test: add gh workflow for tiobe TICS static analysis reporting #6654
Conversation
There was a problem hiding this comment.
Pull request overview
This PR adds a GitHub Actions workflow to automate weekly Tiobe TICS static analysis reporting, migrating this functionality from Jenkins to enable retirement of an internal Jenkins job.
Key changes:
- Introduces a new weekly scheduled workflow for TICS static analysis
- Configures the workflow to run on self-hosted runners with specific requirements
- Sets up dependency installation, coverage generation, and TICS analysis execution
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
.github/workflows/weekly-tics.yml
Outdated
|
|
||
| - name: Coverage | ||
| run: | | ||
| make coverage |
There was a problem hiding this comment.
No such make target exists in this repo.
There was a problem hiding this comment.
Thanks, I hadn't committed changes for this stage to create TICS coverage artifacts. I've adapted them now from our server-jenkins/cloud-init/other job Link corrected for server-jenkins-job
There was a problem hiding this comment.
Thanks, I hadn't committed changes for this stage to create TICS coverage artifacts. I've adapted them now from our server-jenkins/cloud-init/other job
wrong link?
holmanb
left a comment
holmanb
left a comment
There was a problem hiding this comment.
Thanks for the clarifications @blackboxsw. I just added more feedback.
| - name: Generate TICS artifacts | ||
| run: | | ||
| mkdir .cover | ||
| python3 -m pytest --cov=cloudinit --cov-report=xml:.cover/coverage.xml || true |
There was a problem hiding this comment.
This is the wrong file name.
Why are we installing tox but not using it? I suspect we might not need wireguard or ubuntu-dev-tools either. I'd say that we should use just tox or just the read-dependencies script, but not both. And I lean towards tox's simplicity over depending on a home-grown script but I'll leave it up to you.
| on: | ||
| workflow_dispatch: | ||
| schedule: | ||
| - cron: '17 5 * * 6' # Run at 5:17a (arbitrary) on Saturday |
| # Best practices per https://library.canonical.com/corporate-policies/ | ||
| # information-security-policies/ssdlc/ssdlc---static-code-analysis |
There was a problem hiding this comment.
Since the doc applies to the whole file the top of the file seems like a more appropriate location.
Can we please not break the link?
Including "Best practices per" is unnecessary: it doesn't add value over just the link.
2 participants
Process improvement moving some of our Tiobe TICS automation out of Jenkins and into GH actions.
Scheduling weekly reports from GH workflows will allow us to retire an internal cloud-init jenkins job.
Proposed Commit Message
Additional Context
Test Steps
Merge type