Skip to content

Merge pull request #108 from duplocloud/update-image-wait-fix #24

Merge pull request #108 from duplocloud/update-image-wait-fix

Merge pull request #108 from duplocloud/update-image-wait-fix #24

Workflow file for this run

name: Quality
on:
push:
branches:
- main
workflow_dispatch:
inputs:
push:
description: Save the lock file?
default: false
type: boolean
tag:
description: Tag to push
required: false
type: string
codescan:
description: Perform code scan?
default: true
type: boolean
workflow_call:
inputs:
push:
description: Save the lock file?
default: true
type: boolean
tag:
description: Tag to push
required: false
type: string
codescan:
description: Perform code scan?
default: true
type: boolean
secrets:
PYPI_API_TOKEN:
description: PyPi token
required: true
GH_APP_KEY:
description: GitHub App private key
required: true
jobs:
quality:
name: Quality
runs-on: ubuntu-latest
permissions:
security-events: write
steps:
- name: Setup
id: setup
uses: duplocloud/duploctl/.github/actions/setup@main
with:
ref: ${{ inputs.tag }}
install: "--editable ."
app-id: ${{ vars.GH_APP_ID }}
private-key: ${{ secrets.GH_APP_KEY }}
- name: Freeze Requirements
run: pip freeze --exclude-editable > requirements.txt
- name: Install Test Dependencies
run: pip install .[test]
- name: Pip Audit
uses: pypa/[email protected]
with:
inputs: requirements.txt
# do linting
# stop the build if there are Python syntax errors or undefined names
# ruff --format=github --select=E9,F63,F7,F82 --target-version=py37 .
- name: Lint with ruff
run: ruff check ./src
# Now do codequality checks with CodeQL
- name: Initialize CodeQL
# if codescan is true or it is the default branch
if: inputs.codescan || github.ref == 'refs/heads/main'
uses: github/codeql-action/init@v3
with:
languages: python
build-mode: none
# token: ${{ steps.setup.outputs.token }}
- name: Perform CodeQL Analysis
id: analysis
if: inputs.codescan || github.ref == 'refs/heads/main'
uses: github/codeql-action/analyze@v3
with:
category: "/language:python"
# token: ${{ steps.setup.outputs.token }}
- name: Save Lock File
uses: actions/upload-artifact@v4
if: inputs.push
with:
name: requirements.lock
path: requirements.txt
- name: Save Sarif File
if: inputs.push && (inputs.codescan || github.ref == 'refs/heads/main')
uses: actions/upload-artifact@v4
with:
name: sarif
path: ${{ steps.analysis.outputs.sarif-output }}