90 lines
2.6 KiB
YAML
90 lines
2.6 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ci-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
quality:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.13"
|
|
- name: Install uv
|
|
run: python -m pip install --disable-pip-version-check uv==0.10.0
|
|
- name: Sync locked dependencies
|
|
run: uv sync --frozen --all-groups
|
|
- name: Install Chromium for mandatory browser tests
|
|
run: uv run playwright install --with-deps chromium
|
|
- name: Secret scan
|
|
uses: trufflesecurity/trufflehog@v3.79.0
|
|
with:
|
|
path: ./
|
|
extra_args: --only-verified
|
|
- name: Scan project dependencies and lockfiles (high/critical)
|
|
uses: aquasecurity/trivy-action@0.30.0
|
|
with:
|
|
scan-type: fs
|
|
scan-ref: .
|
|
format: table
|
|
severity: HIGH,CRITICAL
|
|
exit-code: "1"
|
|
ignore-unfixed: true
|
|
- name: Verify repository
|
|
env:
|
|
DJANGO_SECRET_KEY: ci-only-not-production-secret
|
|
DJANGO_DEBUG: "1"
|
|
DATABASE_URL: ""
|
|
CELERY_TASK_ALWAYS_EAGER: "1"
|
|
IMAP_ENABLED: "0"
|
|
OLLAMA_ENABLED: "0"
|
|
run: ./scripts/codex_verify.sh
|
|
- name: Upload browser failure artifacts
|
|
if: failure()
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: browser-failure-artifacts
|
|
path: artifacts/browser-tests/
|
|
if-no-files-found: ignore
|
|
|
|
container:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
needs: quality
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Build production image
|
|
run: docker build --pull --tag vacatureradar:ci .
|
|
- name: Scan container image for high/critical vulnerabilities
|
|
uses: aquasecurity/trivy-action@0.30.0
|
|
with:
|
|
image-ref: vacatureradar:ci
|
|
format: table
|
|
severity: HIGH,CRITICAL
|
|
exit-code: "1"
|
|
ignore-unfixed: true
|
|
- name: Generate CycloneDX software bill of materials
|
|
uses: aquasecurity/trivy-action@0.30.0
|
|
with:
|
|
image-ref: vacatureradar:ci
|
|
format: cyclonedx
|
|
output: vacatureradar-sbom.cdx.json
|
|
scan-type: image
|
|
- name: Upload software bill of materials
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: vacatureradar-sbom
|
|
path: vacatureradar-sbom.cdx.json
|
|
- name: Inspect image configuration
|
|
run: docker image inspect vacatureradar:ci > /tmp/image-inspect.json
|