⬆️ [open-formulieren/formio-renderer#337] Update formio-build… #21316

Workflow file for this run

	name: Run CI

	# Run this workflow every time a new commit pushed to your repository
	on:
	push:
	branches:
	- main
	- stable/*
	tags:
	- '*'
	pull_request:
	workflow_dispatch:
	schedule:
	- cron: '30 7 * * *'

	permissions: {}

	env:
	IMAGE_NAME: openformulieren/open-forms
	DJANGO_SETTINGS_MODULE: openforms.conf.ci
	TEST_REPORT_RANDOM_STATE: 'true'
	OTEL_SERVICE_NAME: openforms-ci

	jobs:

	setup:
	name: Set up the build variables
	runs-on: ubuntu-latest
	outputs:
	# see https://github.com/orgs/community/discussions/26671
	image-name: ${{ steps.envars-to-outputs.outputs.image-name }}
	version: ${{ steps.vars.outputs.version }}
	git_hash: ${{ steps.vars.outputs.git_hash }}
	sdk-version: ${{ steps.sdk-vars.outputs.sdk-version }}
	sdk-ref: ${{ steps.sdk-vars.outputs.sdk-ref }}
	steps:
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
	with:
	persist-credentials: false
	- name: Set output with default values
	id: envars-to-outputs
	run: \|
	echo "image-name=${{ env.IMAGE_NAME }}" >> $GITHUB_OUTPUT
	- name: Extract version info
	id: vars
	uses: maykinmedia/open-api-workflows/actions/extract-version@0a5525c13f8eea10be40c8eaee5e535ea3a10721 # v6.4.1
	- name: Extract SDK version info
	id: sdk-vars
	uses: ./.github/actions/extract-sdk-version
	with:
	backend-version: ${{ steps.vars.outputs.version }}

	tests:
	name: Run the Django test suite
	runs-on: ubuntu-latest

	services:
	postgres:
	image: postgres:15
	env:
	POSTGRES_HOST_AUTH_METHOD: trust
	ports:
	- 5432:5432
	# Needed because the postgres container does not provide a healthcheck
	options:
	--health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
	--name postgres
	redis:
	image: redis:8
	ports:
	- 6379:6379
	steps:
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
	with:
	persist-credentials: false
	submodules: true
	- name: Set up backend environment
	uses: ./.github/actions/setup-backend

	- name: Start CI docker services
	run: \|
	docker compose -f docker-compose.ci.yml up -d
	working-directory: docker

	- name: Run tests
	run: \|
	echo "# Profiling stats" >> $GITHUB_STEP_SUMMARY
	echo "" >> $GITHUB_OUTPUT

	python src/manage.py compilemessages
	python src/manage.py collectstatic --noinput --link
	mkdir private_media
	coverage run \
	--concurrency=multiprocessing \
	--parallel-mode \
	src/manage.py test src \
	--force-color \
	--parallel 4 \
	--exclude-tag=e2e \
	--verbosity 2
	coverage combine

	env:
	SECRET_KEY: dummy
	DB_USER: postgres
	DB_PASSWORD: ''
	DEBUG: 'true'
	# deliberatey broken
	CELERY_BROKER_URL: 'redis://bad-host:6379/0'
	# specified explicitly, since the broker URL is broken, but the once backend
	# needs to be available even with CELERY_TASK_ALWAYS_EAGER
	CELERY_ONCE_REDIS_URL: 'redis://localhost:6379/0'

	- name: Run JS tests
	run: npm test

	- name: Publish coverage report
	uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
	with:
	token: ${{ secrets.CODECOV_TOKEN }}

	- name: Check that private-media tests are properly isolated
	run: \|
	num_private_media_files=$(find private_media -type f \| wc -l)
	if [[ "$num_private_media_files" == "0" ]]; then
	exit 0
	else
	echo "# Writes to private_media detected!" >> $GITHUB_STEP_SUMMARY
	echo "$num_private_media_files were written into the private media storage, while tests should not leave any files." >> $GITHUB_STEP_SUMMARY
	echo "" >> $GITHUB_STEP_SUMMARY
	echo "Files:" >> $GITHUB_STEP_SUMMARY
	find private_media -type f >> $GITHUB_STEP_SUMMARY
	exit 1
	fi

	tests-reverse:
	name: Run the Django test suite in reverse
	runs-on: ubuntu-latest

	services:
	postgres:
	image: postgres:15
	env:
	POSTGRES_HOST_AUTH_METHOD: trust
	ports:
	- 5432:5432
	# Needed because the postgres container does not provide a healthcheck
	options:
	--health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
	--name postgres
	redis:
	image: redis:6
	ports:
	- 6379:6379
	steps:
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
	with:
	persist-credentials: false
	submodules: true
	- name: Set up backend environment
	uses: ./.github/actions/setup-backend

	- name: Start CI docker services
	run: \|
	docker compose -f docker-compose.ci.yml up -d
	working-directory: docker

