python-ci.yml

name: Python CI

on:
  [push, pull_request]

permissions:
  contents: read

jobs:

  test:
    name: Lint & Tests
    runs-on: ubuntu-latest
    timeout-minutes: 10

    strategy:
      fail-fast: true

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.13"

      - name: Cache pip
        uses: actions/cache@v4
        with:
          path: ~/.cache/pip
          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }}
          restore-keys: |
            ${{ runner.os }}-pip-

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r app_python/requirements.txt
          pip install pytest ruff

      - name: Lint
        run: ruff check .

      - name: Run tests
        run: pytest

      - name: Setup Snyk
        uses: snyk/actions/setup@master

      - name: Run Snyk
        run: snyk test --file=app_python/requirements.txt
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}


  docker:
    name: Build & Push Docker
    needs: test
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Set version (CalVer)
        id: version
        run: |
          echo "VERSION=$(date +'%Y.%m')" >> $GITHUB_OUTPUT

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          context: ./app_python
          file: ./app_python/Dockerfile
          push: true
          tags: |
            ${{ secrets.DOCKERHUB_USERNAME }}/app_python:2026.02
            ${{ secrets.DOCKERHUB_USERNAME }}/app_python:latest