Fix CI unit test step with a dedicated Docker build stage

Reviewed-on: #6

.gitea/workflows/ci.yml

@@ -0,0 +1,63 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "0 6 * * 1"
+
+jobs:
+  build-and-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build Docker image
+        run: |
+          docker build -t adguard-cidre:ci . 2>&1 | tee build.log
+          if grep -q "Building wheel for" build.log; then
+            echo "::warning::A dependency was built from source — check Python/Alpine compatibility"
+          fi
+
+      - name: Smoke test (syntax check)
+        run: |
+          docker run --rm --entrypoint python adguard-cidre:ci -c "
+          import ast
+          with open('blocklist_scheduler.py') as f:
+              source = f.read()
+          try:
+              ast.parse(source)
+              print('OK: syntax is valid')
+          except SyntaxError as e:
+              print(f'::error::Syntax error: {e}')
+              exit(1)
+          "
+
+      - name: Run unit tests
+        run: |
+          docker build --target test -t adguard-cidre:test .
+          docker run --rm adguard-cidre:test pytest -v
+
+      - name: Check deprecation warnings
+        run: |
+          docker run --rm adguard-cidre:ci python -W error::DeprecationWarning -c "import blocklist_scheduler" 2>&1 | tee deprecation.log || true
+          if grep -qi "deprecat" deprecation.log; then
+            echo "::warning::Deprecation warning detected, check logs"
+          fi
+
+      - name: Scan with Trivy (critical - blocking)
+        run: |
+          docker run --rm \
+            -e DOCKER_HOST=tcp://dockerhost:2375 \
+            --add-host=dockerhost:host-gateway \
+            aquasec/trivy:0.74.0 image --exit-code 1 --severity CRITICAL adguard-cidre:ci
+
+      - name: Scan with Trivy (high - informative)
+        run: |
+          docker run --rm \
+            -e DOCKER_HOST=tcp://dockerhost:2375 \
+            --add-host=dockerhost:host-gateway \
+            aquasec/trivy:0.74.0 image --exit-code 0 --severity HIGH adguard-cidre:ci

.gitignore

@@ -1,2 +1,4 @@
 /adguard/*.log
 /tmp/
+__pycache__/
+.pytest_cache/

Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.11-alpine
+FROM python:3.13-alpine AS base
 
 ENV TZ=Europe/Paris
 
@@ -11,4 +11,11 @@ WORKDIR /app
 
 COPY blocklist_scheduler.py .
 
+FROM base AS test
+COPY requirements-dev.txt .
+RUN pip install --no-cache-dir -r requirements-dev.txt
+COPY tests/ tests/
+COPY pytest.ini .
+
+FROM base
 ENTRYPOINT ["python3", "blocklist_scheduler.py"]

README.md

@@ -1,13 +1,11 @@
 <h1 align="center"> Adguard CIDRE Sync</h1>
-<div align="center">
-    <a href="https://discord.gg/gxffg3GA96">
-        <img src="https://img.shields.io/badge/JV%20hardware-rejoindre-green?style=flat-square&logo=discord&logoColor=%23fff" alt="JV Hardware">
-    </a>
-</div>
 
 **Adguard CIDRE Sync** - A bot to synchronize adguard clients disallow list with countries CIDR list of your choices.
 
-*The code is partially generated by AI*
+> [!NOTE]
+>_The code was partially written and structured using a generative AI._
+>
+>_Github repo is a mirror of https://git.djeex.fr/Djeex/adguard-cidre. You'll find full package, history and release note there._
 
 ## Sommaire
 
@@ -34,7 +32,7 @@
 | Variable                 | Description                                                              | Example                     | Possible Values                             |
 |--------------------------|--------------------------------------------------------------------------|-----------------------------|---------------------------------------------|
 | `TZ`                      | Timezone of the container to correctly schedule updates                | `Europe/Paris`              | Any valid timezone (e.g., `UTC`, `America/New_York`, etc.) |
-| `BLOCK_COUNTRIES`         | List of country codes for CIDR lists, separated by commas                | `cn,ru,ir`                  | ISO 2-letter country codes                  |
+| `BLOCK_COUNTRIES`         | List of country codes for CIDR lists, separated by commas. You can also define an exclude list (all countries except the specified ones) by prefixing each country code with !. Mixing inclusion and exclusion codes is not supported.                | including list : `cn,ru,ir`, excluding list : `!cn,!ru,!ir`                  | ISO 2-letter country codes                  |
 | `BLOCKLIST_CRON_TYPE`     | Scheduling type: `daily` or `weekly`                                    | `daily`                     | `daily`, `weekly`                           |
 | `BLOCKLIST_CRON_TIME`     | Time to run update in `HH:MM` 24-hour format                            | `06:00`                     | 24-hour time format                         |
 | `BLOCKLIST_CRON_DAY`      | Day of the week for weekly schedule (e.g., `mon`, `tue`, etc.)          | `mon`                       | `mon`, `tue`, `wed`, `thu`, `fri`, `sat`, `sun` |

