Bump cryptography from 49.0.0 to 50.0.0 #531
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build | |
| on: | |
| push: | |
| branches: | |
| - develop | |
| - main | |
| - 'release/**' | |
| - 'feature/**' | |
| - 'issue/**' | |
| - 'issues/**' | |
| - 'dependabot/**' | |
| workflow_dispatch: | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }} | |
| PYTHON_VERSION: '3.12' | |
| POETRY_VERSION: '2.3.2' | |
| TERRAFORM_VERSION: '1.5.3' | |
| jobs: | |
| build: | |
| name: Build, Test, and Publish | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| packages: write | |
| id-token: write | |
| outputs: | |
| new_version: ${{ steps.build-outputs.outputs.new_version }} | |
| pyproject_name: ${{ steps.build-outputs.outputs.pyproject_name }} | |
| target_env_uppercase: ${{ steps.build-outputs.outputs.target_env_uppercase }} | |
| target_env_lowercase: ${{ steps.build-outputs.outputs.target_env_lowercase }} | |
| source: ${{ steps.build-outputs.outputs.source }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 # Needed for proper versioning | |
| - name: Setup Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| cache: 'pip' | |
| - name: Setup Poetry | |
| uses: abatilo/actions-poetry@v4 | |
| with: | |
| poetry-version: ${{ env.POETRY_VERSION }} | |
| - name: Configure Poetry | |
| run: | | |
| poetry config virtualenvs.in-project true | |
| - name: Cache Poetry dependencies | |
| uses: actions/cache@v4 | |
| with: | |
| path: .venv | |
| key: poetry-${{ runner.os }}-${{ hashFiles('**/poetry.lock') }} | |
| - name: Version Management | |
| id: versioning | |
| run: | | |
| current_version=$(poetry version -s) | |
| base_version=$(echo "$current_version" | grep -oE '^[0-9]+\.[0-9]+\.[0-9]+') | |
| pyproject_name=$(poetry version | awk '{print $1}') | |
| # Version calculation based on branch | |
| if [[ "${{ github.ref }}" =~ ^refs/heads/(issue|feature|dependabot)/ ]]; then | |
| TIMESTAMP=$(date -u +"%Y%m%d%H%M") | |
| new_version="${base_version}a${TIMESTAMP}" | |
| echo "TARGET_ENV_UPPERCASE=SIT" >> $GITHUB_ENV | |
| elif [[ "${{ github.ref }}" == "refs/heads/develop" ]]; then | |
| echo "TARGET_ENV_UPPERCASE=SIT" >> $GITHUB_ENV | |
| new_version=$(poetry version prerelease -s) | |
| elif [[ "${{ github.ref }}" =~ ^refs/heads/release/ ]]; then | |
| echo "TARGET_ENV_UPPERCASE=UAT" >> $GITHUB_ENV | |
| if [[ ${current_version} =~ rc ]]; then | |
| new_version=$(poetry version prerelease -s) | |
| else | |
| new_version="${GITHUB_REF#refs/heads/release/}rc1" | |
| fi | |
| elif [[ "${{ github.ref }}" == "refs/heads/main" ]]; then | |
| echo "TARGET_ENV_UPPERCASE=OPS" >> $GITHUB_ENV | |
| new_version=${base_version} | |
| fi | |
| echo "new_version=${new_version}" >> $GITHUB_ENV | |
| echo "pyproject_name=${pyproject_name}" >> $GITHUB_ENV | |
| poetry version ${new_version} | |
| - name: Run Snyk as a blocking step | |
| uses: snyk/actions/python@master | |
| env: | |
| SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} | |
| with: | |
| command: test | |
| args: > | |
| --org=${{ secrets.SNYK_ORG_ID }} | |
| --project-name=${{ github.repository }} | |
| --severity-threshold=high | |
| --fail-on=all | |
| - name: Run Snyk on Python | |
| uses: snyk/actions/python@master | |
| env: | |
| SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} | |
| with: | |
| command: monitor | |
| args: > | |
| --org=${{ secrets.SNYK_ORG_ID }} | |
| --project-name=${{ github.repository }} | |
| - name: Run Poetry | |
| run: | | |
| poetry build | |
| poetry install | |
| poetry run pylint podaac | |
| poetry run flake8 podaac | |
| poetry run pytest --junitxml=build/reports/pytest.xml --cov=podaac/ --cov-report=html -m "not aws and not integration" tests/ | |
| - name: Quick check for changes | |
| id: check_changes | |
| if: | | |
| github.ref == 'refs/heads/develop' || | |
| github.ref == 'refs/heads/main' || | |
| startsWith(github.ref, 'refs/heads/release') | |
| run: | | |
