Skip to content

Commit 081a563

Browse files
manmohan-shaw-oktamanmohan-shaw-okta
committed
Updating Circle CI Pipeline
1 parent e9fa5b8 commit 081a563

File tree

1 file changed

+246
-24
lines changed

1 file changed

+246
-24
lines changed

‎.circleci/config.yml‎

Lines changed: 246 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -7,27 +7,130 @@ orbs:
77
aws-cli: circleci/[email protected]
88

99
jobs:
10-
build_and_test:
11-
executor: python/default
10+
build:
11+
docker:
12+
- image: cimg/python:3.10
1213
steps:
1314
- checkout
14-
- python/install-packages:
15-
pkg-manager: pip
15+
- restore_cache:
16+
keys:
17+
- v1-dependencies-{{ checksum "requirements.txt" }}
18+
- v1-dependencies-
1619
- run:
17-
name: Build
18-
command: python setup.py build
20+
name: Install Dependencies
21+
command: |
22+
pip install --upgrade pip setuptools wheel
23+
pip install -r requirements.txt
24+
- save_cache:
25+
paths:
26+
- ~/.cache/pip
27+
key: v1-dependencies-{{ checksum "requirements.txt" }}
1928
- run:
20-
name: Run Integration Tests
21-
command: pytest tests/integration
29+
name: Build Distribution
30+
command: |
31+
python setup.py sdist bdist_wheel
32+
- persist_to_workspace:
33+
root: ~/project
34+
paths:
35+
- dist
36+
- ./*
37+
38+
unit_tests:
39+
docker:
40+
- image: cimg/python:3.10
41+
steps:
42+
- attach_workspace:
43+
at: ~/project
44+
- restore_cache:
45+
keys:
46+
- v1-dependencies-{{ checksum "requirements.txt" }}
47+
- v1-dependencies-
48+
- run:
49+
name: Install Dependencies
50+
command: |
51+
pip install --upgrade pip setuptools wheel
52+
pip install -r requirements.txt
53+
pip install pytest-cov
54+
- run:
55+
name: Run Unit Tests with Coverage
56+
command: |
57+
pytest tests/unit -v \
58+
--junitxml=test-results/unit/junit.xml \
59+
--cov=okta \
60+
--cov-report=xml:coverage/unit/coverage.xml \
61+
--cov-report=html:coverage/unit/html \
62+
--cov-report=term-missing || true
63+
- run:
64+
name: Display Coverage Summary
65+
command: |
66+
if [ -f coverage/unit/coverage.xml ]; then
67+
pip install coverage
68+
coverage report --data-file=.coverage 2>/dev/null || echo "Coverage data processed"
69+
fi
70+
- store_test_results:
71+
path: test-results
72+
- store_artifacts:
73+
path: test-results
74+
destination: test-results
75+
- store_artifacts:
76+
path: coverage/unit
77+
destination: coverage-unit
78+
79+
integration_tests:
80+
docker:
81+
- image: cimg/python:3.10
82+
steps:
83+
- attach_workspace:
84+
at: ~/project
85+
- restore_cache:
86+
keys:
87+
- v1-dependencies-{{ checksum "requirements.txt" }}
88+
- v1-dependencies-
89+
- run:
90+
name: Install Dependencies
91+
command: |
92+
pip install --upgrade pip setuptools wheel
93+
pip install -r requirements.txt
94+
pip install pytest-cov
95+
- run:
96+
name: Run Integration Tests with Coverage
97+
command: |
98+
pytest tests/integration -v \
99+
--junitxml=test-results/integration/junit.xml \
100+
--cov=okta \
101+
--cov-report=xml:coverage/integration/coverage.xml \
102+
--cov-report=html:coverage/integration/html \
103+
--cov-report=term-missing || true
104+
- run:
105+
name: Display Coverage Summary
106+
command: |
107+
if [ -f coverage/integration/coverage.xml ]; then
108+
pip install coverage
109+
coverage report --data-file=.coverage 2>/dev/null || echo "Coverage data processed"
110+
fi
111+
- store_test_results:
112+
path: test-results
113+
- store_artifacts:
114+
path: test-results
115+
destination: test-results
116+
- store_artifacts:
117+
path: coverage/integration
118+
destination: coverage-integration
119+
22120
snyk-scan:
23121
docker:
24122
- image: cimg/python:3.10
25123
steps:
26-
- attach_workspace: # Allows for sharing of build-workspace (containing downloaded dependencies) (optional)
27-
at: ~/project # This is the working directory for CCI containers, change if necessary
28-
- checkout # Might not need this if you have "persist_to_workspace" and "attach_workspace"
29-
- run: | # Might not need this if you have "persist_to_workspace" and "attach_workspace"
30-
pip install -r requirements.txt
124+
- checkout
125+
- restore_cache:
126+
keys:
127+
- v1-dependencies-{{ checksum "requirements.txt" }}
