Skip to content

Commit d4234d9

Browse files
saikiransayabugaribharagha
saikiransayabugari
and
bharagha
authored
GENAI-New-worflows (open-edge-platform#834)
Co-authored-by: Raghu Bhat <raghavendra.bhat@intel.com>
1 parent 64b15ff commit d4234d9

9 files changed

+3409
-0
lines changed

‎.github/workflows/GEN-AI-Chat-qna-core.yaml‎

Lines changed: 361 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,361 @@
1+
---
2+
# SPDX-FileCopyrightText: (C) 2025 Intel Corporation
3+
# SPDX-License-Identifier: Apache-2.0
4+
5+
name: "[GEN-AI] Chat-qna-core-CI"
6+
run-name: "[GEN-AI-Chat-qna-core-CI] PR workflow (by @${{ github.actor }} via ${{ github.event_name }})"
7+
8+
9+
# Only run at most 1 workflow concurrently per PR, unlimited for branches
10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.sha }}
12+
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
13+
14+
on:
15+
pull_request:
16+
branches:
17+
- main
18+
paths:
19+
- 'sample-applications/chat-question-and-answer-core/**'
20+
21+
jobs:
22+
23+
trivy-scan:
24+
runs-on: ubuntu-22.04-32core-128GB
25+
permissions:
26+
contents: read
27+
steps:
28+
- uses: actions/checkout@8edcb1bdb4e267140fa742c62e395cd74f332709
29+
with:
30+
persist-credentials: false
31+
32+
- name: Build Docker images
33+
run: |
34+
docker build -f ./sample-applications/chat-question-and-answer-core/docker/Dockerfile -t chatqna-core-backend:latest ./sample-applications/chat-question-and-answer-core/
35+
docker build -f ./sample-applications/chat-question-and-answer-core/ui/Dockerfile -t chatqna-core-frontend:latest ./sample-applications/chat-question-and-answer-core/ui/
36+
37+
- name: Run Trivy Filesystem Scan
38+
uses: open-edge-platform/orch-ci/.github/actions/security/trivy@27276444a9bcf247a27369406686b689933bd1ff
39+
id: trivy-fs
40+
with:
41+
scan_type: "fs"
42+
scan-scope: "all"
43+
severity: "HIGH,CRITICAL"
44+
format: "json"
45+
scan_target: "sample-applications/chat-question-and-answer-core/"
46+
report_suffix: "-fs-chat-qna-core-CT7"
47+
48+
49+
- name: Run trivy Scan - chat-qna-core-backend (HTML Report)
50+
uses: open-edge-platform/orch-ci/.github/actions/security/trivy@27276444a9bcf247a27369406686b689933bd1ff
51+
id: chat-qna-core-backend-html
52+
with:
53+
scan_type: "image"
54+
scan-scope: "all"
55+
scan_target: "chatqna-core-backend:latest"
56+
severity: "HIGH,CRITICAL"
57+
format: "table"
58+
report_suffix: "-image-chat-qna-core-backend-html-CT248"
59+
generate_sbom: "false"
60+
61+
- name: Run trivy Scan - chat-qna-core-backend (SPDX SBOM)
62+
uses: open-edge-platform/orch-ci/.github/actions/security/trivy@27276444a9bcf247a27369406686b689933bd1ff
63+
id: chat-qna-core-backend-spdx
64+
with:
65+
scan_type: "image"
66+
scan-scope: "all"
67+
scan_target: "chatqna-core-backend:latest"
68+
severity: "HIGH,CRITICAL"
69+
format: "spdx-json"
70+
scanners: "vuln"
71+
report_suffix: "-image-chat-qna-core-backend-spdx-CT248"
72+
generate_sbom: "false"
73+
74+
75+
- name: Run trivy Scan - chat-qna-core-frontend (HTML Report)
76+
uses: open-edge-platform/orch-ci/.github/actions/security/trivy@27276444a9bcf247a27369406686b689933bd1ff
77+
id: chat-qna-core-frontend-html
78+
with:
79+
scan_type: "image"
80+
scan-scope: "all"
81+
