Merge pull request #1004 from Smartappli/renovate/docker.io-smartappl… #1270
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Global Code Quality | |
| on: | |
| push: | |
| branches: [ "master" ] | |
| pull_request: | |
| # The branches below must be a subset of the branches above | |
| branches: [ "master" ] | |
| schedule: | |
| - cron: '30 3 * * *' | |
| concurrency: | |
| group: global-code-quality-${{ github.event_name == 'pull_request' && format('{0}-{1}', github.workflow, github.event.pull_request.number) || github.workflow_ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| codacy-security-scan: | |
| permissions: | |
| contents: read # for actions/checkout to fetch code | |
| security-events: write # for github/codeql-action/upload-sarif to upload SARIF results | |
| actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status | |
| name: Codacy Security Scan | |
| runs-on: ubuntu-latest | |
| env: | |
| CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }} | |
| steps: | |
| # Checkout the repository to the GitHub Actions runner | |
| - name: Checkout code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | |
| # Execute Codacy Analysis CLI and generate a SARIF output with the security issues identified during the analysis | |
| - name: Run Codacy Analysis CLI | |
| if: env.CODACY_PROJECT_TOKEN != '' | |
| uses: codacy/codacy-analysis-cli-action@562ee3e92b8e92df8b67e0a5ff8aa8e261919c08 | |
| with: | |
| # Check https://github.com/codacy/codacy-analysis-cli#project-token to get your project token from your Codacy repository | |
| # You can also omit the token and run the tools that support default configurations | |
| project-token: ${{ env.CODACY_PROJECT_TOKEN }} | |
| verbose: true | |
| output: results.sarif | |
| format: sarif | |
| # Adjust severity of non-security issues | |
| gh-code-scanning-compat: true | |
| # Force 0 exit code to allow SARIF file generation | |
| # This will handover control about PR rejection to the GitHub side | |
| max-allowed-issues: 2147483647 | |
| - name: Skip Codacy when token is not configured | |
| if: env.CODACY_PROJECT_TOKEN == '' | |
| run: echo "CODACY_PROJECT_TOKEN is not configured; skipping Codacy scan." | |
| sonarcloud: | |
| name: SonarCloud | |
| runs-on: ubuntu-latest | |
| env: | |
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | |
| with: | |
| fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis | |
| - name: Set up Python | |
| if: env.SONAR_TOKEN != '' | |
| uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 | |
| with: | |
| python-version: '3.13' | |
| - name: Install uv | |
| if: env.SONAR_TOKEN != '' | |
| run: | | |
| python -m pip install \ | |
| --disable-pip-version-check \ | |
| --no-cache-dir \ | |
| --only-binary=:all: \ | |
| pip==26.1.1 \ | |
| uv==0.11.17 | |
| - name: AIMER coverage | |
| if: env.SONAR_TOKEN != '' | |
| env: | |
| DEBUG: '1' | |
| DJANGO_SETTINGS_MODULE: AIMER.settings | |
| SECRET_KEY: sonar-test-secret-key | |
| SECURE_SSL_REDIRECT: '0' | |
| run: | | |
| python -m uv --directory services/aimer-web sync --locked | |
| python -m uv --directory services/aimer-web run --locked python -m coverage erase | |
| python -m uv --directory services/aimer-web run --locked python -m coverage run --parallel-mode --source=AIMER,auth,website,RAG -m pytest -q auth website RAG/tests | |
| python -m uv --directory services/aimer-web run --locked python -m coverage combine | |
| python -m uv --directory services/aimer-web run --locked python -m coverage xml -o ../../coverage-aimer-web.xml | |
| - name: FARM coverage | |
| if: env.SONAR_TOKEN != '' | |
| env: | |
| DJANGO_SECRET_KEY: sonar-test-secret-key | |
| DJANGO_SECURE_SSL_REDIRECT: '0' | |
| run: | | |
| python -m uv --directory services/FARM sync --locked | |
| python -m uv --directory services/FARM run --locked python -m coverage erase | |
| python -m uv --directory services/FARM run --locked python -m coverage run --parallel-mode --source=FARM -m pytest -q tests | |
| python -m uv --directory services/FARM run --locked python -m coverage combine | |
| python -m uv --directory services/FARM run --locked python -m coverage xml -o ../../coverage-farm.xml | |
| - name: MAGE coverage | |
| if: env.SONAR_TOKEN != '' | |
| run: | | |
| python -m uv --directory services/MAGE sync --locked | |
| python -m uv --directory services/MAGE run --locked python -m coverage erase | |
| python -m uv --directory services/MAGE run --locked python -m coverage run --parallel-mode --source=api -m pytest -q -m "not slow" tests | |
| python -m uv --directory services/MAGE run --locked python -m coverage combine | |
| python -m uv --directory services/MAGE run --locked python -m coverage xml -o ../../coverage-mage.xml | |
| - name: SonarQube Scan | |
| if: env.SONAR_TOKEN != '' | |
| uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e | |
| with: | |
| args: > | |
| -Dsonar.python.coverage.reportPaths=coverage-aimer-web.xml,coverage-farm.xml,coverage-mage.xml | |
| env: | |
| SONAR_TOKEN: ${{ env.SONAR_TOKEN }} | |
| - name: Skip SonarCloud when token is not configured | |
| if: env.SONAR_TOKEN == '' | |
| run: echo "SONAR_TOKEN is not configured; skipping SonarCloud scan." |