Skip to content

Commit 873d5fb

Browse files
joke1196joke1196
authored
PYSCAN-45: Migrate CI from GitHub Action to Cirrus (#33)
1 parent f7504db commit 873d5fb

File tree

4 files changed

+142
-127
lines changed

4 files changed

+142
-127
lines changed

‎.cirrus.star

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
load("github.com/SonarSource/cirrus-modules@v2", "load_features")
2+
3+
def main(ctx):
4+
return load_features(ctx)

‎.cirrus.yml

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
env:
2+
ARTIFACTORY_URL: VAULT[development/kv/data/repox data.url]
3+
ARTIFACTORY_PRIVATE_USERNAME: vault-${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-private-reader
4+
ARTIFACTORY_PRIVATE_PASSWORD: VAULT[development/artifactory/token/${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-private-reader access_token]
5+
ARTIFACTORY_DEPLOY_USERNAME: vault-${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-qa-deployer
6+
ARTIFACTORY_DEPLOY_PASSWORD: VAULT[development/artifactory/token/${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-qa-deployer access_token]
7+
#Possible values for ARTIFACTORY_DEPLOY_REPO: sonarsource-private-qa, sonarsource-public-qa
8+
ARTIFACTORY_DEPLOY_REPO: sonarsource-public-qa
9+
REPOX_URL: VAULT[development/kv/data/repox data.url]
10+
GITHUB_TOKEN: VAULT[development/github/token/licenses-ro token]
11+
SONAR_TOKEN: VAULT[development/kv/data/sonarcloud data.token]
12+
SONAR_HOST_URL: https://sonarcloud.io
13+
14+
only_sonarsource_qa: &ONLY_SONARSOURCE_QA
15+
only_if: $CIRRUS_USER_COLLABORATOR == 'true' && $CIRRUS_TAG == "" && ($CIRRUS_PR != "" || $CIRRUS_BRANCH == "master" || $CIRRUS_BRANCH =~ "feature/*" || $CIRRUS_BRANCH =~ "dogfood-on-.*")
16+
17+
container_definition: &CONTAINER_DEFINITION
18+
dockerfile: .cirrus/poetry.Dockerfile
19+
cluster_name: ${CIRRUS_CLUSTER_NAME}
20+
region: eu-central-1
21+
builder_image_name: POETRY_VM
22+
builder_role: cirrus-builder
23+
builder_image: docker-builder-v*
24+
builder_instance_type: t3.small
25+
builder_subnet_id: ${CIRRUS_AWS_SUBNET}
26+
zone: eu-central-1
27+
namespace: default
28+
use_in_memory_disk: true
29+
docker_arguments:
30+
CIRRUS_AWS_ACCOUNT: ${CIRRUS_AWS_ACCOUNT}
31+
DEPLOY_PULL_REQUEST: true
32+
cpu: 3
33+
memory: 8G
34+
35+
36+
.poetry_template: &POETRY_TEMPLATE
37+
<<: *ONLY_SONARSOURCE_QA
38+
eks_container:
39+
<<: *CONTAINER_DEFINITION
40+
poetry_script:
41+
- poetry config repositories.repox "${REPOX_URL}/api/pypi/sonarsource-pypi/simple/"
42+
- poetry config http-basic.repox "${ARTIFACTORY_PRIVATE_USERNAME}" "${ARTIFACTORY_PRIVATE_PASSWORD}"
43+
- poetry install
44+
45+
formatting_task:
46+
<<: *POETRY_TEMPLATE
47+
alias: formatting
48+
name: "Formatting"
49+
formatting_script:
50+
- poetry run black src/ tests/ --check
51+
- poetry run licenseheaders -t license_header.tmpl -o "SonarSource SA" -y 2011-2024 -n "Sonar Scanner Python" -E .py -d src/
52+
- poetry run licenseheaders -t license_header.tmpl -o "SonarSource SA" -y 2011-2024 -n "Sonar Scanner Python" -E .py -d tests/
53+
- poetry run licenseheaders -t license_header.tmpl -o "SonarSource SA" -y 2011-2024 -n "Sonar Scanner Python" -E .py -d its/ -x its/sources/**.py
54+
- git diff --name-only --exit-code ./src ./tests ./its
55+
56+
analysis_task:
57+
<<: *POETRY_TEMPLATE
58+
alias: analysis
59+
name: "SC Analysis"
60+
analysis_script:
61+
- poetry run pytest --cov-report=xml:coverage.xml --cov-config=pyproject.toml --cov=src --cov-branch tests
62+
- sonar-scanner -Dsonar.organization=sonarsource -DbuildNumber=${CI_BUILD_NUMBER}
63+
64+
qa_task:
65+
alias: qa
66+
matrix:
67+
- name: "Test Python 3.8"
68+
eks_container:
69+
docker_arguments:
70+
PYTHON_VERSION: 3.8.18
71+
- name: "Test Python 3.9"
72+
eks_container:
73+
docker_arguments:
74+
PYTHON_VERSION: 3.9.18
75+
- name: "Test Python 3.10"
76+
eks_container:
77+
docker_arguments:
78+
PYTHON_VERSION: 3.10.13
79+
- name: "Test Python 3.11"
80+
eks_container:
81+
docker_arguments:
82+
PYTHON_VERSION: 3.11.7
83+
- name: "Test Python 3.12"
84+
eks_container:
85+
docker_arguments:
86+
PYTHON_VERSION: 3.12.1
87+
<<: *POETRY_TEMPLATE
88+
qa_script:
89+
- poetry run pytest tests/
90+
91+
publish_task:
92+
depends_on:
93+
- formatting
94+
- analysis
95+
- qa
96+
<<: *POETRY_TEMPLATE
97+
name: "Publish (Repox)"
98+
publish_script:
99+
- poetry version patch
100+
- poetry version $(poetry version -s).dev${CI_BUILD_NUMBER}
101+
- poetry build
102+
- poetry config repositories.sonarsource https://repox.jfrog.io/artifactory/api/pypi/sonarsource-pypi-builds
103+
- poetry publish -r sonarsource --username ${ARTIFACTORY_DEPLOY_USERNAME} --password ${ARTIFACTORY_DEPLOY_PASSWORD} --verbose
104+

