Skip to content

Commit c410c8e

Browse files
sdn4zsdn4z
authored
Merge pull request #3 from sdn4z/github2
ci: add workflows
2 parents abb3bd9 + 5c29540 commit c410c8e

File tree

10 files changed

+348
-0
lines changed

10 files changed

+348
-0
lines changed

‎.github/dependabot.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "pip"
4+
directory: "/"
5+
schedule:
6+
interval: "weekly"
7+
day: "monday"
8+
labels:
9+
- "dependencies"
10+
commit-message:
11+
prefix: "chore"
12+
groups:
13+
patch-updates:
14+
patterns:
15+
- "*"
16+
update-types:
17+
- "patch"
18+
minor-updates:
19+
patterns:
20+
- "*"
21+
update-types:
22+
- "minor"

‎.github/release.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
changelog:
2+
exclude:
3+
labels:
4+
- ignore-for-release
5+
authors:
6+
- octocat
7+
categories:
8+
- title: Breaking Changes 🚨
9+
labels:
10+
- breaking
11+
- title: New Features 🎉
12+
labels:
13+
- feature
14+
- title: Fixes 🔧
15+
labels:
16+
- fix
17+
- title: Other Changes
18+
labels:
19+
- "*"

‎.github/workflows/auto-merge.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: Dependabot auto-approve
2+
on: pull_request_target
3+
4+
permissions:
5+
contents: write
6+
pull-requests: write
7+
8+
jobs:
9+
dependabot:
10+
runs-on: ubuntu-latest
11+
if: ${{ github.actor == 'dependabot[bot]' }}
12+
steps:
13+
- name: Dependabot metadata
14+
id: metadata
15+
uses: dependabot/[email protected]
16+
with:
17+
github-token: "${{ secrets.GITHUB_TOKEN }}"
18+
- name: Enable auto-merge for Dependabot PRs
19+
if: ${{ steps.metadata.outputs.update-type != 'version-update:semver-major'}}
20+
run: gh pr merge --auto --squash "$PR_URL"
21+
env:
22+
PR_URL: ${{github.event.pull_request.html_url}}
23+
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

‎.github/workflows/bumpversion.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: Bump version
2+
3+
on:
4+
workflow_dispatch:
5+
6+
jobs:
7+
bump_version:
8+
if: ${{ !startsWith(github.event.head_commit.message, 'bump:') && github.ref == 'refs/heads/main' }}
9+
runs-on: ubuntu-latest
10+
name: "Bump version and create changelog with commitizen"
11+
steps:
12+
- uses: actions/create-github-app-token@v1
13+
id: app-token
14+
with:
15+
app-id: ${{ vars.ELEMENTSINTERACTIVE_BOT_APP_ID }}
16+
private-key: ${{ secrets.ELEMENTSINTERACTIVE_BOT_PRIVATE_KEY }}
17+
- uses: actions/checkout@v4
18+
with:
19+
fetch-depth: 0
20+
token: ${{ steps.app-token.outputs.token }}
21+
ref: ${{ github.head_ref }}
22+
# Make sure the value of GITHUB_TOKEN will not be persisted in repo's config
23+
persist-credentials: false
24+
- id: cz
25+
name: Create bump and changelog
26+
uses: commitizen-tools/commitizen-action@master
27+
with:
28+
github_token: ${{ steps.app-token.outputs.token }}
29+
- name: Print Version
30+
run: echo "Bumped to version ${{ steps.cz.outputs.version }}"

‎.github/workflows/conventional-label.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
on:
2+
pull_request_target:
3+
types: [ opened, edited ]
4+
name: conventional-release-labels
5+
jobs:
6+
label:
7+
runs-on: ubuntu-latest
8+
steps:
9+
- uses: bcoe/conventional-release-labels@v1
10+
with:
11+
type_labels: '{"feat": "feature", "fix": "fix", "breaking": "breaking", "ci": "CI"}'

