python-commit.yml

name: Python commit pipeline
run-name: ${{ github.actor }} made a commit to the Python training directory
  
on:
  push:
    branches: [ ftr/* ]
    paths:
      - 'training/**'
      - 'Dockerfile' 

jobs:
  pylint:
    name: "Check with Pylint"
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - uses: cclauss/GitHub-Action-for-pylint@0.7.0

  black:
    name: "Check formatting with Black"
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - uses: psf/black@stable

  gitleaks:
    name: "Check for leaks in secrets with gitleaks"
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0
    - uses: gitleaks/gitleaks-action@v2
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  sonar_cloud:
    name: "Run SonarCloud"
    runs-on: ubuntu-latest
    needs: 
      - gitleaks
      - pylint
      - black
    steps:
    - uses: actions/checkout@v4
    - uses: AppThreat/sast-scan-action@master
      with:
        type: "python"

  elasticnet-build-push:
    name: "Build training Docker image, check for vulneratibilities and push"
    runs-on: ubuntu-latest
    needs: sonar_cloud
    steps:
    - name: "Checkout"
      uses: actions/checkout@v4
    - name: "Set up QEMU"
      uses: docker/setup-qemu-action@v3
    - name: "Set up BuildX"
      uses: docker/setup-buildx-action@v3
    - name: "Login to Docker Hub"
      uses: docker/login-action@v3
      with:
        username: ${{ secrets.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN}}    
    - name: "Build Docker image"
      run: docker build -f Dockerfile -t mltraining:${{ github.sha }} .
    - name: "Scan with Trivy"
      run: |
        docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v $(pwd):/root/ aquasec/trivy:latest fs --severity HIGH,CRITICAL --exit-code 1 --no-progress /
    - name: "Push to Docker Hub"
      run: |
        docker tag mltraining:${{ github.sha }} ${{ secrets.DOCKERHUB_USERNAME }}/mltraining:${{ github.sha }}
        docker tag mltraining:${{ github.sha }} ${{ secrets.DOCKERHUB_USERNAME }}/mltraining:latest
        docker push ${{ secrets.DOCKERHUB_USERNAME }}/mltraining:${{ github.sha }}
        docker push ${{ secrets.DOCKERHUB_USERNAME }}/mltraining:latest