‎.cirrus/poetry.Dockerfile

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
ARG CIRRUS_AWS_ACCOUNT=275878209202
2+
FROM ${CIRRUS_AWS_ACCOUNT}.dkr.ecr.eu-central-1.amazonaws.com/base:j17-latest
3+
4+
USER root
5+
6+
ARG SCANNER_VERSION=5.0.1.3006
7+
ARG PYTHON_VERSION=3.12.1
8+
9+
# install required dependencies to build Python from source see: https://devguide.python.org/getting-started/setup-building/#install-dependencies
10+
RUN apt-get update && apt-get install -y build-essential zlib1g-dev libncurses5-dev libgdbm-dev libnss3-dev libssl-dev libsqlite3-dev libreadline-dev libffi-dev curl libbz2-dev
11+
RUN curl -O https://www.python.org/ftp/python/${PYTHON_VERSION}/Python-${PYTHON_VERSION}.tar.xz
12+
RUN tar -xf Python-${PYTHON_VERSION}.tar.xz
13+
RUN cd Python-${PYTHON_VERSION} && ./configure && make -s -j 4 && make altinstall
14+
RUN cd /usr/local/bin \
15+
&& ln -s python${PYTHON_VERSION%.*} python \
16+
&& ln -s python${PYTHON_VERSION%.*} python3 \
17+
&& ln -s pip${PYTHON_VERSION%.*} pip \
18+
&& ln -s pip${PYTHON_VERSION%.*} pip3
19+
20+
RUN curl "https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-${SCANNER_VERSION}.zip" -o /tmp/sonar-scanner.zip \
21+
&& unzip -d /opt /tmp/sonar-scanner.zip \
22+
&& mv /opt/sonar-scanner-${SCANNER_VERSION} /opt/sonar-scanner \
23+
&& rm /tmp/sonar-scanner.zip
24+
25+
USER sonarsource
26+
27+
RUN curl -sSL https://install.python-poetry.org | python3 -
28+
ENV PATH=/usr/bin:$PATH
29+
ENV PATH="/home/sonarsource/bin:${PATH}"
30+
ENV PATH="${PATH}:/opt/sonar-scanner/bin"
31+
ENV PATH="${PATH}:/home/sonarsource/.local/bin"
32+
33+
ENV SONARCLOUD_ANALYSIS true
34+