‎.github/workflows/lgtm.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
name: LGTM Review
2+
3+
on:
4+
issue_comment:
5+
types: [created]
6+
7+
jobs:
8+
lgtm-review:
9+
if: |
10+
github.event.issue.pull_request &&
11+
startsWith(github.event.comment.body, '/lgtm review')
12+
runs-on: ubuntu-latest
13+
steps:
14+
- name: Check if commenter has write access
15+
id: check-permission
16+
env:
17+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
18+
run: |
19+
USER=${{ github.event.comment.user.login }}
20+
REPO=${{ github.repository }}
21+
PERMISSION=$(curl -s -H "Authorization: Bearer $GITHUB_TOKEN" \
22+
https://api.github.com/repos/$REPO/collaborators/$USER/permission \
23+
| jq -r '.permission')
24+
25+
if [[ "$PERMISSION" == "admin" || "$PERMISSION" == "maintain" || "$PERMISSION" == "write" ]]; then
26+
echo "HAS_PERMISSION=true" >> $GITHUB_ENV
27+
else
28+
echo "HAS_PERMISSION=false" >> $GITHUB_ENV
29+
fi
30+
31+
- name: Fail if unauthorized
32+
if: env.HAS_PERMISSION == 'false'
33+
run: |
34+
echo "User ${{ github.event.comment.user.login }} is not authorized to trigger this workflow."
35+
exit 1
36+
37+
- name: Checkout PR code
38+
uses: actions/checkout@v4
39+
with:
40+
ref: refs/pull/${{ github.event.issue.number }}/merge
41+
42+
- name: Run LGTM Review
43+
run: |
44+
docker run --rm elementsinteractive/lgtm-ai \
45+
review \
46+
--pr-url "https://github.com/${{ github.repository }}/pull/${{ github.event.issue.number }}" \
47+
--git-api-key "${{ secrets.GITHUB_TOKEN }}" \
48+
--ai-api-key "${{ secrets.AI_API_TOKEN }}" \
49+
-vv

‎.github/workflows/lint.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# This workflow will check our code for having a proper format, as well as the commit message to meet the expected ones
2+
3+
name: Lint
4+
5+
on:
6+
push:
7+
branches: ["main"]
8+
pull_request:
9+
branches: ["main"]
10+
11+
jobs:
12+
lint:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- uses: actions/checkout@v4
16+
- name: Set up Python 3.13
17+
uses: actions/setup-python@v4
18+
with:
19+
python-version: "3.13"
20+
- name: Install just
21+
run: |
22+
sudo apt update
23+
sudo snap install --edge --classic just
24+
- name: Install dependencies
25+
run: |
26+
python -m pip install --upgrade pip
27+
python -m pip install poetry
28+
poetry install
29+
30+
- name: Lint
31+
run: |
32+
just lint
33+
34+
lint-commit:
35+
runs-on: ubuntu-latest
36+
name: "Lint commit message"
37+
steps:
38+
- name: Check out
39+
uses: actions/checkout@v4
40+
- name: Install commitizen
41+
run: |
42+
python -m pip install --upgrade pip
43+
python -m pip install commitizen
44+
- name: Check commit message
45+
run: cz check --rev-range HEAD

