Skip to content

ci: Dockerfile json args recommended (#273) #776

ci: Dockerfile json args recommended (#273)

ci: Dockerfile json args recommended (#273) #776

Workflow file for this run

name: Analysis
on:
push:
branches: [main]
pull_request:
types: [opened, reopened, synchronize, ready_for_review]
schedule:
- cron: "0 12 * * 0" # 4 AM PST = 12 PM UDT, runs sundays
workflow_dispatch:
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
# https://github.com/marketplace/actions/aqua-security-trivy
trivy:
name: Trivy Security Scan
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v4
- name: Run Trivy vulnerability scanner in repo mode
uses: aquasecurity/trivy-action@0.29.0
with:
format: "sarif"
output: "trivy-results.sarif"
ignore-unfixed: true
scan-type: "fs"
scanners: "vuln,secret,config"
severity: "CRITICAL,HIGH"
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: "trivy-results.sarif"
java:
name: Java
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
runs-on: ubuntu-24.04
defaults:
run:
working-directory: backend-java
services:
postgres:
image: postgres
env:
POSTGRES_DB: postgres
POSTGRES_USER: postgres
POSTGRES_PASSWORD: postgres
options: >-
--health-cmd pg_isready
--health-interval 10s
--health-timeout 5s
--health-retries 5
ports:
- 5432:5432
steps:
- uses: actions/checkout@v4
- uses: actions/setup-java@v4
with:
distribution: "temurin"
java-version: "23"
- name: Cache local Maven repository
uses: actions/cache@v4
with:
path: ~/.m2/repository
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
restore-keys: |
${{ runner.os }}-maven-
- name: Run unit tests
run: mvn -f pom.xml clean package
python:
name: Python
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
runs-on: ubuntu-24.04
defaults:
run:
working-directory: backend-py
services:
postgres:
image: postgres
env:
POSTGRES_DB: postgres
POSTGRES_USER: postgres
POSTGRES_PASSWORD: postgres
options: >-
--health-cmd pg_isready
--health-interval 10s
--health-timeout 5s
--health-retries 5
ports:
- 5432:5432
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
with:
python-version: "3.12"
- name: cache poetry install
uses: actions/cache@v4
with:
path: ~/.local
key: poetry-${{ hashFiles('**/pyproject.toml') }}
- uses: snok/install-poetry@v1.4.1
with:
version: 1.2.2
virtualenvs-create: true
virtualenvs-in-project: true
installer-parallel: true
- id: cache-deps
uses: actions/cache@v4
with:
path: .venv
key: pydeps-${{ hashFiles('**/poetry.lock') }}
- run: poetry install --no-interaction --no-root
if: steps.cache-deps.outputs.cache-hit != 'true'
- run: poetry run pytest
results:
name: Analysis Results
needs: [trivy, java, python]
if: always()
runs-on: ubuntu-24.04
steps:
- if: contains(needs.*.result, 'canceled|failure')
run: echo "At least one job has failed." && exit 1
- run: echo "Success!"