‎.github/workflows/build-pr.yml

Lines changed: 0 additions & 127 deletions
Original file line numberDiff line numberDiff line change
@@ -9,99 +9,6 @@ on:
99
- 'feature/**'
1010

1111
jobs:
12-
test:
13-
runs-on: ubuntu-latest
14-
permissions:
15-
id-token: write # required by SonarSource/vault-action-wrapper
16-
contents: read # required by actions/checkout
17-
strategy:
18-
fail-fast: false
19-
matrix:
20-
python-version: ["3.8", "3.9", "3.10", "3.11", "3.12"]
21-
steps:
22-
- name: Get vault secrets
23-
id: secrets
24-
uses: SonarSource/vault-action-wrapper@v2
25-
with:
26-
secrets: |
27-
development/artifactory/token/{REPO_OWNER_NAME_DASH}-private-reader role | ARTIFACTORY_ROLE;
28-
development/artifactory/token/{REPO_OWNER_NAME_DASH}-private-reader access_token | ARTIFACTORY_PASSWORD;
29-
development/kv/data/repox url | REPOX_URL;
30-
- uses: actions/checkout@v3
31-
- name: Install Poetry
32-
run: |
33-
pipx install poetry
34-
- name: Set up Python ${{ matrix.python-version }}
35-
uses: actions/setup-python@v4
36-
with:
37-
python-version: ${{ matrix.python-version }}
38-
cache: "poetry"
39-
- name: Install dependencies
40-
env:
41-
ARTIFACTORY_USERNAME: vault-${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_ROLE }}
42-
ARTIFACTORY_PASSWORD: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_PASSWORD }}
43-
REPOX_URL: ${{ fromJSON(steps.secrets.outputs.vault).REPOX_URL }}
44-
run: |
45-
poetry config repositories.repox "${REPOX_URL}/api/pypi/sonarsource-pypi/simple/"
46-
poetry config http-basic.repox "${ARTIFACTORY_USERNAME}" "${ARTIFACTORY_PASSWORD}"
47-
poetry install
48-
- name: Check tests
49-
run: |
50-
poetry run pytest tests/
51-
analysis:
52-
runs-on: ubuntu-latest
53-
permissions:
54-
id-token: write # required by SonarSource/vault-action-wrapper
55-
contents: read # required by actions/checkout
56-
pull-requests: read # required by SonarSource/sonarcloud-github-action
57-
strategy:
58-
fail-fast: false
59-
steps:
60-
- name: Get vault secrets
61-
id: secrets
62-
uses: SonarSource/vault-action-wrapper@v2
63-
with:
64-
secrets: |
65-
development/artifactory/token/{REPO_OWNER_NAME_DASH}-private-reader role | ARTIFACTORY_ROLE;
66-
development/artifactory/token/{REPO_OWNER_NAME_DASH}-private-reader access_token | ARTIFACTORY_PASSWORD;
67-
development/kv/data/repox url | REPOX_URL;
68-
development/kv/data/sonarcloud token | SONARCLOUD_TOKEN;
69-
- uses: actions/checkout@v3
70-
- name: Install Poetry
71-
run: |
72-
pipx install poetry
73-
- name: Set up Python
74-
uses: actions/setup-python@v4
75-
with:
76-
python-version: |
77-
3.12
78-
cache: "poetry"
79-
- name: Install dependencies
80-
env:
81-
ARTIFACTORY_USERNAME: vault-${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_ROLE }}
82-