blocklist_scheduler.py

@@ -6,6 +6,7 @@ import requests
 import yaml
 import schedule
 import time
+import re
 from pathlib import Path
 
 logging.basicConfig(
@@ -18,14 +19,15 @@ ADGUARD_YAML = Path("/adguard/AdGuardHome.yaml")
 TMP_YAML = ADGUARD_YAML.parent / (ADGUARD_YAML.name + ".tmp")
 MANUAL_IPS_FILE = Path("/adguard/manually_blocked_ips.conf")
 CIDR_BASE_URL = "https://raw.githubusercontent.com/vulnebify/cidre/main/output/cidr/ipv4"
+COUNTRY_LIST_URL = "https://raw.githubusercontent.com/vulnebify/cidre/refs/heads/main/cidre/countries.py"
 
 FIRST_BACKUP = ADGUARD_YAML.parent / "AdGuardHome.yaml.first-start.bak"
 LAST_UPDATE_BACKUP = ADGUARD_YAML.parent / "AdGuardHome.yaml.last-update.bak"
 
 BLOCK_COUNTRIES = os.getenv("BLOCK_COUNTRIES", "")
-BLOCKLIST_CRON_TYPE = os.getenv("BLOCKLIST_CRON_TYPE", "daily").lower()  # daily or weekly
+BLOCKLIST_CRON_TYPE = os.getenv("BLOCKLIST_CRON_TYPE", "daily").lower()
-BLOCKLIST_CRON_TIME = os.getenv("BLOCKLIST_CRON_TIME", "06:00")  # HH:MM format
+BLOCKLIST_CRON_TIME = os.getenv("BLOCKLIST_CRON_TIME", "06:00")
-BLOCKLIST_CRON_DAY = os.getenv("BLOCKLIST_CRON_DAY", "mon").lower()  # only if weekly
+BLOCKLIST_CRON_DAY = os.getenv("BLOCKLIST_CRON_DAY", "mon").lower()
 
 ADGUARD_CONTAINER_NAME = os.getenv("ADGUARD_CONTAINER_NAME", "adguardhome")
 DOCKER_API_URL = os.getenv("DOCKER_API_URL", "http://socket-proxy-adguard:2375")
@@ -41,6 +43,44 @@ def backup_last_update():
     logging.info(f"Creating last update backup: {LAST_UPDATE_BACKUP}")
     LAST_UPDATE_BACKUP.write_text(ADGUARD_YAML.read_text())
 
+def fetch_all_country_codes():
+    try:
+        resp = requests.get(COUNTRY_LIST_URL, timeout=15)
+        resp.raise_for_status()
+        matches = re.findall(r'"([A-Z]{2})"', resp.text)
+        return set(code.lower() for code in matches)
+    except Exception as e:
+        logging.error(f"Failed to fetch available country codes: {e}")
+        return set()
+
+def get_selected_countries():
+    if not BLOCK_COUNTRIES:
+        logging.error("BLOCK_COUNTRIES is not set. Skipping update.")
+        return []
+
+    raw_codes = [c.strip() for c in BLOCK_COUNTRIES.split(",") if c.strip()]
+    if not raw_codes:
+        logging.error("No valid country codes provided.")
+        return []
+
+    is_exclusion = all(c.startswith("!") for c in raw_codes)
+    is_inclusion = all(not c.startswith("!") for c in raw_codes)
+
+    if not (is_exclusion or is_inclusion):
+        logging.error("Mixed syntax in BLOCK_COUNTRIES. Use only inclusion (e.g. 'fr,de') or only exclusion (e.g. '!fr,!de').")
+        sys.exit(1)
+
+    available = fetch_all_country_codes()
+    selected = {c.lstrip("!") for c in raw_codes}
+    unknown = selected - available
+    if unknown:
+        logging.warning(f"Unknown country codes: {', '.join(sorted(unknown))}")
+
+    if is_exclusion:
+        return sorted(available - selected)
+    else:
+        return sorted(selected & available)
+
 def download_cidr_lists(countries):
     combined_ips = []
     for code in countries:
@@ -76,12 +116,15 @@ def update_yaml_with_ips(ips):
         logging.error(f"{ADGUARD_YAML} does not exist. Cannot update.")
         return False
 
