Skip to content

Commit e43489e

Browse files
sdn4zsdn4z
committed
ci: Add GitHub workflows
1 parent 4abb7fc commit e43489e

File tree

13 files changed

+414
-345
lines changed

13 files changed

+414
-345
lines changed

‎.github/dependabot.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "pip"
4+
directory: "/"
5+
schedule:
6+
interval: "weekly"
7+
day: "monday"
8+
labels:
9+
- "dependencies"
10+
commit-message:
11+
prefix: "chore"
12+
groups:
13+
patch-updates:
14+
patterns:
15+
- "*"
16+
update-types:
17+
- "patch"
18+
minor-updates:
19+
patterns:
20+
- "*"
21+
update-types:
22+
- "minor"

‎.github/release.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
changelog:
2+
exclude:
3+
labels:
4+
- ignore-for-release
5+
authors:
6+
- octocat
7+
categories:
8+
- title: Breaking Changes 🚨
9+
labels:
10+
- breaking
11+
- title: New Features 🎉
12+
labels:
13+
- feature
14+
- title: Fixes 🔧
15+
labels:
16+
- fix
17+
- title: Other Changes
18+
labels:
19+
- "*"

‎.github/workflows/auto-merge.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: Dependabot auto-approve
2+
on: pull_request_target
3+
4+
permissions:
5+
contents: write
6+
pull-requests: write
7+
8+
jobs:
9+
dependabot:
10+
runs-on: ubuntu-latest
11+
if: ${{ github.actor == 'dependabot[bot]' }}
12+
steps:
13+
- name: Dependabot metadata
14+
id: metadata
15+
uses: dependabot/fetch-metadata@v1.1.1
16+
with:
17+
github-token: "${{ secrets.GITHUB_TOKEN }}"
18+
- name: Enable auto-merge for Dependabot PRs
19+
if: ${{ steps.metadata.outputs.update-type != 'version-update:semver-major'}}
20+
run: gh pr merge --auto --squash "$PR_URL"
21+
env:
22+
PR_URL: ${{github.event.pull_request.html_url}}
23+
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

‎.github/workflows/bumpversion.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: Bump version
2+
3+
on:
4+
workflow_dispatch:
5+
6+
jobs:
7+
bump_version:
8+
if: ${{ !startsWith(github.event.head_commit.message, 'bump:') && github.ref == 'refs/heads/main' }}
9+
runs-on: ubuntu-latest
10+
name: "Bump version and create changelog with commitizen"
11+
steps:
12+
- uses: actions/create-github-app-token@v1
13+
id: app-token
14+
with:
15+
app-id: ${{ vars.ELEMENTSINTERACTIVE_BOT_APP_ID }}
16+
private-key: ${{ secrets.ELEMENTSINTERACTIVE_BOT_PRIVATE_KEY }}
17+
- uses: actions/checkout@v4
18+
with:
19+
fetch-depth: 0
20+
token: ${{ steps.app-token.outputs.token }}
21+
ref: ${{ github.head_ref }}
22+
# Make sure the value of GITHUB_TOKEN will not be persisted in repo's config
23+
persist-credentials: false
24+
- id: cz
25+
name: Create bump and changelog
26+
uses: commitizen-tools/commitizen-action@master
27+
with:
28+
github_token: ${{ steps.app-token.outputs.token }}
29+
- name: Print Version
30+
run: echo "Bumped to version ${{ steps.cz.outputs.version }}"

‎.github/workflows/conventional-label.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
on:
2+
pull_request_target:
3+
types: [ opened, edited ]
4+
name: conventional-release-labels
5+
jobs:
6+
label:
7+
runs-on: ubuntu-latest
8+
steps:
9+
- uses: bcoe/conventional-release-labels@v1
10+
with:
11+
type_labels: '{"feat": "feature", "fix": "fix", "breaking": "breaking", "ci": "CI"}'