| if [ -n "$(git status --porcelain)" ]; then | |
| echo "changes=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "changes=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Commit Version Bump | |
| # If building develop, a release branch, or main then we commit the version bump back to the repo | |
| if: steps.check_changes.outputs.changes == 'true' | |
| run: | | |
| git config user.name "${GITHUB_ACTOR}" | |
| git config user.email "${GITHUB_ACTOR}@users.noreply.github.com" | |
| git commit -am "/version ${{ env.new_version }}" | |
| git push | |
| - name: Push Tag | |
| env: | |
| VERSION: ${{ env.new_version }} | |
| if: | | |
| github.ref == 'refs/heads/develop' || | |
| github.ref == 'refs/heads/main' || | |
| startsWith(github.ref, 'refs/heads/release') | |
| run: | | |
| git config user.name "${GITHUB_ACTOR}" | |
| git config user.email "${GITHUB_ACTOR}@users.noreply.github.com" | |
| git tag -a "${VERSION}" -m "Version ${VERSION}" | |
| git push origin "${VERSION}" | |
| - name: Create Zip release | |
| run: | | |
| cd terraform | |
| zip -r ../tig-terraform-${{ env.new_version }}.zip * | |
| - name: Upload Release Artifacts | |
| if: | | |
| github.ref == 'refs/heads/develop' || | |
| github.ref == 'refs/heads/main' || | |
| startsWith(github.ref, 'refs/heads/release') || | |
| github.event.head_commit.message == '/deploy sit' || | |
| github.event.head_commit.message == '/deploy uat' | |
| uses: ncipollo/release-action@v1 | |
| with: | |
| tag: ${{ env.new_version }} | |
| artifacts: "*.zip" | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| body: "Version ${{ env.new_version }}" | |
| makeLatest: "${{ github.ref == 'refs/heads/main' }}" | |
| prerelease: "${{ github.ref != 'refs/heads/main' }}" | |
| - name: Publish to test.pypi.org | |
| id: pypi-test-publish | |
| if: | | |
| github.ref == 'refs/heads/develop' || | |
| startsWith(github.ref, 'refs/heads/release') || | |
| github.event.head_commit.message == '/deploy sit' || | |
| github.event.head_commit.message == '/deploy uat' | |
| uses: pypa/gh-action-pypi-publish@release/v1 | |
| with: | |
| repository-url: https://test.pypi.org/legacy/ | |
| - name: Publish to pypi.org | |
| if: | | |
| github.ref == 'refs/heads/main' | |
| id: pypi-publish | |
| uses: pypa/gh-action-pypi-publish@release/v1 | |
| - name: Wait for package | |
| if: | | |
| github.ref == 'refs/heads/develop' || | |
| github.ref == 'refs/heads/main' || | |
| startsWith(github.ref, 'refs/heads/release/') || | |
| github.event.head_commit.message == '/deploy sit' || | |
| github.event.head_commit.message == '/deploy uat' | |
| run: | | |
| pip install tenacity logging | |
| python3 ${GITHUB_WORKSPACE}/.github/workflows/wait-for-pypi.py ${{env.pyproject_name}}[harmony]==${{ env.new_version }} | |
| - name: Deploy Env Override | |
| if: | | |
| github.event.head_commit.message == '/deploy sit' || | |
| github.event.head_commit.message == '/deploy uat' | |
| run: | | |
| message="${{ github.event.head_commit.message }}" | |
| trimmed_message=${message:1} # Remove leading slash | |
| override_env=$(echo "$trimmed_message" | grep -oE '[^[:space:]]+$') | |
| override_env_upper=$(echo "$trimmed_message" | awk '{print toupper($NF)}') | |
| echo "THE_ENV=${override_env}" >> $GITHUB_ENV | |
| echo "TARGET_ENV_UPPERCASE=${override_env_upper}" >> $GITHUB_ENV | |
| - name: Lower Case Target Env | |
| run: | | |
| original_env_value="${TARGET_ENV_UPPERCASE}" | |
| lowercase_value=$(echo "${original_env_value}" | tr '[:upper:]' '[:lower:]') | |
| echo "TARGET_ENV_LOWERCASE=${lowercase_value}" >> $GITHUB_ENV | |
| - name: Set Build Source | |
| id: set-source | |
| run: | | |
| # Use test PyPI package format (Dockerfile will find it via extra-index-url) | |
| echo "SOURCE=${{ env.pyproject_name }}==${{ env.new_version }}" >> $GITHUB_ENV | |
| - name: Set build outputs | |
| id: build-outputs | |
| run: | | |
| echo "new_version=${{ env.new_version }}" >> $GITHUB_OUTPUT | |
