Skip to content

Commit 7321ebb

Browse files
uittenbroekrobbertuittenbroekrobbert
authored
Setup basic project config (#7)
2 parents 961f19c + 0114584 commit 7321ebb

25 files changed

+1192
-101
lines changed

‎.devcontainer/devcontainer.json‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,17 @@
1616
"streetsidesoftware.code-spell-checker",
1717
"redhat.vscode-yaml",
1818
"charliermarsh.ruff",
19-
"github.vscode-github-actions"
19+
"github.vscode-github-actions",
20+
"mhutchie.git-graph"
2021
],
2122
"settings": {
2223
"editor.formatOnPaste": false,
2324
"editor.formatOnSave": true,
2425
"editor.formatOnType": true,
26+
"editor.renderWhitespace": "boundary",
2527
"files.trimTrailingWhitespace": true,
2628
"terminal.integrated.inheritEnv": true,
29+
"debug.toolBarLocation": "commandCenter",
2730
"terminal.integrated.profiles.linux": {
2831
"zsh": {
2932
"path": "/usr/bin/zsh"

‎.dockerignore‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,4 +12,3 @@ __pycache__/
1212
*$py.class
1313

1414
.venv
15-

‎.github/dependabot.yml‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,11 @@ updates:
88
time: "08:00"
99
timezone: "Europe/Amsterdam"
1010
labels:
11-
- "github-actions"
1211
- "dependencies"
12+
groups:
13+
allgithubactions:
14+
patterns:
15+
- "*"
1316

1417
- package-ecosystem: "pip"
1518
directory: "/"
@@ -19,8 +22,11 @@ updates:
1922
time: "08:00"
2023
timezone: "Europe/Amsterdam"
2124
labels:
22-
- "pip"
2325
- "dependencies"
26+
groups:
27+
allpip:
28+
patterns:
29+
- "*"
2430

2531
- package-ecosystem: "devcontainers"
2632
directory: "/"
@@ -30,5 +36,8 @@ updates:
3036
time: "08:00"
3137
timezone: "Europe/Amsterdam"
3238
labels:
33-
- "devcontainers"
3439
- "dependencies"
40+
groups:
41+
alldevcontainers:
42+
patterns:
43+
- "*"

‎.github/workflows/ci.yml‎

Lines changed: 211 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,211 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
tags:
8+
- 'v*'
9+
pull_request:
10+
branches:
11+
- 'main'
12+
13+
env:
14+
REGISTRY: ghcr.io
15+
POETRY_CACHE_DIR: ~/.cache/pypoetry
16+
IMAGE_NAME: ${{ github.repository }}
17+
PYTHON_VERSION: "3.11"
18+
19+
jobs:
20+
lint:
21+
runs-on: ubuntu-latest
22+
steps:
23+
- uses: actions/checkout@v4
24+
25+
- name: Install poetry
26+
run: pipx install poetry
27+
28+
- name: Set up Python ${{ env.python-version }}
29+
uses: actions/setup-python@v5
30+
with:
31+
python-version: ${{ env.PYTHON_VERSION }}
32+
cache: "poetry"
33+
34+
- name: Install dependencies
35+
run: poetry install
36+
37+
- name: run ruff
38+
run: poetry run ruff check --output-format=github
39+
40+
- name: Run format
41+
run: poetry run ruff format --check
42+
43+
- name: Run pyright
44+
run: poetry run pyright
45+
46+
security:
47+
runs-on: ubuntu-latest
48+
steps:
49+
- uses: actions/checkout@v4
50+
51+
- name: Install poetry
52+
run: pipx install poetry
53+
54+
- name: Set up Python ${{ env.PYTHON_VERSION }}
55+
uses: actions/setup-python@v5
56+
with:
57+
python-version: ${{ env.PYTHON_VERSION }}
58+
cache: "poetry"
59+
60+
- name: Install dependencies
61+
run: poetry install
62+
63+
- name: Generate SBOM
64+
run: poetry run cyclonedx-py poetry > sbom.json
65+
66+
- name: Generate licenses file
67+
run: |
68+
poetry run pip-licenses --order=license --format=json --with-description > licenses.txt
69+
70+
- name: Upload SBOM and licenses
71+
uses: actions/upload-artifact@v4
72+
with:
73+
name: sbom-licenses-${{ github.sha }}.json
74+
path: |
75+
sbom.json
76+
licenses.txt
77+
if-no-files-found: error
78+
overwrite: true
79+
80+
- name: Run Trivy vulnerability scanner
81+
uses: aquasecurity/trivy-action@master
82+
with:
83+
scan-type: 'fs'
84+
scan-ref: '.'
85+
trivy-config: trivy.yaml
86+
87+
test:
88+
runs-on: ubuntu-latest
89+
strategy:
90+
matrix:
91+
python-version: ["3.10", "3.11", "3.12"]
92+
93+
steps:
94+
- uses: actions/checkout@v4
95+
with:
96+
fetch-depth: 0
97+
98+
- name: Install poetry
99+
run: pipx install poetry
100+
101+
- name: Set up Python ${{ matrix.python-version }}
102+
uses: actions/setup-python@v5
103+
with:
104+
python-version: ${{ matrix.python-version }}
105+
cache: "poetry"
106+
107+
- name: Install dependencies
108+
run: poetry install
109+
110+
- name: Run pytest
111+
run: poetry run coverage run -m pytest
112+
113+
- name: run coverage report
114+
run: poetry run coverage report
115+
116+
- name: run coverage html
117+
run: poetry run coverage html
118+
119+
- name: Upload code coverage report
120+
if: matrix.python-version == '3.11'
121+
uses: actions/upload-artifact@v4
122+
with:
123+
name: codecoverage-${{ github.sha }}
124+
path: htmlcov/
125+
if-no-files-found: error
126+
overwrite: true
127+
128+
- name: run coverage xml
129+
run: poetry run coverage xml
130+
131+
- name: SonarCloud Scan
132+
if: matrix.python-version == '3.11'
133+
uses: SonarSource/sonarcloud-github-action@master
134+
env:
135+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
136+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
137+
138+
139+
build:
140+
needs: test
141+
runs-on: ubuntu-latest
142+
permissions:
143+
packages: write
144+
contents: read
145+
security-events: write
146+
actions: read
147+
steps:
148+
- uses: actions/checkout@v4
149+
150+
- name: Log in to the Container registry
151+
uses: docker/login-action@v3
152+
with:
153+
registry: ${{ env.REGISTRY }}
154+
username: ${{ github.actor }}
155+
password: ${{ secrets.GITHUB_TOKEN }}
156+
157+
- name: Set up QEMU
158+
uses: docker/setup-qemu-action@v3
159+
160+
- name: Set up Docker Buildx
161+
uses: docker/setup-buildx-action@v3
162+
163+
- name: Extract metadata for Docker
164+
id: meta
165+
uses: docker/metadata-action@v5
166+
with:
167+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
168+
169+
- name: Build and push Docker image
170+
uses: docker/build-push-action@v5
171+
with:
172+
context: .
173+
push: ${{ github.event_name != 'pull_request' }}
174+
tags: ${{ steps.meta.outputs.tags }}
175+
labels: ${{ steps.meta.outputs.labels }}
176+
platforms: linux/amd64,linux/arm64,darwin/amd64
177+
178+
- name: Run Trivy vulnerability scanner
179+
if: github.event_name != 'pull_request'
180+
uses: aquasecurity/trivy-action@master
181+
with:
182+
image-ref: ${{ steps.meta.outputs.tags }}
183+
trivy-config: trivy.yaml
184+
scan-type: image
185+
exit-code: 0
186+
format: 'sarif'
187+
output: 'trivy-results.sarif'
188+
env:
189+
TRIVY_USERNAME: ${{ github.actor }}
190+
TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
191+
192+
- name: Upload Trivy scan results to GitHub Security tab
193+
if: github.event_name != 'pull_request'
194+
uses: github/codeql-action/upload-sarif@v3
195+
with:
196+
sarif_file: 'trivy-results.sarif'
197+
198+
notifyMattermost:
199+
runs-on: ubuntu-latest
200+
needs: [lint, security, test, build ]
201+
if: ${{ always() && contains(needs.*.result, 'failure') }}
202+
steps:
203+
- uses: mattermost/action-mattermost-notify@master
204+
if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
205+
with:
206+
MATTERMOST_WEBHOOK_URL: ${{ secrets.MM_WEBHOOK_URL }}
207+
MATTERMOST_CHANNEL: dev
208+
TEXT: |
209+
${{ github.repository }} failed build @here :unamused:
210+
:rotating_light: [Pipeline](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) failed :fire:
211+
MATTERMOST_USERNAME: ${{ github.triggering_actor }}