‎.github/workflows/lgtm.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
name: LGTM Review
2+
3+
on:
4+
issue_comment:
5+
types: [created]
6+
7+
jobs:
8+
lgtm-review:
9+
if: |
10+
github.event.issue.pull_request &&
11+
startsWith(github.event.comment.body, '/lgtm review')
12+
runs-on: ubuntu-latest
13+
steps:
14+
- name: Check if commenter has write access
15+
id: check-permission
16+
env:
17+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
18+
run: |
19+
USER=${{ github.event.comment.user.login }}
20+
REPO=${{ github.repository }}
21+
PERMISSION=$(curl -s -H "Authorization: Bearer $GITHUB_TOKEN" \
22+
https://api.github.com/repos/$REPO/collaborators/$USER/permission \
23+
| jq -r '.permission')
24+
25+
if [[ "$PERMISSION" == "admin" || "$PERMISSION" == "maintain" || "$PERMISSION" == "write" ]]; then
26+
echo "HAS_PERMISSION=true" >> $GITHUB_ENV
27+
else
28+
echo "HAS_PERMISSION=false" >> $GITHUB_ENV
29+
fi
30+
31+
- name: Fail if unauthorized
32+
if: env.HAS_PERMISSION == 'false'
33+
run: |
34+
echo "User ${{ github.event.comment.user.login }} is not authorized to trigger this workflow."
35+
exit 1
36+
37+
- name: Checkout PR code
38+
uses: actions/checkout@v4
39+
with:
40+
ref: refs/pull/${{ github.event.issue.number }}/merge
41+
42+
- name: Run LGTM Review
43+
run: |
44+
docker run --rm elementsinteractive/lgtm-ai \
45+
review \
46+
--pr-url "https://github.com/${{ github.repository }}/pull/${{ github.event.issue.number }}" \
47+
--git-api-key "${{ secrets.GITHUB_TOKEN }}" \
48+
--ai-api-key "${{ secrets.AI_API_TOKEN }}" \
49+
-vv

‎.github/workflows/lint.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# This workflow will check our code for having a proper format, as well as the commit message to meet the expected ones
2+
3+
name: Lint
4+
5+
on:
6+
push:
7+
branches: ["main"]
8+
pull_request:
9+
branches: ["main"]
10+
11+
jobs:
12+
lint:
13+
runs-on: ubuntu-latest
14+
if: "!startsWith(github.event.head_commit.message, 'bump:')"
15+
steps:
16+
- uses: actions/checkout@v4
17+
- name: Set up Python 3.13
18+
uses: actions/setup-python@v4
19+
with:
20+
python-version: "3.13"
21+
22+
- name: Install dependencies
23+
run: |
24+
python -m pip install --upgrade pip
25+
python -m pip install poetry
26+
poetry install --with test,lint
27+
28+
- name: Lint
29+
run: |
30+
poetry run ruff format --check src tests eval
31+
poetry run ruff check src tests eval
32+
poetry run mypy src tests eval
33+
34+
lint-commit:
35+
runs-on: ubuntu-latest
36+
if: "!startsWith(github.event.head_commit.message, 'bump:')"
37+
name: "Lint commit message"
38+
steps:
39+
- name: Check out
40+
uses: actions/checkout@v4
41+
- name: Install commitizen
42+
run: |
43+
python -m pip install --upgrade pip
44+
python -m pip install commitizen
45+
- name: Check commit message
46+
run: cz check --rev-range HEAD