scan_target: "chatqna-core-frontend:latest"
82+
severity: "HIGH,CRITICAL"
83+
format: "table"
84+
report_suffix: "-image-chat-qna-core-frontend-html-CT248"
85+
generate_sbom: "false"
86+
87+
- name: Run trivy Scan - chat-qna-core-frontend (SPDX SBOM)
88+
uses: open-edge-platform/orch-ci/.github/actions/security/trivy@27276444a9bcf247a27369406686b689933bd1ff
89+
id: chat-qna-core-frontend-spdx
90+
with:
91+
scan_type: "image"
92+
scan-scope: "all"
93+
scan_target: "chatqna-core-frontend:latest"
94+
severity: "HIGH,CRITICAL"
95+
format: "spdx-json"
96+
scanners: "vuln"
97+
report_suffix: "-image-chat-qna-core-frontend-spdx-CT248"
98+
generate_sbom: "false"
99+
100+
101+
- name: Scan Dockerfile with Trivy-backend
102+
uses: open-edge-platform/orch-ci/.github/actions/security/trivy@27276444a9bcf247a27369406686b689933bd1ff
103+
with:
104+
scan_type: "config"
105+
scan_target: "sample-applications/chat-question-and-answer-core/"
106+
severity: "HIGH,CRITICAL"
107+
format: "json"
108+
misconfig_scanners: "dockerfile"
109+
report_suffix: "-config-chat-qna-core-backend-CT222"
110+
111+
- name: Scan Dockerfile with Trivy-frontend
112+
uses: open-edge-platform/orch-ci/.github/actions/security/trivy@27276444a9bcf247a27369406686b689933bd1ff
113+
with:
114+
scan_type: "config"
115+
scan_target: "sample-applications/chat-question-and-answer-core/ui/"
116+
severity: "HIGH,CRITICAL"
117+
format: "json"
118+
misconfig_scanners: "dockerfile"
119+
report_suffix: "-config-chat-qna-core-frontend-CT222"
120+
121+
- name: Upload Report
122+
uses: actions/upload-artifact@de65e23aa2b7e23d713bb51fbfcb6d502f8667d8
123+
with:
124+
name: trivy-report-chat-qna-core
125+
path: security-results/trivy*
126+
127+
bandit-scan:
128+
runs-on: ubuntu-22.04-32core-128GB
129+
permissions:
130+
contents: read
131+
steps:
132+
- uses: actions/checkout@8edcb1bdb4e267140fa742c62e395cd74f332709
133+
134+
- name: Run Bandit Scan
135+
uses: open-edge-platform/orch-ci/.github/actions/security/bandit@27276444a9bcf247a27369406686b689933bd1ff
136+
id: bandit
137+
with:
138+
scan-scope: "all"
139+
output-format: "txt"
140+
fail-on-findings: "false"
141+
paths: "sample-applications/chat-question-and-answer-core/"
142+
report_suffix: "-bandit-chat-qna-core-CT161"
143+
144+
- name: Upload Report
145+
uses: actions/upload-artifact@de65e23aa2b7e23d713bb51fbfcb6d502f8667d8
146+
with:
147+
name: bandit-report-core
148+
path: bandit-report-*.txt
149+
150+
151+
clamav-scan:
152+
runs-on: ubuntu-22.04-32core-128GB
153+
permissions:
154+
contents: read
155+
steps:
156+
- uses: actions/checkout@8edcb1bdb4e267140fa742c62e395cd74f332709
157+
158+
- name: Run ClamAV Scan
159+
uses: open-edge-platform/orch-ci/.github/actions/security/clamav@27276444a9bcf247a27369406686b689933bd1ff
160+
id: clamav
161+
with:
162+
scan-scope: "all"
163+
output-format: "txt"
164+
fail-on-findings: "false"
165+
paths: "sample-applications/chat-question-and-answer-core/"
166+
exclude_dirs: ".git,node_modules,venv,ui/test,tests"
167+
168+
- name: Upload Report
169+
uses: actions/upload-artifact@de65e23aa2b7e23d713bb51fbfcb6d502f8667d8
170+
with:
171+
name: clamav-report-chatqna-core
172+
path: security-results/clamav*
173+
174+
# GitLeaks scanning job
175+
gitleaks-scan:
176+
