Initial deploy setup

2026-07-21 14:00:00 +02:00
commit b8091e59bd
285 changed files with 27854 additions and 0 deletions
@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
@@ -0,0 +1,68 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - name: Install uv
+        run: python -m pip install --disable-pip-version-check uv==0.10.0
+      - name: Sync locked dependencies
+        run: uv sync --frozen --all-groups
+      - name: Secret scan
+        uses: trufflesecurity/trufflehog@v3.79.0
+        with:
+          path: ./
+          extra_args: --only-verified
+      - name: Scan project dependencies and lockfiles (high/critical)
+        uses: aquasecurity/trivy-action@0.30.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          format: table
+          severity: HIGH,CRITICAL
+          exit-code: "1"
+          ignore-unfixed: true
+      - name: Verify repository
+        env:
+          DJANGO_SECRET_KEY: ci-only-not-production-secret
+          DJANGO_DEBUG: "1"
+          DATABASE_URL: ""
+          CELERY_TASK_ALWAYS_EAGER: "1"
+          IMAP_ENABLED: "0"
+          OLLAMA_ENABLED: "0"
+        run: ./scripts/codex_verify.sh
+
+  container:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    needs: quality
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build production image
+        run: docker build --pull --tag vacatureradar:ci .
+      - name: Scan container image for high/critical vulnerabilities
+        uses: aquasecurity/trivy-action@0.30.0
+        with:
+          image-ref: vacatureradar:ci
+          format: table
+          severity: HIGH,CRITICAL
+          exit-code: "1"
+          ignore-unfixed: true
+      - name: Inspect image configuration
+        run: docker image inspect vacatureradar:ci > /tmp/image-inspect.json