‎.github/workflows/publish.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
# This workflow will publish our package on pypi
2+
3+
name: Publish
4+
5+
on:
6+
push:
7+
tags:
8+
- "v*.*.*"
9+
10+
permissions:
11+
contents: write
12+
13+
jobs:
14+
push_to_pypi:
15+
runs-on: ubuntu-latest
16+
17+
permissions:
18+
id-token: write
19+
contents: read
20+
21+
steps:
22+
- uses: actions/checkout@v4
23+
- name: Checkout
24+
uses: actions/setup-python@v4
25+
with:
26+
python-version: "3.13"
27+
- name: Build distributions
28+
run: |
29+
python -m pip install --upgrade pip
30+
python -m pip install build
31+
python -m build
32+
- name: Publish release distributions to PyPI
33+
uses: pypa/gh-action-pypi-publish@release/v1
34+
35+
push_to_docker_hub:
36+
needs: push_to_pypi
37+
name: Push Docker image to Docker Hub
38+
runs-on: ubuntu-latest
39+
steps:
40+
- name: Check out the repo
41+
uses: actions/checkout@v4
42+
43+
- name: Log in to Docker Hub
44+
uses: docker/login-action@v2
45+
with:
46+
username: ${{ secrets.DOCKER_USERNAME }}
47+
password: ${{ secrets.DOCKER_PASSWORD }}
48+
49+
- name: Extract metadata (tags, labels) for Docker
50+
id: meta
51+
uses: docker/metadata-action@v4
52+
with:
53+
images: elementsinteractive/lightman-ai
54+
55+
- name: Build and push Docker image
56+
uses: docker/build-push-action@v4
57+
with:
58+
context: .
59+
file: ./Dockerfile
60+
push: true
61+
tags: ${{ steps.meta.outputs.tags }}
62+
labels: ${{ steps.meta.outputs.labels }}
63+
64+
release_notes:
65+
runs-on: ubuntu-latest
66+
needs: push_to_docker_hub
67+
steps:
68+
- uses: actions/checkout@v4
69+
- name: Release
70+
uses: softprops/action-gh-release@v2
71+
with:
72+
generate_release_notes: true
73+
token: "${{ secrets.GITHUB_TOKEN }}"

‎.github/workflows/security.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# This workflow will run security checks against our project
2+
3+
name: Security
4+
5+
on:
6+
push:
7+
branches: ["main"]
8+
pull_request:
9+
branches: ["main"]
10+
11+
jobs:
12+
osv-scanner:
13+
runs-on: ubuntu-latest
14+
if: "!startsWith(github.event.head_commit.message, 'bump:')"
15+
container:
16+
image: ghcr.io/google/osv-scanner:v1.9.2
17+
steps:
18+
- uses: actions/checkout@v4
19+
- name: Run OSV Scanner
20+
run: |
21+
/osv-scanner --skip-git --format table -r .
22+
semgrep:
23+
runs-on: ubuntu-latest
24+
if: "!startsWith(github.event.head_commit.message, 'bump:')"
25+
container:
26+
image: returntocorp/semgrep:latest
27+
steps:
28+
- uses: actions/checkout@v4
29+
- name: Run Semgrep
30+
run: |
31+
semgrep scan --config auto
32+
twyn:
33+
runs-on: ubuntu-latest
34+
if: "!startsWith(github.event.head_commit.message, 'bump:')"
35+
container:
36+
image: elementsinteractive/twyn:v2.8.28
37+
steps:
38+
- uses: actions/checkout@v4
39+
- name: Run Twyn against our dependencies
40+
run: |
41+
twyn run -vv

‎.github/workflows/test.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# This workflow will install Python dependencies, and run the tests for our project
2+
3+
name: Test
4+
5+
on:
6+
push:
7+
branches: ["main"]
8+
pull_request:
9+
branches: ["main"]
10+
11+
jobs:
12+
test:
13+
runs-on: ubuntu-latest
14+
if: "!startsWith(github.event.head_commit.message, 'bump:')"
15+
steps:
16+
- uses: actions/checkout@v4
17+
- name: Set up Python
18+
uses: actions/setup-python@v4
19+
with:
20+
python-version: "3.13"
21+
22+
- name: Install dependencies
23+
run: |
24+
python -m pip install --upgrade pip
25+
python -m pip install poetry
26+
poetry install --with test
27+
28+
- name: Test with pytest
29+
run: |
30+
poetry run pytest

0 commit comments

Comments
 (0)