fix(ci): grant performance report publish permission #141
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Tests | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main, develop] | |
| env: | |
| UV_EXTRA: dev | |
| jobs: | |
| test: | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| python-version: ["3.12", "3.13"] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| - name: Install libomp on macOS | |
| if: runner.os == 'macOS' | |
| run: | | |
| if brew ls --versions libomp >/dev/null 2>&1; then | |
| echo "libomp already installed" | |
| else | |
| brew install libomp | |
| fi | |
| echo "DYLD_LIBRARY_PATH=/opt/homebrew/opt/libomp/lib:${DYLD_LIBRARY_PATH:-}" >> "$GITHUB_ENV" | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | |
| with: | |
| enable-cache: true | |
| cache-dependency-glob: "uv.lock" | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install dependencies | |
| run: uv sync --frozen --all-extras | |
| - name: Run tests with pytest | |
| run: | | |
| uv run --extra dev pytest --cov=openfatture --cov-report=xml --cov-report=term-missing --cov-fail-under=49 | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@v4 | |
| with: | |
| file: ./coverage.xml | |
| flags: unittests | |
| name: codecov-${{ matrix.os }}-py${{ matrix.python-version }} | |
| fail_ci_if_error: false | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| - name: Install libomp on macOS | |
| if: runner.os == 'macOS' | |
| run: | | |
| brew list libomp || brew install libomp | |
| echo "DYLD_LIBRARY_PATH=/opt/homebrew/opt/libomp/lib:${DYLD_LIBRARY_PATH:-}" >> "$GITHUB_ENV" | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: '3.13' | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | |
| - name: Install dependencies | |
| run: uv sync --frozen --all-extras --python "$(command -v python3)" | |
| - name: Run Black | |
| run: uv run --extra dev python -m black --check . | |
| - name: Run Ruff | |
| run: uv run --extra dev ruff check . | |
| - name: Run MyPy | |
| run: uv run --extra dev python -m mypy openfatture/ | |
| security: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@0.35.0 | |
| with: | |
| scan-type: 'fs' | |
| scan-ref: '.' | |
| format: 'sarif' | |
| output: 'trivy-results.sarif' | |
| - name: Upload Trivy results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: 'trivy-results.sarif' | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: '3.13' | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | |
| - name: Install dependencies | |
| run: uv sync --frozen | |
| - name: Run Safety check | |
| run: uv run safety check --json | |
| continue-on-error: true | |
| - name: Run Bandit (Python SAST) | |
| # Advisory for now: the codebase has pre-existing findings (3 High, | |
| # 6 Medium). Results are surfaced in the Security tab via SARIF; triage | |
| # and tighten to a failing gate once the backlog is addressed. | |
| run: | | |
| uvx bandit -r openfatture/ -ll -f sarif -o bandit-results.sarif || true | |
| uvx bandit -r openfatture/ -ll || true | |
| - name: Upload Bandit results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| if: always() | |
| with: | |
| sarif_file: 'bandit-results.sarif' | |
| continue-on-error: true | |
| - name: Run pip-audit (dependency vulnerabilities) | |
| run: uvx pip-audit --strict || true | |
| continue-on-error: true | |
| permissions: | |
| contents: read | |
| security-events: write |