ARTIFACTORY_PASSWORD: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_PASSWORD }}
83-
REPOX_URL: ${{ fromJSON(steps.secrets.outputs.vault).REPOX_URL }}
84-
run: |
85-
poetry config repositories.repox "${REPOX_URL}/api/pypi/sonarsource-pypi/simple/"
86-
poetry config http-basic.repox "${ARTIFACTORY_USERNAME}" "${ARTIFACTORY_PASSWORD}"
87-
poetry install
88-
- name: Check formatting
89-
run: |
90-
poetry run black src/ tests/ --check
91-
- name: Check licensing
92-
run: |
93-
poetry run licenseheaders -t license_header.tmpl -o "SonarSource SA" -y 2011-2024 -n "Sonar Scanner Python" -E .py -d src/
94-
poetry run licenseheaders -t license_header.tmpl -o "SonarSource SA" -y 2011-2024 -n "Sonar Scanner Python" -E .py -d tests/
95-
poetry run licenseheaders -t license_header.tmpl -o "SonarSource SA" -y 2011-2024 -n "Sonar Scanner Python" -E .py -d its/ -x its/sources/**.py
96-
git diff --name-only --exit-code ./src ./tests ./its
97-
- name: Check tests and generate coverage
98-
run: |
99-
poetry run pytest --cov-report=xml:coverage.xml --cov-config=pyproject.toml --cov=src --cov-branch tests
100-
- name: SonarCloud Scan
101-
uses: SonarSource/sonarcloud-github-action@master
102-
env:
103-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
104-
SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONARCLOUD_TOKEN }}
10512
integration_tests:
10613
runs-on: ubuntu-latest
10714
permissions:
@@ -144,37 +51,3 @@ jobs:
14451
working-directory: ./its
14552
run: |
14653
poetry run pytest
147-
publish:
148-
runs-on: ubuntu-latest
149-
permissions:
150-
id-token: write # required by SonarSource/vault-action-wrapper
151-
contents: read # required by actions/checkout
152-
strategy:
153-
fail-fast: false
154-
steps:
155-
- name: Get vault secrets
156-
id: secrets
157-
uses: SonarSource/vault-action-wrapper@v2
158-
with:
159-
secrets: |
160-
development/artifactory/token/{REPO_OWNER_NAME_DASH}-qa-deployer access_token | ARTIFACTORY_PASSWORD_QA;
161-
- uses: actions/checkout@v3
162-
- name: Set up Python
163-
uses: actions/setup-python@v4
164-
with:
165-
python-version: |
166-
3.12
167-
- name: Install Poetry
168-
run: |
169-
pipx install poetry
170-
- name: Configure pypi repo
171-
run: poetry config repositories.sonarsource https://repox.jfrog.io/artifactory/api/pypi/sonarsource-pypi-builds
172-
- name: Build and publish
173-
env:
174-
ARTIFACTORY_PYPI_DEPLOYER_USER: vault-SonarSource-sonar-scanner-python-qa-deployer
175-
ARTIFACTORY_PYPI_DEPLOYER_API_KEY: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_PASSWORD_QA }}
176-
run: |
177-
poetry version patch
178-
poetry version $(poetry version -s).dev${{ github.run_number }}
179-
poetry build
180-
poetry publish -r sonarsource --username $ARTIFACTORY_PYPI_DEPLOYER_USER --password $ARTIFACTORY_PYPI_DEPLOYER_API_KEY --verbose

0 commit comments

Comments
 (0)