‎.github/workflows/codeql.yml‎

Lines changed: 5 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -8,31 +8,25 @@ on:
88

99
jobs:
1010
analyze:
11-
name: Analyze (${{ matrix.language }})
11+
name: Analyze (python)
1212
runs-on: 'ubuntu-latest'
1313
timeout-minutes: 360
1414
permissions:
1515
security-events: write
1616
packages: read
1717
actions: read
1818
contents: read
19-
strategy:
20-
fail-fast: false
21-
matrix:
22-
include:
23-
- language: python
24-
build-mode: none
19+
2520
steps:
2621
- name: Checkout repository
2722
uses: actions/checkout@v4
28-
23+
2924
- name: Initialize CodeQL
3025
uses: github/codeql-action/init@v3
3126
with:
32-
languages: ${{ matrix.language }}
33-
build-mode: ${{ matrix.build-mode }}
27+
languages: python
3428

3529
- name: Perform CodeQL Analysis
3630
uses: github/codeql-action/analyze@v3
3731
with:
38-
category: "/language:${{matrix.language}}"
32+
category: "/language:python"

‎.github/workflows/first-interaction.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ on: [pull_request, issues]
55
jobs:
66
greeting:
77
runs-on: ubuntu-latest
8+
timeout-minutes: 10
89
permissions:
910
issues: write
1011
pull-requests: write

‎.github/workflows/stale.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,9 @@ on:
77
jobs:
88
stale:
99
runs-on: ubuntu-latest
10+
timeout-minutes: 10
1011
permissions:
11-
contents: write # only for delete-branch option
12+
contents: write
1213
issues: write
1314
pull-requests: write
1415
steps:

‎.gitignore‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ __pycache__/
33
*.py[cod]
44
*$py.class
55

6+
# poetry build
7+
dist/
68

79
# Unit test / coverage reports
810
.coverage
@@ -22,6 +24,5 @@ __pypackages__/
2224
# ruff linter
2325
.ruff_cache/
2426

25-
26-
27-
27+
#mypyr
28+
.mypy_cache/

‎.pre-commit-config.yaml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,6 @@ repos:
1818
hooks:
1919
- id: ruff
2020
- id: ruff-format
21-
- repo: https://github.com/RobertCraigie/pyright-python
22-
rev: v1.1.359
23-
hooks:
24-
- id: pyright
2521

2622
ci:
2723
autofix_prs: false

python_project/__init__.py renamed to .trivyignore

File renamed without changes.

0 commit comments

Comments
 (0)