@@ -12,20 +12,38 @@ jobs:
12
12
test :
13
13
runs-on : ubuntu-latest
14
14
permissions :
15
+ id-token : write # required by SonarSource/vault-action-wrapper
15
16
contents : read # required by actions/checkout
16
17
strategy :
17
18
fail-fast : false
18
19
matrix :
19
20
python-version : ["3.8", "3.9", "3.10", "3.11", "3.12"]
20
21
steps :
22
+ - name : Get vault secrets
23
+ id : secrets
24
+ uses : SonarSource/vault-action-wrapper@v2
25
+ with :
26
+ secrets : |
27
+ development/artifactory/token/{REPO_OWNER_NAME_DASH}-private-reader role | ARTIFACTORY_ROLE;
28
+ development/artifactory/token/{REPO_OWNER_NAME_DASH}-private-reader access_token | ARTIFACTORY_PASSWORD;
29
+ development/kv/data/repox url | REPOX_URL;
21
30
- uses : actions/checkout@v3
31
+ - name : Install Poetry
32
+ run : |
33
+ pipx install poetry
22
34
- name : Set up Python ${{ matrix.python-version }}
23
35
uses : actions/setup-python@v4
24
36
with :
25
37
python-version : ${{ matrix.python-version }}
38
+ cache : " poetry"
26
39
- name : Install dependencies
40
+ env :
41
+ ARTIFACTORY_USERNAME : vault-${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_ROLE }}
42
+ ARTIFACTORY_PASSWORD : ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_PASSWORD }}
43
+ REPOX_URL : ${{ fromJSON(steps.secrets.outputs.vault).REPOX_URL }}
27
44
run : |
28
- pipx install poetry
45
+ poetry config repositories.repox "${REPOX_URL}/api/pypi/sonarsource-pypi/simple/"
46
+ poetry config http-basic.repox "${ARTIFACTORY_USERNAME}" "${ARTIFACTORY_PASSWORD}"
29
47
poetry install
30
48
- name : Check tests
31
49
run : |
@@ -44,34 +62,83 @@ jobs:
44
62
uses : SonarSource/vault-action-wrapper@v2
45
63
with :
46
64
secrets : |
65
+ development/artifactory/token/{REPO_OWNER_NAME_DASH}-private-reader role | ARTIFACTORY_ROLE;
47
66
development/artifactory/token/{REPO_OWNER_NAME_DASH}-private-reader access_token | ARTIFACTORY_PASSWORD;
48
67
development/kv/data/repox url | REPOX_URL;
49
68
development/kv/data/sonarcloud token | SONARCLOUD_TOKEN;
50
69
- uses : actions/checkout@v3
51
- - name : Set up Python
70
+ - name : Install Poetry
71
+ run : |
72
+ pipx install poetry
73
+ - name : Set up Python
52
74
uses : actions/setup-python@v4
53
75
with :
54
76
python-version : |
55
77
3.12
78
+ cache : " poetry"
56
79
- name : Install dependencies
80
+ env :
81
+ ARTIFACTORY_USERNAME : vault-${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_ROLE }}
82
+ ARTIFACTORY_PASSWORD : ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_PASSWORD }}
83
+ REPOX_URL : ${{ fromJSON(steps.secrets.outputs.vault).REPOX_URL }}
57
84
run : |
58
- pipx install poetry
85
+ poetry config repositories.repox "${REPOX_URL}/api/pypi/sonarsource-pypi/simple/"
86
+ poetry config http-basic.repox "${ARTIFACTORY_USERNAME}" "${ARTIFACTORY_PASSWORD}"
59
87
poetry install
60
88
- name : Check formatting
61
89
run : |
62
90
poetry run black src/ tests/ --check
63
91
- name : Check licensing
64
92
run : |
65
- poetry run licenseheaders -t license_header.tmpl -o "SonarSource SA" -y 2011-2023 -n "Sonar Scanner Python" -E .py -d src/
66
- poetry run licenseheaders -t license_header.tmpl -o "SonarSource SA" -y 2011-2023 -n "Sonar Scanner Python" -E .py -d tests/
67
- git diff --name-only --exit-code ./src ./tests
93
+ poetry run licenseheaders -t license_header.tmpl -o "SonarSource SA" -y 2011-2024 -n "Sonar Scanner Python" -E .py -d src/
94
+ poetry run licenseheaders -t license_header.tmpl -o "SonarSource SA" -y 2011-2024 -n "Sonar Scanner Python" -E .py -d tests/
95
+ poetry run licenseheaders -t license_header.tmpl -o "SonarSource SA" -y 2011-2024 -n "Sonar Scanner Python" -E .py -d its/ -x its/sources/**.py
96
+ git diff --name-only --exit-code ./src ./tests ./its
68
97
- name : Check tests and generate coverage
69
98
run : |
70
99
poetry run pytest --cov-report=xml:coverage.xml --cov-config=pyproject.toml --cov=src --cov-branch tests
71
- env :
72
- ARTIFACTORY_ACCESS_TOKEN : ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_PASSWORD }}
73
100
- name : SonarCloud Scan
74
101
uses : SonarSource/sonarcloud-github-action@master
75
102
env :
76
103
GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
77
104
SONAR_TOKEN : ${{ fromJSON(steps.secrets.outputs.vault).SONARCLOUD_TOKEN }}
105
+ integration_tests :
106
+ runs-on : ubuntu-latest
107
+ permissions :
108
+ id-token : write # required by SonarSource/vault-action-wrapper
109
+ contents : read # required by actions/checkout
110
+ strategy :
111
+ fail-fast : false
112
+ steps :
113
+ - name : Get vault secrets
114
+ id : secrets
115
+ uses : SonarSource/vault-action-wrapper@v2
116
+ with :
117
+ secrets : |
118
+ development/artifactory/token/{REPO_OWNER_NAME_DASH}-private-reader role | ARTIFACTORY_ROLE;
119
+ development/artifactory/token/{REPO_OWNER_NAME_DASH}-private-reader access_token | ARTIFACTORY_PASSWORD;
120
+ development/kv/data/repox url | REPOX_URL;
121
+ - uses : actions/checkout@v3
122
+ - name : Install Poetry
123
+ run : |
124
+ pipx install poetry
125
+ - name : Set up Python
126
+ uses : actions/setup-python@v4
127
+ with :
128
+ python-version : |
129
+ 3.12
130
+ cache : " poetry"
131
+ - name : Install its dependencies
132
+ working-directory : ./its
133
+ env :
134
+ ARTIFACTORY_USERNAME : vault-${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_ROLE }}
135
+ ARTIFACTORY_PASSWORD : ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_PASSWORD }}
136
+ REPOX_URL : ${{ fromJSON(steps.secrets.outputs.vault).REPOX_URL }}
137
+ run : |
138
+ poetry config repositories.repox "${REPOX_URL}/api/pypi/sonarsource-pypi/simple/"
139
+ poetry config http-basic.repox "${ARTIFACTORY_USERNAME}" "${ARTIFACTORY_PASSWORD}"
140
+ poetry install
141
+ - name : Run integration tests
142
+ working-directory : ./its
143
+ run : |
144
+ poetry run pytest
0 commit comments