-    data = None
+    try:
         with ADGUARD_YAML.open() as f:
             data = yaml.safe_load(f)
+    except Exception as e:
+        logging.error(f"Failed to parse YAML file: {e}")
+        return False
 
-    if data is None:
+    if not isinstance(data, dict):
-        logging.error(f"Failed to parse YAML file {ADGUARD_YAML}")
+        logging.error("Invalid YAML format.")
         return False
 
     data['dns']['disallowed_clients'] = ips
@@ -106,12 +149,12 @@ def restart_adguard_container():
         logging.error(f"Error restarting container: {e}")
 
 def update_blocklist():
-    if not BLOCK_COUNTRIES:
+    countries = get_selected_countries()
-        logging.error("No countries specified in BLOCK_COUNTRIES environment variable. Skipping update.")
+    if not countries:
+        logging.error("No valid countries to process. Skipping update.")
         return
 
-    countries_list = [c.strip() for c in BLOCK_COUNTRIES.split(",") if c.strip()]
+    cidr_ips = download_cidr_lists(countries)
-    cidr_ips = download_cidr_lists(countries_list)
     manual_ips = read_manual_ips()
     combined_ips = cidr_ips + manual_ips
 
@@ -132,7 +175,7 @@ def schedule_job():
         schedule.every().day.at(f"{hour:02d}:{minute:02d}").do(update_blocklist)
         logging.info(f"Scheduled daily update at {hour:02d}:{minute:02d}")
     elif BLOCKLIST_CRON_TYPE == "weekly":
-        valid_days = ["mon","tue","wed","thu","fri","sat","sun"]
+        valid_days = ["mon", "tue", "wed", "thu", "fri", "sat", "sun"]
         day = BLOCKLIST_CRON_DAY[:3]
         if day not in valid_days:
             logging.error(f"Invalid BLOCKLIST_CRON_DAY '{BLOCKLIST_CRON_DAY}', must be one of {valid_days}. Defaulting to Monday.")
@@ -146,9 +189,7 @@ def schedule_job():
 
 def main():
     logging.info("Starting blocklist scheduler...")
-
     backup_first_start()
-
     update_blocklist()
     schedule_job()
     while True:

pytest.ini

@@ -0,0 +1,2 @@
+[pytest]
+pythonpath = .

requirements-dev.txt

@@ -0,0 +1,4 @@
+requests
+pyyaml
+schedule
+pytest

tests/test_blocklist_scheduler.py

@@ -0,0 +1,41 @@
+import pytest
+
+import blocklist_scheduler as bs
+
+
+def test_backup_first_start_creates_backup_when_missing(tmp_path, monkeypatch):
+    adguard_yaml = tmp_path / "AdGuardHome.yaml"
+    adguard_yaml.write_text("original: config\n")
+    first_backup = tmp_path / "AdGuardHome.yaml.first-start.bak"
+
+    monkeypatch.setattr(bs, "ADGUARD_YAML", adguard_yaml)
+    monkeypatch.setattr(bs, "FIRST_BACKUP", first_backup)
+
+    bs.backup_first_start()
+
+    assert first_backup.read_text() == "original: config\n"
+
+
+def test_backup_first_start_does_not_overwrite_existing_backup(tmp_path, monkeypatch):
+    adguard_yaml = tmp_path / "AdGuardHome.yaml"
+    adguard_yaml.write_text("new: config\n")
+    first_backup = tmp_path / "AdGuardHome.yaml.first-start.bak"
+    first_backup.write_text("pristine: original\n")
+
+    monkeypatch.setattr(bs, "ADGUARD_YAML", adguard_yaml)
+    monkeypatch.setattr(bs, "FIRST_BACKUP", first_backup)
+
+    bs.backup_first_start()
+
+    assert first_backup.read_text() == "pristine: original\n"
+
+
+def test_backup_first_start_raises_if_adguard_yaml_missing(tmp_path, monkeypatch):
+    adguard_yaml = tmp_path / "AdGuardHome.yaml"
+    first_backup = tmp_path / "AdGuardHome.yaml.first-start.bak"
+
+    monkeypatch.setattr(bs, "ADGUARD_YAML", adguard_yaml)
+    monkeypatch.setattr(bs, "FIRST_BACKUP", first_backup)
+
+    with pytest.raises(FileNotFoundError):
+        bs.backup_first_start()