	- name: Run tests
	run: \|
	python src/manage.py compilemessages
	python src/manage.py collectstatic --noinput --link
	mkdir private_media
	src/manage.py test src \
	--force-color \
	--parallel 4 \
	--exclude-tag=e2e \
	--reverse

	env:
	PYTHONOPTIMIZE: '1' # skip 'assert' execution
	SECRET_KEY: dummy
	DB_USER: postgres
	DB_PASSWORD: ''
	DEBUG: 'true'

	i18n-check:
	name: Check i18n messages extracted
	runs-on: ubuntu-latest

	steps:
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
	with:
	persist-credentials: false
	- uses: open-formulieren/actions/check-message-extraction@c3a381fb81dde99084eaeeb861bb95a433b1a535 # v1.1
	with:
	paths: src/openforms/js/{compiled-lang,lang}
	extraction-command: ./bin/makemessages_js.sh
	compilation-command: ./bin/compilemessages_js.sh

	# Only actually does anything in release/* branches or for pushed tags
	- uses: open-formulieren/actions/check-missing-translations@c3a381fb81dde99084eaeeb861bb95a433b1a535 # v1.1
	with:
	messages-path: src/openforms/js/lang
	locales: nl

	e2etests:
	runs-on: ubuntu-24.04
	needs: setup

	if: "${{ !( (github.event_name == 'push' && contains(github.event.head_commit.message, '[skip: e2e]')) \|\| (github.event_name == 'pull_request' && contains(github.event.pull_request.body, '[skip: e2e]')) ) }}"

	strategy:
	fail-fast: false
	matrix:
	browser:
	- chromium
	- firefox
	- webkit

	name: End-to-end tests, ${{ matrix.browser }}

	services:
	postgres:
	image: postgres:15
	env:
	POSTGRES_HOST_AUTH_METHOD: trust
	ports:
	- 5432:5432
	# Needed because the postgres container does not provide a healthcheck
	options:
	--health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
	--name postgres
	redis:
	image: redis:6
	ports:
	- 6379:6379
	steps:
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
	with:
	persist-credentials: false
	- name: Set up backend environment
	uses: ./.github/actions/setup-backend

	- name: Install playwright deps
	run: playwright install --with-deps ${{ matrix.browser }}

	- name: Extract SDK files from SDK docker image
	run: \|
	container_id=$(docker create openformulieren/open-forms-sdk:${NEEDS_SETUP_OUTPUTS_SDK_VERSION})
	docker cp $container_id:/sdk ./src/openforms/static/
	docker rm -v $container_id
	env:
	NEEDS_SETUP_OUTPUTS_SDK_VERSION: ${{ needs.setup.outputs.sdk-version }}

	- name: Run testsuite
	run: \|
	python src/manage.py compilemessages
	python src/manage.py collectstatic --noinput --link
	src/manage.py test src --force-color --tag=e2e
	env:
	SECRET_KEY: dummy
	DB_USER: postgres
	DB_PASSWORD: ''
	E2E_DRIVER: ${{ matrix.browser }}
	E2E_ENABLE_TRACING: '1'
	E2E_TRACES_PATH: /tmp/playwright_traces
	SDK_RELEASE: ${{ needs.setup.outputs.sdk-version }}

	- name: Upload playwright traces artifact on failure
	if: ${{ failure() }}
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: playwright-traces-${{ matrix.browser }}
	path: /tmp/playwright_traces
	retention-days: 1

	docs:
	name: Build and check documentation
	runs-on: ubuntu-latest
	needs: setup

	steps:
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
	with:
	persist-credentials: false
	path: open-forms

	- name: Set up backend environment
	uses: ./open-forms/.github/actions/setup-backend
	with:
	setup-node: 'no'
	optimize-postgres: 'no'
	working-directory: 'open-forms'

	- name: Checkout SDK repository
	uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
	with:
	persist-credentials: false
	repository: 'open-formulieren/open-forms-sdk'
	ref: ${{ needs.setup.outputs.sdk-ref }}
	path: open-forms-sdk

	- name: Setup symlinks
	run: \|
	ln -s $(pwd)/open-forms-sdk/CHANGELOG.rst open-forms/docs/changelog-sdk.rst

	- name: Build docs
	run: \|
	export OPENSSL_CONF=$(pwd)/openssl.conf
	make SPHINXOPTS="-W" html
	working-directory: open-forms/docs
	env:
	FORCE_COLOR: "1"

	docker_build:
	needs: setup
	strategy:
	matrix:
	# KEEP IN SYNC WITH docker_push JOB
	target:
	- env: production
	extensions: ''
	image-tag-prefix: ''
	- env: extensions
	extensions: 'token_exchange,prefill_haalcentraalhr'
	image-tag-prefix: 'all-extensions-'
	uses: ./.github/workflows/build-image.yml
	with:
	# see https://github.com/orgs/community/discussions/26671
	image-name: ${{ needs.setup.outputs.image-name }}
	image-tag-prefix: ${{ matrix.target.image-tag-prefix }}
	version: ${{ needs.setup.outputs.version }}
	git-hash: ${{ needs.setup.outputs.git_hash }}
	target-env: ${{ matrix.target.env }}
	extensions: ${{ matrix.target.extensions }}

	image_scan:
	runs-on: ubuntu-latest
	name: Scan docker image
	needs:
	- setup
	- docker_build

	permissions:
	security-events: write

	steps:
	# So the scanner gets commit meta-information
	- name: Checkout code
	uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
	with:
	persist-credentials: false

