Add pytest suite and Gitea Actions CI/CD pipeline
CI / build-and-scan (pull_request) Successful in 56s
CI / build-and-scan (pull_request) Successful in 56s
83 tests (94% coverage of src/py) covering the builder pipeline (gallery sync, HTML/CSS generation, image processing, full site build) and the Flask webui (routes, uploads, theme/font management). Dockerfile gains a `test` stage (pytest) between the wheel builder and the prod image, and pins the alpine base to a full patch tag so Renovate can classify updates. CI workflow builds, smoke-tests, runs the suite, scans with Trivy, and publishes/releases on merge to main, following the same pipeline already running on adguard-cidre.
This commit is contained in:
Djeex
@@ -0,0 +1,141 @@
|
||||
name: CI
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
pull_request:
|
||||
branches: [main]
|
||||
|
||||
jobs:
|
||||
build-and-scan:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v7
|
||||
with:
|
||||
fetch-depth: 0
|
||||
persist-credentials: false
|
||||
|
||||
- name: Build prod image
|
||||
run: docker build -t lumeex:ci .
|
||||
|
||||
- name: Smoke test
|
||||
run: |
|
||||
docker run --rm --entrypoint python lumeex:ci -c "
|
||||
import ast
|
||||
ast.parse(open('build.py').read())
|
||||
ast.parse(open('gallery.py').read())
|
||||
print('syntax ok')
|
||||
"
|
||||
|
||||
- name: Build test image
|
||||
run: docker build --target test -t lumeex:test .
|
||||
|
||||
- name: Unit tests
|
||||
run: docker run --rm lumeex:test pytest -v
|
||||
|
||||
- name: Check deprecation warnings
|
||||
run: docker run --rm --entrypoint python lumeex:ci -W error::DeprecationWarning -c "import src.py.webui.webui"
|
||||
|
||||
- name: Trivy critical (blocking)
|
||||
run: |
|
||||
docker run --rm \
|
||||
-e DOCKER_HOST=tcp://dockerhost:2375 --add-host=dockerhost:host-gateway \
|
||||
-v /var/run/docker.sock:/var/run/docker.sock \
|
||||
aquasec/trivy image --exit-code 1 --severity CRITICAL lumeex:ci
|
||||
|
||||
- name: Trivy high (informative)
|
||||
run: |
|
||||
docker run --rm \
|
||||
-e DOCKER_HOST=tcp://dockerhost:2375 --add-host=dockerhost:host-gateway \
|
||||
-v /var/run/docker.sock:/var/run/docker.sock \
|
||||
aquasec/trivy image --exit-code 0 --severity HIGH lumeex:ci
|
||||
|
||||
- name: Publish tagged image
|
||||
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
|
||||
env:
|
||||
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
||||
CI_PUSH_TOKEN: ${{ secrets.CI_PUSH_TOKEN }}
|
||||
GITEA_URL: https://git.djeex.fr
|
||||
IMAGE: git.djeex.fr/djeex/lumeex
|
||||
run: |
|
||||
set -e
|
||||
|
||||
# Only republish when a container-relevant file actually changed
|
||||
BEFORE="${{ github.event.before }}"
|
||||
if [ -z "$BEFORE" ] || [ "$BEFORE" = "0000000000000000000000000000000000000000" ]; then
|
||||
BEFORE="HEAD~1"
|
||||
fi
|
||||
CHANGED=$(git diff --name-only "$BEFORE" "${{ github.sha }}" -- \
|
||||
