Repository navigation
build(deps): bump docker/login-action from 4.7.0 to 4.8.0 in the github-actions group #51
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| quality: | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 | |
| with: | |
| python-version: "3.13" | |
| - run: python -m pip install "uv==0.11.24" | |
| - run: uv sync --frozen --extra dev --extra s3 | |
| - run: uv run ruff check . | |
| - run: uv run mypy src | |
| - run: uv run pip-audit | |
| - run: uv build --out-dir dist | |
| - name: Smoke-test built wheel | |
| run: | | |
| python -m venv /tmp/github-backup-wheel-test | |
| /tmp/github-backup-wheel-test/bin/python -m pip install --no-deps dist/*.whl | |
| /tmp/github-backup-wheel-test/bin/github-backup --version | |
| /tmp/github-backup-wheel-test/bin/github-backup help run | |
| test: | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 15 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.11", "3.12", "3.13"] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - run: python -m pip install "uv==0.11.24" | |
| - run: uv sync --frozen --extra dev --extra s3 | |
| - run: uv run pytest --cov=github_backup --cov-report=term-missing --cov-fail-under=80 | |
| docker: | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Build container image | |
| run: docker build --pull --platform linux/amd64 --provenance=false --tag github-backup:ci . | |
| - name: Scan container for actionable high/critical vulnerabilities | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: github-backup:ci | |
| scanners: vuln | |
| vuln-type: os,library | |
| severity: CRITICAL,HIGH | |
| ignore-unfixed: true | |
| exit-code: "1" | |
| - name: Smoke-test container image | |
| run: | | |
| docker run --rm --platform linux/amd64 --read-only --cap-drop=ALL --security-opt=no-new-privileges \ | |
| github-backup:ci --version | |
| docker run --rm --platform linux/amd64 --read-only --cap-drop=ALL --security-opt=no-new-privileges \ | |
| github-backup:ci help run | |
| - name: Smoke-test protected config server | |
| run: | | |
| docker run --detach --name github-backup-config-ci --platform linux/amd64 \ | |
| --read-only --cap-drop=ALL --security-opt=no-new-privileges \ | |
| --tmpfs /tmp:rw,noexec,nosuid,size=16m \ | |
| --entrypoint gunicorn github-backup:ci \ | |
| --bind 0.0.0.0:8080 --workers 1 --threads 2 --worker-tmp-dir /tmp \ | |
| github_backup.config_web:application | |
| trap 'docker rm --force github-backup-config-ci' EXIT | |
| for attempt in $(seq 1 20); do | |
| if docker exec github-backup-config-ci python -c \ | |
| "import urllib.request; assert urllib.request.urlopen('http://127.0.0.1:8080/health', timeout=2).read() == b'OK'"; then | |
| exit 0 | |
| fi | |
| sleep 1 | |
| done | |
| docker logs github-backup-config-ci | |
| exit 1 |