| echo "pyproject_name=${{ env.pyproject_name }}" >> $GITHUB_OUTPUT | |
| echo "target_env_uppercase=${{ env.TARGET_ENV_UPPERCASE }}" >> $GITHUB_OUTPUT | |
| echo "target_env_lowercase=${{ env.TARGET_ENV_LOWERCASE }}" >> $GITHUB_OUTPUT | |
| echo "source=${{ env.SOURCE }}" >> $GITHUB_OUTPUT | |
| - name: Upload terraform zip artifact | |
| if: | | |
| github.ref == 'refs/heads/develop' || | |
| github.ref == 'refs/heads/main' || | |
| startsWith(github.ref, 'refs/heads/release') || | |
| github.event.head_commit.message == '/deploy sit' || | |
| github.event.head_commit.message == '/deploy uat' | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: terraform-zip | |
| path: tig-terraform-${{ env.new_version }}.zip | |
| retention-days: 1 | |
| deploy: | |
| name: Deploy Docker and Terraform | |
| runs-on: ubuntu-24.04-arm | |
| needs: build | |
| if: | | |
| github.ref == 'refs/heads/develop' || | |
| github.ref == 'refs/heads/main' || | |
| startsWith(github.ref, 'refs/heads/release') || | |
| github.event.head_commit.message == '/deploy sit' || | |
| github.event.head_commit.message == '/deploy uat' | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set deployment variables from build outputs | |
| run: | | |
| echo "NEW_VERSION=${{ needs.build.outputs.new_version }}" >> $GITHUB_ENV | |
| echo "PYPROJECT_NAME=${{ needs.build.outputs.pyproject_name }}" >> $GITHUB_ENV | |
| echo "TARGET_ENV_UPPERCASE=${{ needs.build.outputs.target_env_uppercase }}" >> $GITHUB_ENV | |
| echo "TARGET_ENV_LOWERCASE=${{ needs.build.outputs.target_env_lowercase }}" >> $GITHUB_ENV | |
| echo "SOURCE=${{ needs.build.outputs.source }}" >> $GITHUB_ENV | |
| - name: Log in to the Container registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata (tags, labels) for Docker | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| flavor: | | |
| latest=${{ github.ref == 'refs/heads/main' }} | |
| tags: | | |
| type=pep440,pattern={{version}},value=${{ env.NEW_VERSION }} | |
| type=raw,value=${{ env.TARGET_ENV_LOWERCASE }} | |
| - name: Build and Push Docker Image | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: ./docker/lambdaDockerfileArm | |
| push: true | |
| pull: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| platforms: linux/arm64 | |
| build-args: | | |
| SOURCE=${{ env.SOURCE }} | |
| - name: Setup Terraform | |
| uses: hashicorp/setup-terraform@v3 | |
| with: | |
| terraform_version: 1.5.3 | |
| - name: Get Docker image tag | |
| id: docker-tag | |
| run: | | |
| # Extract the first tag (version tag) from metadata output | |
| DOCKER_IMAGE_TAG=$(echo "${{ steps.meta.outputs.tags }}" | head -n1) | |
| echo "DOCKER_IMAGE_TAG=${DOCKER_IMAGE_TAG}" >> $GITHUB_ENV | |
| echo "DOCKER_IMAGE_TAG=${DOCKER_IMAGE_TAG}" >> $GITHUB_OUTPUT | |
| - name: Deploy Terraform | |
| working-directory: terraform_deploy/ | |
| env: | |
| AWS_ACCESS_KEY_ID: ${{ secrets[format('AWS_ACCESS_KEY_ID_SERVICES_{0}', env.TARGET_ENV_UPPERCASE)] }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets[format('AWS_SECRET_ACCESS_KEY_SERVICES_{0}', env.TARGET_ENV_UPPERCASE)] }} | |
| AWS_ACCOUNT_ID: ${{ secrets[format('AWS_ACCOUNT_ID_SERVICES_{0}', env.TARGET_ENV_UPPERCASE)] }} | |
| AWS_DEFAULT_REGION: us-west-2 | |
| TF_VAR_tig_docker_image: ${{ env.DOCKER_IMAGE_TAG }} | |
| TF_VAR_EARTH_DATA_LOGIN_CLIENT_ID: ${{ secrets[format('EARTH_DATA_LOGIN_CLIENT_ID_{0}', env.TARGET_ENV_UPPERCASE)] }} | |
| TF_VAR_EARTH_DATA_LOGIN_PASSWORD: ${{ secrets[format('EARTH_DATA_LOGIN_PASSWORD_{0}', env.TARGET_ENV_UPPERCASE)] }} | |
| run: | | |
| python3 override.py https://github.com/podaac/tig/releases/download/${{ env.NEW_VERSION }}/tig-terraform-${{ env.NEW_VERSION }}.zip "${{ env.DOCKER_IMAGE_TAG }}" | |
| source bin/config.sh ${{ env.TARGET_ENV_LOWERCASE }} | |
| terraform plan -var-file=tfvars/"${{ env.TARGET_ENV_LOWERCASE }}".tfvars -var="app_version=${{ env.NEW_VERSION }}" -out="tfplan" | |
| terraform apply -auto-approve tfplan > /dev/null |