feature/review trigger security (#88)

Author: tcarmet

.devcontainer/Dockerfile

@@ -8,6 +8,6 @@ FROM mcr.microsoft.com/vscode/devcontainers/python:0-${VARIANT}
 ARG NODE_VERSION="none"
 RUN if [ "${NODE_VERSION}" != "none" ]; then su vscode -c "umask 0002 && . /usr/local/share/nvm/nvm.sh && nvm install ${NODE_VERSION} 2>&1"; fi
 
-COPY requirements.txt constraints.txt /tmp/pip-tmp/
+COPY requirements.txt /tmp/pip-tmp/
 RUN pip3 --disable-pip-version-check --no-cache-dir install -r /tmp/pip-tmp/requirements.txt \
-   && pip3 install tox && rm -rf /tmp/pip-tmp
+   && pip3 install tox && rm -rf /tmp/pip-tmp

.dockerignore

@@ -1,3 +1,8 @@
 venv
 *.pyc
 *~
+.git
+*.egg-info
+__pycache__
+.eggs
+.tox

.github/workflows/build.yaml

@@ -1,7 +1,16 @@
 ---
 name: build
 
-on: push
+on:
+  push:
+    branches:
+    - '**'
+  schedule:
+  # Run once a week at 00:00 on Sunday
+  - cron: '0 0 * * 0'
+  release:
+    types:
+    - created
 
 permissions:
   contents: read

.github/workflows/release.yaml

@@ -39,6 +39,8 @@ jobs:
           context: .
           file: ./Dockerfile
           push: true
+          build-args: |
+            VERSION=${{ github.event.inputs.tag }}
           tags: |
             ghcr.io/scality/bert-e:${{ inputs.tag }}
             registry.scality.com/bert-e/bert-e:${{ inputs.tag }}

.github/workflows/trivy.yaml

@@ -3,9 +3,6 @@
 name: trivy
 
 on:
-  schedule:
-  # Every day at noon
-  - cron: '0 12 * * *'
   workflow_call:
     inputs:
       image:

MANIFEST.in

@@ -1,2 +1,3 @@
 recursive-include bert_e/templates *
 recursive-include bert_e/docs *
+include requirements.txt

requirements.txt

@@ -18,4 +18,3 @@ requests==2.28.2
 requests-mock==1.10.0
 werkzeug==2.2.2
 WTForms==3.0.1
-setuptools-scm==1.9.0

setup.py

@@ -1,6 +1,7 @@
 #!/usr/bin/env python3
 
 from os.path import abspath, dirname, join
+import os
 import pip
 
 from setuptools import setup
@@ -36,14 +37,11 @@ def requires():
 
 setup(
     name='bert-e',
-    use_scm_version={
-        'local_scheme': 'dirty-tag'
-    },
-    setup_requires=[
-        'setuptools_scm'
-    ],
+    version=os.getenv('VERSION', '1.0-dev'),
+    python_requires=">=3.10",
+    platforms=['any'],
     description='Scality\'s automated branch merging tool',
-    url='https://bitbucket.org/scality/bert-e',
+    url='https://github.com/scality/bert-e',
     license='Apache',
     include_package_data=True,
     packages=[