CI/CD hardening: lint, secret scan, coverage gate, auto CVE-fix PRs, GHCR + GitHub mirror publishing (#32)
CI / build-and-scan (push) Successful in 1m37s

- release changelog: commits rendered as description (link), divider lines dropped
- gitleaks secret scan and hadolint on every push/PR
- ruff lint/format gate (Python repos) with a pytest --cov-fail-under gate
- scheduled CRITICAL Trivy failures attempt an apk upgrade rebuild and open a follow-up PR if it clears the finding, instead of just failing red
- images also published to ghcr.io/djeex/<repo>
- a matching GitHub Release is created on the GitHub mirror, with a notice pointing back to this repo as the source of truth
This commit was merged in pull request #32.
This commit is contained in:
2026-08-26 15:43:40 +02:00
parent b3ed21eec2
commit 5a7a60d299
10 changed files with 356 additions and 135 deletions
+55 -34
View File
@@ -38,62 +38,83 @@ def test_missing_product_names_exits(monkeypatch):
def test_default_role_map_is_everyone(monkeypatch):
cfg = _reload_env_config(monkeypatch, {
"DISCORD_WEBHOOK_URL": VALID_WEBHOOK,
"PRODUCT_NAMES": "RTX 5090, RTX 5080",
})
cfg = _reload_env_config(
monkeypatch,
{
"DISCORD_WEBHOOK_URL": VALID_WEBHOOK,
"PRODUCT_NAMES": "RTX 5090, RTX 5080",
},
)
assert cfg.DISCORD_ROLE_MAP == {"RTX 5090": "@everyone", "RTX 5080": "@everyone"}
def test_role_count_mismatch_exits(monkeypatch):
with pytest.raises(SystemExit):
_reload_env_config(monkeypatch, {
"DISCORD_WEBHOOK_URL": VALID_WEBHOOK,
"PRODUCT_NAMES": "RTX 5090, RTX 5080",
"DISCORD_ROLES": "<@&123456789012345678>",
})
_reload_env_config(
monkeypatch,
{
"DISCORD_WEBHOOK_URL": VALID_WEBHOOK,
"PRODUCT_NAMES": "RTX 5090, RTX 5080",
"DISCORD_ROLES": "<@&123456789012345678>",
},
)
def test_invalid_role_format_exits(monkeypatch):
with pytest.raises(SystemExit):
_reload_env_config(monkeypatch, {
"DISCORD_WEBHOOK_URL": VALID_WEBHOOK,
"PRODUCT_NAMES": "RTX 5090",
"DISCORD_ROLES": "not-a-role",
})
_reload_env_config(
monkeypatch,
{
"DISCORD_WEBHOOK_URL": VALID_WEBHOOK,
"PRODUCT_NAMES": "RTX 5090",
"DISCORD_ROLES": "not-a-role",
},
)
def test_valid_role_format_accepted(monkeypatch):
cfg = _reload_env_config(monkeypatch, {
"DISCORD_WEBHOOK_URL": VALID_WEBHOOK,
"PRODUCT_NAMES": "RTX 5090",
"DISCORD_ROLES": "<@&123456789012345678>",
})
cfg = _reload_env_config(
monkeypatch,
{
"DISCORD_WEBHOOK_URL": VALID_WEBHOOK,
"PRODUCT_NAMES": "RTX 5090",
"DISCORD_ROLES": "<@&123456789012345678>",
},
)
assert cfg.DISCORD_ROLE_MAP["RTX 5090"] == "<@&123456789012345678>"
def test_unknown_country_falls_back_to_us(monkeypatch):
cfg = _reload_env_config(monkeypatch, {
"DISCORD_WEBHOOK_URL": VALID_WEBHOOK,
"PRODUCT_NAMES": "RTX 5090",
"COUNTRY": "ZZ",
})
cfg = _reload_env_config(
monkeypatch,
{
"DISCORD_WEBHOOK_URL": VALID_WEBHOOK,
"PRODUCT_NAMES": "RTX 5090",
"COUNTRY": "ZZ",
},
)
assert cfg.currency == "$"
def test_known_country_currency(monkeypatch):
cfg = _reload_env_config(monkeypatch, {
"DISCORD_WEBHOOK_URL": VALID_WEBHOOK,
"PRODUCT_NAMES": "RTX 5090",
"COUNTRY": "GB",
})
cfg = _reload_env_config(
monkeypatch,
{
"DISCORD_WEBHOOK_URL": VALID_WEBHOOK,
"PRODUCT_NAMES": "RTX 5090",
"COUNTRY": "GB",
},
)
assert cfg.currency == "£"
def test_refresh_time_invalid_exits(monkeypatch):
with pytest.raises(SystemExit):
_reload_env_config(monkeypatch, {
"DISCORD_WEBHOOK_URL": VALID_WEBHOOK,
"PRODUCT_NAMES": "RTX 5090",
"REFRESH_TIME": "not-a-number",
})
_reload_env_config(
monkeypatch,
{
"DISCORD_WEBHOOK_URL": VALID_WEBHOOK,
"PRODUCT_NAMES": "RTX 5090",
"REFRESH_TIME": "not-a-number",
},
)