Dockerfile requirements.txt VERSION build.py gallery.py \
|
||||
src/ config/ docker/.sh/entrypoint.sh || true)
|
||||
|
||||
if [ -z "$CHANGED" ]; then
|
||||
echo "No container-relevant changes, skipping publish."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
VERSION_BUMPED=false
|
||||
if ! echo "$CHANGED" | grep -qx "VERSION"; then
|
||||
CURRENT_VERSION=$(cat VERSION)
|
||||
MAJOR=$(echo "$CURRENT_VERSION" | cut -d. -f1)
|
||||
MINOR=$(echo "$CURRENT_VERSION" | cut -d. -f2)
|
||||
PATCH=$(echo "$CURRENT_VERSION" | cut -d. -f3)
|
||||
NEW_VERSION="$MAJOR.$MINOR.$((PATCH + 1))"
|
||||
echo "$NEW_VERSION" > VERSION
|
||||
|
||||
git config user.name "gitea-ci"
|
||||
git config user.email "[email protected]"
|
||||
git remote set-url origin "https://gitea-ci:${CI_PUSH_TOKEN}@git.djeex.fr/Djeex/lumeex.git"
|
||||
git add VERSION
|
||||
git commit -m "chore: bump version to $NEW_VERSION [skip ci]"
|
||||
git push origin HEAD:main
|
||||
git config --unset-all "http.https://git.djeex.fr/Djeex/lumeex.git/.extraheader" || true
|
||||
VERSION_BUMPED=true
|
||||
fi
|
||||
|
||||
FULL_VERSION=$(cat VERSION)
|
||||
MAJOR_MINOR=$(echo "$FULL_VERSION" | cut -d. -f1,2)
|
||||
|
||||
echo "$REGISTRY_TOKEN" | docker login git.djeex.fr -u Djeex --password-stdin
|
||||
|
||||
docker tag lumeex:ci "$IMAGE:latest"
|
||||
docker tag lumeex:ci "$IMAGE:$MAJOR_MINOR"
|
||||
docker tag lumeex:ci "$IMAGE:$FULL_VERSION"
|
||||
docker push "$IMAGE:latest"
|
||||
docker push "$IMAGE:$MAJOR_MINOR"
|
||||
docker push "$IMAGE:$FULL_VERSION"
|
||||
|
||||
# Categorize the changelog from the merged PR's labels, if any
|
||||
PR_NUMBER=$(git log -1 --format=%B "${{ github.sha }}" | grep -oE '#[0-9]+' | head -1 | tr -d '#' || true)
|
||||
CATEGORY="🔧 Maintenance"
|
||||
PR_LINK=""
|
||||
if [ -n "$PR_NUMBER" ]; then
|
||||
PR_LINK="https://git.djeex.fr/Djeex/lumeex/pulls/$PR_NUMBER"
|
||||
LABELS=$(curl -s -H "Authorization: token $CI_PUSH_TOKEN" \
|
||||
"$GITEA_URL/api/v1/repos/Djeex/lumeex/issues/$PR_NUMBER/labels" | jq -r '.[].name' || true)
|
||||
if echo "$LABELS" | grep -qx "bug"; then
|
||||
CATEGORY="⚠️ Hotfix"
|
||||
elif echo "$LABELS" | grep -qx "major"; then
|
||||
CATEGORY="💥 Breaking change"
|
||||
elif echo "$LABELS" | grep -qx "minor"; then
|
||||
CATEGORY="✨ Update"
|
||||
fi
|
||||
fi
|
||||
|
||||
COMMIT_LINK="https://git.djeex.fr/Djeex/lumeex/commit/${{ github.sha }}"
|
||||
BODY=$(printf '**%s**\n\nCommit: %s' "$CATEGORY" "$COMMIT_LINK")
|
||||
if [ -n "$PR_LINK" ]; then
|
||||
BODY=$(printf '%s\nPR: %s' "$BODY" "$PR_LINK")
|
||||
fi
|
||||
|
||||
jq -n \
|
||||
--arg tag "$FULL_VERSION" \
|
||||
--arg name "$FULL_VERSION" \
|
||||
--arg body "$BODY" \
|
||||
'{tag_name: $tag, name: $name, body: $body}' | \
|
||||
curl -s -X POST \
|
||||
-H "Authorization: token $CI_PUSH_TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d @- \
|
||||
"$GITEA_URL/api/v1/repos/Djeex/lumeex/releases"
|
||||
Reference in New Issue
Block a user