverage report | |
| uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 | |
| with: | |
| name: coverage | |
| path: coverage.xml | |
| sonar: | |
| name: SonarCloud | |
| runs-on: ubuntu-24.04 | |
| needs: test | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| fetch-depth: 0 | |
| - name: Download coverage report | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: coverage | |
| - name: Run SonarQube scan | |
| uses: minvws/action-sonarqube@v1 | |
| with: | |
| sonar-token: ${{ secrets.SONAR_TOKEN }} | |
| detect_modified_files: | |
| name: Modified files | |
| runs-on: ubuntu-24.04 | |
| outputs: | |
| image_files_changed: ${{ steps.image-files-changed.outputs.any_changed }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Check image-related file changes | |
| id: image-files-changed | |
| uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6 | |
| with: | |
| files: | | |
| docker/Dockerfile | |
| pyproject.toml | |
| poetry.lock | |
| .github/workflows/ci.yaml | |
| image_build_scan_push: | |
| name: Build, scan, and push Docker image | |
| runs-on: ubuntu-24.04 | |
| needs: [build, lint, type-check, safety-check, spelling-check, test, detect_modified_files] | |
| # Only run this job on main branch, version tags, or if image-related files have changed | |
| if: | | |
| github.ref == 'refs/heads/main' || | |
| startsWith(github.ref, 'refs/tags/v') || | |
| needs.detect_modified_files.outputs.image_files_changed == 'true' | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Log in to the Container registry | |
| uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Create version.json | |
| run: | | |
| RELEASE_VERSION="${GITHUB_REF#refs/*/}" | |
| echo "RELEASE_VERSION=$RELEASE_VERSION" >> $GITHUB_ENV | |
| echo "{ \"version\": \"${RELEASE_VERSION}\", \"git_ref\": \"$GITHUB_SHA\"}" > version.json | |
| - name: Extract metadata (tags, labels) for Docker | |
| id: meta | |
| uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0 | |
| with: | |
| images: ghcr.io/${{ github.repository }} | |
| - name: Build Docker image | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| env: | |
| NEW_UID: 1000 | |
| NEW_GID: 1000 | |
| with: | |
| context: . | |
| file: docker/Dockerfile | |
| push: false | |
| load: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| build-args: | | |
| NEW_UID=${{ env.NEW_UID }} | |
| NEW_GID=${{ env.NEW_GID }} | |
| standalone=true | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }} | |
| format: "sarif" | |
| output: "trivy-results.sarif" | |
| exit-code: "0" | |
| severity: "CRITICAL,HIGH" | |
| vuln-type: "library" | |
| # Re-enable if Code security tab upload is enabled by OPS | |
| # - name: Upload Trivy scan results to GitHub Security tab | |
| # uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0 | |
| # # Only upload SARIF results on main branch or version tags | |
| # if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v') | |
| # with: | |
| # sarif_file: "trivy-results.sarif" | |
| - name: Fail build on vulnerabilities | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }} | |
| format: "table" | |
| exit-code: ${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')) && '0' || '1' }} | |
| severity: "CRITICAL,HIGH" | |
| vuln-type: "library" | |
| skip-setup-trivy: true | |
| - name: Push Docker image | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v') | |
| env: | |
| NEW_UID: 1000 | |
| NEW_GID: 1000 | |
| with: | |
| context: . | |
| file: docker/Dockerfile | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| build-args: | | |
| NEW_UID=${{ env.NEW_UID }} | |
| NEW_GID=${{ env.NEW_GID }} | |
| standalone=true |