fix warnings #14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI/CD Pipeline | |
| on: | |
| push: | |
| branches: [main] | |
| paths-ignore: | |
| - 'tests/**' | |
| jobs: | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: '3.10' | |
| - run: pip install -r requirements-dev.txt | |
| - run: ruff check . | |
| test: | |
| name: Test | |
| runs-on: ubuntu-latest | |
| needs: [lint] | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: '3.10' | |
| - name: Install system dependencies | |
| run: sudo apt-get install -y graphviz | |
| - name: Install Python dependencies | |
| run: pip install -r requirements.txt -r requirements-dev.txt | |
| - name: Run test suite | |
| run: pytest tests/ -v | |
| sbom: | |
| name: SBOM & Vulnerability Scan | |
| runs-on: ubuntu-latest | |
| needs: [test] | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: '3.10' | |
| - name: Install Syft | |
| run: | | |
| curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin | |
| - name: Generate SBOM | |
| run: syft . -o cyclonedx-json=sbom.json | |
| - name: Upload SBOM as artifact | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: sbom | |
| path: sbom.json | |
| - name: Install Grype | |
| run: | | |
| curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin | |
| - name: Scan SBOM for vulnerabilities | |
| run: | | |
| grype db update | |
| grype sbom:sbom.json --fail-on medium | |
| continue-on-error: true | |
| - name: Scan dependencies for vulnerabilities | |
| run: | | |
| pip install pip-audit | |
| pip-audit -r requirements.txt -f json -o audit-report.json || true | |
| python3 - <<'EOF' | |
| import json, os | |
| with open('audit-report.json') as f: | |
| data = json.load(f) | |
| vulns = [ | |
| (d['name'], d['version'], v['id'], ', '.join(v.get('fix_versions', [])) or 'none') | |
| for d in data.get('dependencies', []) | |
| for v in d.get('vulns', []) | |
| ] | |
| if vulns: | |
| for name, ver, vid, fixes in vulns: | |
| print(f'::warning::{name}=={ver} 路 {vid} 路 fix: {fixes}') | |
| with open(os.environ['GITHUB_STEP_SUMMARY'], 'a') as f: | |
| f.write('## 鈿狅笍 Dependency Vulnerabilities\n\n') | |
| f.write('| Package | Version | ID | Fix Versions |\n') | |
| f.write('|---|---|---|---|\n') | |
| for name, ver, vid, fixes in vulns: | |
| f.write(f'| {name} | {ver} | {vid} | {fixes} |\n') | |
| else: | |
| print('No known vulnerabilities found.') | |
| EOF | |
| continue-on-error: true | |
| - name: Upload vulnerability report | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: vulnerability-report | |
| path: audit-report.json | |
| security: | |
| name: Static Security Scan | |
| runs-on: ubuntu-latest | |
| needs: [test] | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: '3.10' | |
| - run: pip install bandit | |
| - name: Run bandit | |
| run: bandit -r . --exclude .venv,tests -ll | |
| publish: | |
| name: Build & Publish Binary | |
| runs-on: ubuntu-latest | |
| needs: [lint, test, sbom, security] | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: '3.10' | |
| - name: Install dependencies | |
| run: pip install -r requirements.txt pyinstaller | |
| - name: Build standalone binary | |
| run: pyinstaller --onefile main.py --name optimizhelper | |
| - name: Upload binary as artifact | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: optimizhelper-linux | |
| path: dist/optimizhelper |