	- name: Download built image
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	name: docker-image-all-extensions-${{ needs.setup.outputs.version }}

	- name: Scan image with Trivy
	uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
	with:
	input: ${{ github.workspace }}/image.tar # from download-artifact
	format: 'sarif'
	output: 'trivy-results-docker.sarif'
	ignore-unfixed: true
	env:
	# Uses the cache from trivy.yml workflow
	TRIVY_SKIP_DB_UPDATE: true
	TRIVY_SKIP_JAVA_DB_UPDATE: true

	- name: Upload results to GH Security tab
	uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
	with:
	sarif_file: 'trivy-results-docker.sarif'

	upgrade_simulation:
	needs:
	- setup
	- docker_build
	env:
	RUN_SETUP_CONFIG: "False" # Disable running the setup_configuration
	name: Simulate upgrading instances
	runs-on: ubuntu-latest
	strategy:
	matrix:
	start:
	- '3.5.5'
	- '3.5.7'

	steps:
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
	with:
	persist-credentials: false
	- name: Download built image
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	name: docker-image-${{ needs.setup.outputs.version }}
	- name: Load image
	run: docker image load -i image.tar

	- name: Pull and run old version
	run: \|
	docker compose pull
	docker compose run web \
	python src/manage.py migrate
	env:
	TAG: ${{ matrix.start }}

	- name:
	run: \|
	docker compose run -e RELEASE=${RELEASE} web \
	python src/manage.py migrate
	# run fix scripts to verify they don't crash
	docker compose run -e RELEASE=${RELEASE} web \
	/app/bin/test_fix_scripts.sh
	env:
	RELEASE: '4.0.0'
	# ensure local image gets used
	TAG: ${{ needs.setup.outputs.version }}

	# oas:
	# name: OAS
	# uses: maykinmedia/open-api-workflows/.github/workflows/oas.yml@0a5525c13f8eea10be40c8eaee5e535ea3a10721 # v6.4.1
	# with:
	# python-version: '3.12'
	# apt-packages: 'libxml2 libxmlsec1 libxmlsec1-openssl gdal-bin'
	# django-settings-module: openforms.conf.ci
	# oas-generate-command: ./bin/generate_oas.sh
	# schema-path: src/openapi.yaml
	# oas-artifact-name: open-forms-oas
	# node-version-file: '.nvmrc'
	# spectral-version: '^6.15.0'
	# openapi-to-postman-version: '^5.0.0'
	# postman-artifact-name: open-forms-postman-collection
	# openapi-generator-version: '^2.20.0'

	docker_push:
	needs:
	- tests
	- i18n-check
	- e2etests
	- setup
	- docker_build
	# - oas

	name: Push Docker image
	runs-on: ubuntu-latest
	if: github.event_name == 'push' # Exclude PRs

	permissions:
	contents: read
	packages: write
	attestations: write
	id-token: write

	strategy:
	matrix:
	# KEEP IN SYNC WITH docker_build JOB
	target:
	- env: production
	image-tag-prefix: ''
	- env: extensions
	image-tag-prefix: 'all-extensions-'

	steps:
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
	with:
	persist-credentials: false

	- name: Download built image
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	name: docker-image-${{ matrix.target.image-tag-prefix }}${{ needs.setup.outputs.version }}

	- name: Load image
	run: \|
	docker image load -i image.tar

	- name: Login to GitHub Container Registry
	uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
	with:
	registry: ghcr.io
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}

	- name: Push to ghcr.io
	run: \|
	docker tag $IMAGE_NAME:$TAG ghcr.io/open-formulieren/open-forms:$TAG
	docker push ghcr.io/open-formulieren/open-forms:$TAG
	env:
	TAG: ${{ matrix.target.image-tag-prefix }}${{ needs.setup.outputs.version }}

	- name: Login to Docker Hub
	uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
	with:
	username: ${{ secrets.DOCKER_USERNAME }}
	password: ${{ secrets.DOCKER_TOKEN }}

	- name: Push the Docker image (production)
	run: docker push $IMAGE_NAME:$TAG
	env:
	TAG: ${{ matrix.target.image-tag-prefix }}${{ needs.setup.outputs.version }}

	update-docker-readme:
	needs:
	- setup
	- docker_push
	uses: ./.github/workflows/dockerhub-description.yml
	with:
	image_name: ${{ needs.setup.outputs.image-name }}
	secrets:
	DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
	DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}

Navigation Menu

Uh oh!

⬆️ [open-formulieren/formio-renderer#337] Update formio-build… #21316

Workflow file

⬆️ [open-formulieren/formio-renderer#337] Update formio-build… #21316

Uh oh!

Workflow file for this run