1+ name : Python CI
2+
3+ on :
4+ push :
5+ branches : [ master, lab03 ]
6+ paths :
7+ - ' app_python/**'
8+ - ' .github/workflows/python-ci.yml'
9+ pull_request :
10+ branches : [ master ]
11+ paths :
12+ - ' app_python/**'
13+
14+ jobs :
15+ test :
16+ name : Test Python Application
17+ runs-on : ubuntu-latest
18+
19+ steps :
20+ - name : Checkout code
21+ uses : actions/checkout@v4
22+
23+ - name : Set up Python
24+ uses : actions/setup-python@v5
25+ with :
26+ python-version : ' 3.14'
27+ cache : ' pip'
28+ cache-dependency-path : ' app_python/requirements-dev.txt'
29+
30+ - name : Install dependencies
31+ working-directory : ./app_python
32+ run : |
33+ python -m pip install --upgrade pip
34+ pip install -r requirements-dev.txt
35+
36+ - name : Lint with ruff
37+ working-directory : ./app_python
38+ run : |
39+ pip install ruff
40+ ruff check . --output-format=github || true
41+
42+ - name : Run tests with coverage
43+ working-directory : ./app_python
44+ run : |
45+ pytest -v --cov=. --cov-report=term --cov-report=lcov
46+
47+ - name : Upload coverage to Coveralls
48+ uses : coverallsapp/github-action@v2
49+ with :
50+ github-token : ${{ secrets.GITHUB_TOKEN }}
51+ path-to-lcov : ./app_python/coverage.lcov
52+ flag-name : python
53+ parallel : false
54+
55+ docker :
56+ name : Build and Push Docker Image
57+ runs-on : ubuntu-latest
58+ needs : test
59+
60+ steps :
61+ - name : Checkout code
62+ uses : actions/checkout@v4
63+
64+ - name : Set up Docker Buildx
65+ uses : docker/setup-buildx-action@v3
66+
67+ - name : Log in to Docker Hub
68+ uses : docker/login-action@v3
69+ with :
70+ username : ${{ secrets.DOCKERHUB_USERNAME }}
71+ password : ${{ secrets.DOCKERHUB_TOKEN }}
72+
73+ - name : Extract metadata
74+ id : meta
75+ uses : docker/metadata-action@v5
76+ with :
77+ images : ${{ secrets.DOCKERHUB_USERNAME }}/devops-info-service
78+ tags : |
79+ type=raw,value=latest
80+ type=sha,prefix={{date 'YYYY.MM.DD'}}-
81+
82+ - name : Build and push
83+ uses : docker/build-push-action@v6
84+ with :
85+ context : ./app_python
86+ push : true
87+ tags : ${{ steps.meta.outputs.tags }}
88+ labels : ${{ steps.meta.outputs.labels }}
89+ cache-from : type=gha
90+ cache-to : type=gha,mode=max
91+
92+ security :
93+ name : Security Scan with Snyk
94+ runs-on : ubuntu-latest
95+
96+ steps :
97+ - name : Checkout code
98+ uses : actions/checkout@v4
99+
100+ - name : Set up Python
101+ uses : actions/setup-python@v5
102+ with :
103+ python-version : ' 3.14'
104+
105+ - name : Install dependencies
106+ working-directory : ./app_python
107+ run : |
108+ python -m pip install --upgrade pip
109+ pip install -r requirements.txt
110+
111+ - name : Install Snyk CLI
112+ run : |
113+ curl --compressed https://static.snyk.io/cli/latest/snyk-linux -o snyk
114+ chmod +x ./snyk
115+ sudo mv ./snyk /usr/local/bin/snyk
116+
117+ - name : Authenticate Snyk
118+ run : snyk auth ${{ secrets.SNYK_TOKEN }}
119+ env :
120+ SNYK_TOKEN : ${{ secrets.SNYK_TOKEN }}
121+
122+ - name : Run Snyk to check for vulnerabilities
123+ working-directory : ./app_python
124+ continue-on-error : true
125+ run : |
126+ snyk test --severity-threshold=high --file=requirements.txt
0 commit comments