Merge pull request #18 from sydseter/stepsecurity_remediation_1712240465

Trying to upload artifact

.github/workflows/run-tests-generate-output.yaml → .github/workflows/generate-artifacts.yaml

@@ -1,73 +1,13 @@
-name: Run Tests and generate output files
+name: Generate output files
 # Controls when the workflow will run
 on:
-  pull_request:
-    branches:
-      - '**'
-    paths:
-      - '**'
-  workflow_dispatch:
+  workflow_run:
+    workflows: [Run pull request tests]
+    types: [completed]
 permissions:
   contents: read
 
 jobs:
-  runtests:
-    name: Run Tests
-    runs-on: ubuntu-latest
-    steps:
-      # Make sure we have some code to test
-      - name: Harden Runner
-        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            api.github.com:443
-            azure.archive.ubuntu.com:80
-            esm.ubuntu.com:443
-            files.pythonhosted.org:443
-            github-cloud.githubusercontent.com:443
-            github.com:443
-            motd.ubuntu.com:443
-            packages.microsoft.com:443
-            ppa.launchpadcontent.net:443
-            pypi.org:443
-            opencre.org:443
-            codeclimate.com:443
-            d3iz1jjs17r6kg.cloudfront.net:443
-            keys.openpgp.org:443
-            api.codeclimate.com:443
-      - name: Checkout repository
-        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
-      # Set the pip environment up
-      - name: Get Python
-        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
-        with:
-          python-version: '3.10'
-          cache: 'pipenv' # caching pip dependencies
-      - name: Install dependencies
-        run: |
-          pip install -r requirements.txt --require-hashes
-          pipenv install --ignore-pipfile --dev
-      # Run the tests
-      - name: Run unit tests
-        run: pipenv run python -m unittest discover -s "tests/scripts" -p "*_utest.py"
-      - name: Run integration
-        run: pipenv run python -m unittest discover -s "tests/scripts" -p "*_itest.py"
-      # Test coverage reports
-      - name: Check test coverage - run tests
-        run: pipenv run coverage run -m unittest discover -s "tests/scripts" -p "*_*test.py"
-      - name: Check test coverage - generate xml
-        run: pipenv run coverage xml
-      - name: Check test coverage - Report
-        run: pipenv run coverage report --fail-under 85 scripts/convert*
-      # Check formatting of files
-      - name: Check formatting of files with Black
-        run: pipenv run black --line-length=120 --check .
-      - name: Check formatting of files with flake
-        run: pipenv run flake8 --max-line-length=120 --max-complexity=10 --ignore=E203,W503
-      - name: Check formatting of files for correct spelling and namespace names
-        run: pipenv run mypy --namespace-packages --strict ./scripts/
-
   # If Tests pass, generate new output files
   uploadoutputfiles:
     name: Upload Output Files

.github/workflows/run-pull-request-tests.yml

@@ -0,0 +1,21 @@
+name: Run pull request tests
+# Controls when the workflow will run
+on:
+  # Triggers the workflow on push or pull request events but only for the main branch
+  pull_request:
+    branches:
+      - '**'
+    paths:
+      - '**'
+  # Allows you to run this workflow manually from the Actions tab
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+permissions:
+  contents: read
+
+jobs:
+  run-tests:
+    uses: .github/workflows/run-tests.yml

.github/workflows/run-tests.yaml

@@ -0,0 +1,76 @@
+name: Run Tests
+# Controls when the workflow will run
+on:
+  # Triggers the workflow on push or pull request events but only for the main branch
+  pull_request:
+    branches:
+      - '**'
+    paths:
+      - '**'
+  # Allows you to run this workflow manually from the Actions tab
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+  workflow_call:
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+permissions:
+  contents: read
+
+jobs:
+  runtests:
+    name: Run Tests
+    runs-on: ubuntu-latest
+    steps:
+      # Make sure we have some code to test
+      - name: Harden Runner
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            azure.archive.ubuntu.com:80
+            esm.ubuntu.com:443
+            files.pythonhosted.org:443
+            github-cloud.githubusercontent.com:443
+            github.com:443
+            motd.ubuntu.com:443
+            packages.microsoft.com:443
+            ppa.launchpadcontent.net:443
+            pypi.org:443
+            opencre.org:443
+            codeclimate.com:443
+            d3iz1jjs17r6kg.cloudfront.net:443
+            keys.openpgp.org:443
+            api.codeclimate.com:443
+      - name: Checkout repository
+        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+      # Set the pip environment up
+      - name: Get Python
+        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
+        with:
+          python-version: '3.10'
+          cache: 'pipenv' # caching pip dependencies
+      - name: Install dependencies
+        run: |
+          pip install -r requirements.txt --require-hashes
+          pipenv install --ignore-pipfile --dev
+      # Run the tests
+      - name: Run unit tests
+        run: pipenv run python -m unittest discover -s "tests/scripts" -p "*_utest.py"
+      - name: Run integration
+        run: pipenv run python -m unittest discover -s "tests/scripts" -p "*_itest.py"
+      # Test coverage reports
+      - name: Check test coverage - run tests
+        run: pipenv run coverage run -m unittest discover -s "tests/scripts" -p "*_*test.py"
+      - name: Check test coverage - generate xml
+        run: pipenv run coverage xml
+      - name: Check test coverage - Report
+        run: pipenv run coverage report --fail-under 85 scripts/convert*
+      # Check formatting of files
+      - name: Check formatting of files with Black
+        run: pipenv run black --line-length=120 --check .
+      - name: Check formatting of files with flake
+        run: pipenv run flake8 --max-line-length=120 --max-complexity=10 --ignore=E203,W503
+      - name: Check formatting of files for correct spelling and namespace names
+        run: pipenv run mypy --namespace-packages --strict ./scripts/