‎.github/workflows/publish.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
name: Publish
2+
3+
on:
4+
workflow_dispatch:
5+
6+
jobs:
7+
push_to_pypi:
8+
runs-on: ubuntu-latest
9+
10+
permissions:
11+
id-token: write
12+
contents: read
13+
14+
steps:
15+
- uses: actions/checkout@v4
16+
- name: Checkout
17+
uses: actions/setup-python@v4
18+
with:
19+
python-version: "3.13"
20+
- name: Build distributions
21+
run: |
22+
python -m pip install --upgrade pip
23+
python -m pip install build
24+
python -m build
25+
- name: Publish release distributions to PyPI
26+
uses: pypa/gh-action-pypi-publish@release/v1
27+
28+
push_to_docker_hub:
29+
needs: push_to_pypi
30+
name: Push Docker image to Docker Hub
31+
runs-on: ubuntu-latest
32+
permissions:
33+
contents: write
34+
packages: write
35+
36+
steps:
37+
- name: Check out the repo
38+
uses: actions/checkout@v4
39+
40+
- name: Log in to Docker Hub
41+
uses: docker/login-action@v3
42+
with:
43+
username: ${{ secrets.DOCKER_USERNAME }}
44+
password: ${{ secrets.DOCKER_PASSWORD }}
45+
46+
- name: Login to GitHub Container Registry
47+
uses: docker/login-action@v3
48+
with:
49+
registry: ghcr.io
50+
username: ${{ github.actor }}
51+
password: ${{ secrets.GITHUB_TOKEN }}
52+
53+
- name: Extract metadata (tags, labels) for Docker
54+
id: meta
55+
uses: docker/metadata-action@v4
56+
with:
57+
images: elementsinteractive/lightman-ai
58+
59+
- name: Build and push Docker image
60+
uses: docker/build-push-action@v5
61+
with:
62+
context: .
63+
file: ./Dockerfile
64+
push: true
65+
tags: ${{ steps.meta.outputs.tags }}
66+
labels: ${{ steps.meta.outputs.labels }}
67+
cache-from: type=registry,ref=ghcr.io/elementsinteractive/lightman-ai:buildcache
68+
cache-to: type=registry,ref=ghcr.io/elementsinteractive/lightman-ai:buildcache,mode=max
69+
70+
release_notes:
71+
runs-on: ubuntu-latest
72+
needs: push_to_docker_hub
73+
steps:
74+
- uses: actions/checkout@v4
75+
- name: Release
76+
uses: softprops/action-gh-release@v2
77+
with:
78+
generate_release_notes: true
79+
token: "${{ secrets.GITHUB_TOKEN }}"

‎.github/workflows/security.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# This workflow will run some security checks against our project
2+
3+
name: Security
4+
5+
on:
6+
push:
7+
branches: ["main"]
8+
pull_request:
9+
branches: ["main"]
10+
11+
jobs:
12+
osv-scanner:
13+
runs-on: ubuntu-latest
14+
container:
15+
image: ghcr.io/google/osv-scanner:v1.9.2
16+
steps:
17+
- uses: actions/checkout@v4
18+
- name: Run OSV Scanner
19+
run: |
20+
/osv-scanner --skip-git --format table -r .
21+
semgrep:
22+
runs-on: ubuntu-latest
23+
container:
24+
image: returntocorp/semgrep:latest
25+
steps:
26+
- uses: actions/checkout@v4
27+
- name: Run Semgrep
28+
run: |
29+
semgrep scan --config auto
30+
twyn:
31+
runs-on: ubuntu-latest
32+
container:
33+
image: elementsinteractive/twyn:v2.8.27
34+
steps:
35+
- uses: actions/checkout@v4
36+
- name: Run Twyn against our dependencies
37+
run: |
38+
twyn run -vv

‎.github/workflows/test.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# This workflow will install Python dependencies, and run the tests for our project
2+
3+
name: Test
4+
5+
on:
6+
push:
7+
branches: ["main"]
8+
pull_request:
9+
branches: ["main"]
10+
11+
jobs:
12+
test:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- uses: actions/checkout@v4
16+
- name: Set up Python
17+
uses: actions/setup-python@v4
18+
with:
19+
python-version: "3.13"
20+
- name: Install just
21+
run: |
22+
sudo apt update
23+
sudo snap install --edge --classic just
24+
- name: Install dependencies
25+
run: |
26+
python -m pip install --upgrade pip
27+
python -m pip install poetry
28+
poetry install
29+
30+
- name: Test with pytest
31+
run: |
32+
just test

0 commit comments

Comments
 (0)