runs-on: ubuntu-22.04-32core-128GB
177+
permissions:
178+
contents: read
179+
steps:
180+
- name: Checkout code
181+
uses: actions/checkout@8edcb1bdb4e267140fa742c62e395cd74f332709
182+
with:
183+
persist-credentials: false
184+
185+
- name: Install gitleaks
186+
uses: open-edge-platform/orch-ci/.github/actions/bootstrap@5f1c7f544b235db6ded508b6b4c6a2d3a78a38be
187+
with:
188+
bootstrap_tools: "gitleaks"
189+
190+
- name: Get current timestamp
191+
id: timestamp
192+
run: echo "time=$(date +%s)" >> "$GITHUB_OUTPUT"
193+
194+
- name: Clone CI repo
195+
uses: actions/checkout@8edcb1bdb4e267140fa742c62e395cd74f332709
196+
with:
197+
repository: open-edge-platform/orch-ci
198+
path: ci
199+
persist-credentials: false
200+
201+
- name: Scan for secrets
202+
run: |
203+
gitleaks dir "sample-applications/chat-question-and-answer-core/" -v -c ci/.gitleaks.toml --baseline-path ci/gitleaks_baselines/gitleaks-chatqna-core.json -r gitleaks-chatqna-core.json || true
204+
205+
- name: Upload Gitleaks Report
206+
uses: actions/upload-artifact@de65e23aa2b7e23d713bb51fbfcb6d502f8667d8
207+
with:
208+
name: gitleaks-report-chat-qna-core-${{ steps.timestamp.outputs.time }}
209+
path: gitleaks-chatqna-core.json
210+
211+
# Python linting with pylint
212+
pylint-scan:
213+
runs-on: ubuntu-22.04-32core-128GB
214+
permissions:
215+
contents: read
216+
steps:
217+
- uses: actions/checkout@8edcb1bdb4e267140fa742c62e395cd74f332709
218+
219+
- name: Setup Python
220+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
221+
with:
222+
python-version: '3.12'
223+
224+
- name: Install Poetry
225+
run: |
226+
pip install poetry
227+
228+
- name: Install dependencies and pylint
229+
run: |
230+
cd sample-applications/chat-question-and-answer-core/
231+
poetry install || true
232+
poetry add --group dev pylint
233+
234+
- name: Run pylint
235+
run: |
236+
cd sample-applications/chat-question-and-answer-core/
237+
mkdir -p security-results
238+
echo "=== Pylint Scan Results ===" > security-results/pylint-report-chat-qna-core.txt
239+
echo "Scan Date: $(date)" >> security-results/pylint-report-chat-qna-core.txt
240+
echo "" >> security-results/pylint-report-chat-qna-core.txt
241+
242+
# Create a basic pylint config
243+
cat > .pylintrc << EOF
244+
[MESSAGES CONTROL]
245+
disable=C0111,C0103,R0903,R0913,W0613,W0622,R0801,R0902,R0914,R0915,R0912,C0301,C0302
246+
247+
[FORMAT]
248+
max-line-length=120
249+
250+
[REPORTS]
251+
output-format=text
252+
reports=yes
253+
EOF
254+
255+
# Find all Python files and lint them
256+
find app/ -type f -name "*.py" -exec poetry run pylint --rcfile=.pylintrc {} + >> security-results/pylint-report-chat-qna-core.txt 2>&1 || true
257+
258+
echo "Pylint scan completed"
259+
260+
- name: Upload pylint Report
261+
uses: actions/upload-artifact@de65e23aa2b7e23d713bb51fbfcb6d502f8667d8
262+
with:
263+
name: pylint-report-chat-qna-core
264+
path: sample-applications/chat-question-and-answer-core/security-results/pylint-report-chat-qna-core.txt
265+
266+
# ShellCheck scanning job
267+
shellcheck-scan:
268+
runs-on: ubuntu-22.04-32core-128GB
269+
permissions:
270+
contents: read
271+
steps:
272+
- uses: actions/checkout@8edcb1bdb4e267140fa742c62e395cd74f332709
273+
274+
- name: Setup environment with shellcheck
275+
uses: open-edge-platform/orch-ci/.github/actions/bootstrap@5f1c7f544b235db6ded508b6b4c6a2d3a78a38be
276+
with:
277+
bootstrap_tools: "shellcheck"
278+
279+
- name: Run ShellCheck
280+
run: |
281+
mkdir -p security-results
282+
echo "=== ShellCheck Scan Results ===" > security-results/shellcheck-report-chat-qna-core.txt
283+
echo "Scan Date: $(date)" >> security-results/shellcheck-report-chat-qna-core.txt
284+
echo "" >> security-results/shellcheck-report-chat-qna-core.txt
285+
286+
# Find all shell scripts and check them
287+
find sample-applications/chat-question-and-answer-core/ -type f \( -name "*.sh" -o -name "*.bash" \) -print0 | while IFS= read -r -d '' file; do
288+
echo "Checking: $file" >> security-results/shellcheck-report-chat-qna-core.txt
289+
shellcheck "$file" >> security-results/shellcheck-report-chat-qna-core.txt 2>&1 || true
290+
echo "---" >> security-results/shellcheck-report-chat-qna-core.txt
291+
done
292+
293+
echo "ShellCheck scan completed"
294+
295+
- name: Upload ShellCheck Report
296+
uses: actions/upload-artifact@de65e23aa2b7e23d713bb51fbfcb6d502f8667d8
297+
with:
298+
name: shellcheck-report-chat-qna-core
299+
path: security-results/shellcheck-report-chat-qna-core.txt
300+
301+
# Run Unit test cases Frontend
302+
run-unit-tests-frontend:
303+
runs-on: ubuntu-22.04-32core-128GB
304+
permissions:
305+
contents: read
306+
steps:
307+
- uses: actions/checkout@8edcb1bdb4e267140fa742c62e395cd74f332709
308+
309+
- name: Install Node.js
310+
uses: actions/setup-node@v4
311+
with:
312+
node-version: '22'
313+
314+
- name: Install dependencies and run tests
315+
run: |
316+
cd sample-applications/chat-question-and-answer-core/ui/
317+
npm install || true
318+
npm run coverage || true
319+
320+
- name: Upload test results
321+
uses: actions/upload-artifact@de65e23aa2b7e23d713bb51fbfcb6d502f8667d8
322+
with:
323+
name: chat-qna-core-frontend-results
324+
path: sample-applications/chat-question-and-answer-core/ui/coverage/
325+
326+
# Run Unit test cases for Backend
327+
run-unit-tests-backend:
328+
runs-on: ubuntu-22.04-32core-128GB
329+
permissions:
330+
contents: read
331+
steps:
332+
- uses: actions/checkout@8edcb1bdb4e267140fa742c62e395cd74f332709
333+
334+
- name: Set up Python environment
335+
uses: actions/setup-python@v4
336+
with:
337+
python-version: '3.12'
338+
339+
- name: Run unit tests
340+
run: |
341+
cd sample-applications/chat-question-and-answer-core/
342+
# Backend Coverage (including all production Python files)
343+
python3.12 -m venv chat-qna-core-venv
344+
source chat-qna-core-venv/bin/activate
345+
pip install poetry
346+
poetry install --with dev || true
347+
poetry add --group dev pytest-cov || true
348+
poetry run pytest tests/ \
349+
--cov=app \
350+
--cov-report=html:coverage-backend \
351+
--cov-report=xml:coverage-backend.xml \
352+
--cov-report=term-missing \
353+
--cov-branch || true
354+
deactivate
355+
rm -rf chat-qna-core-venv
356+
357+
- name: Upload test results
358+
uses: actions/upload-artifact@de65e23aa2b7e23d713bb51fbfcb6d502f8667d8
359+
with:
360+
name: chat-qna-core-backend-test-results
361+
path: sample-applications/chat-question-and-answer-core/coverage-backend/

0 commit comments

Comments
 (0)