128+
- v1-dependencies-
129+
- run:
130+
name: Install Dependencies
131+
command: |
132+
pip install --upgrade pip
133+
pip install -r requirements.txt
31134
- platform-helpers-general/step-run-snyk-monitor:
32135
scan-all-projects: true
33136
skip-unresolved: false
@@ -38,31 +141,25 @@ jobs:
38141
resource_class: large
39142
steps:
40143
- checkout
41-
42144
- run:
43145
name: Install Dependencies
44146
command: pip wheel -r requirements.txt -w _vendor/
45-
46147
- run:
47148
name: Download Reverse Labs Scanner
48149
command: |
49150
curl https://dso-resources.oktasecurity.com/scanner \
50151
-H "x-api-key: $RESOURCE_TOKEN" \
51152
--output rl_wrapper-0.0.2+35ababa-py3-none-any.whl
52-
# Install the wrapper that was downloaded
53153
- run:
54154
name: Install RL Wrapper
55155
command: |
56156
pip install ./rl_wrapper-0.0.2+35ababa-py3-none-any.whl
57-
# Setup the AWS profile
58157
- aws-cli/setup:
59158
profile_name: default
60159
role_arn: $AWS_ARN
61160
region: us-east-1
62-
# Get the credentials and save to env
63161
- run: >-
64162
eval "$(aws configure export-credentials --profile default --format env)" 2> /dev/null
65-
# Run the wrapper, do not change anything here
66163
- run:
67164
name: Run Reversing Labs Wrapper Scanner
68165
command: |
@@ -75,17 +172,142 @@ jobs:
75172
--build-env "circleci" \
76173
--suppress_output
77174
175+
publish_to_pypi:
176+
docker:
177+
- image: cimg/python:3.10
178+
steps:
179+
- attach_workspace:
180+
at: ~/project
181+
- run:
182+
name: Install Twine
183+
command: |
184+
pip install --upgrade pip twine
185+
- run:
186+
name: Verify Distribution
187+
command: |
188+
twine check dist/*
189+
- run:
190+
name: Publish to PyPI
191+
command: |
192+
twine upload dist/* --username __token__ --password $PYPI_TOKEN
193+
78194
workflows:
79-
"Circle CI Tests":
195+
# Workflow for non-production: PRs and non-master branches (internal contributors)
196+
non-prod:
80197
jobs:
81-
- build_and_test
198+
# Security scans run first in parallel
82199
- snyk-scan:
83200
context:
84201
- static-analysis
85-
name: execute-snyk
86-
87-
"Malware Scanner":
202+
203+
- reversing-labs:
204+
context:
205+
- okta-dcp
206+
207+
# Build only after security scans pass
208+
- build:
209+
requires:
210+
- snyk-scan
211+
- reversing-labs
212+
213+
# Unit tests run after build succeeds
214+
- unit_tests:
215+
requires:
216+
- build
217+
218+
# Integration tests run after unit tests pass
219+
- integration_tests:
220+
requires:
221+
- unit_tests
222+
223+
# Workflow for external contributors (forked repository PRs)
224+
# Security scans may be skipped due to missing context access
225+
contributors:
226+
jobs:
227+
# Build runs first for external contributors
228+
- build:
229+
filters:
230+
branches:
231+
# This will run on forked PR branches
232+
only: /pull\/[0-9]+/
233+
234+
# Unit tests run after build succeeds
235+
- unit_tests:
236+
requires:
237+
- build
238+
filters:
239+
branches:
240+
only: /pull\/[0-9]+/
241+
242+
# Integration tests run after unit tests pass
243+
- integration_tests:
244+
requires:
245+
- unit_tests
246+
filters:
247+
branches:
248+
only: /pull\/[0-9]+/
249+
250+
# Production workflow - only runs on master branch
251+
prod:
88252
jobs:
253+
# Security scans run first in parallel
254+
- snyk-scan:
255+
context:
256+
- static-analysis
257+
filters:
258+
branches:
259+
only: master
260+
tags:
261+
only: /^v.*/
262+
89263
- reversing-labs:
90264
context:
91265
- okta-dcp
266+
filters:
267+
branches:
268+
only: master
269+
tags:
270+
only: /^v.*/
271+
272+
# Build only after security scans pass
273+
- build:
274+
requires:
275+
- snyk-scan
276+
- reversing-labs
277+
filters:
278+
branches:
279+
only: master
280+
tags:
281+
only: /^v.*/
282+
283+
# Unit tests run after build succeeds
284+
- unit_tests:
285+
requires:
286+
- build
287+
filters:
288+
branches:
289+
only: master
290+
tags:
291+
only: /^v.*/
292+
293+
# Integration tests run after unit tests pass
294+
- integration_tests:
295+
requires:
296+
- unit_tests
297+
filters:
298+
branches:
299+
only: master
300+
tags:
301+
only: /^v.*/
302+
303+
# Publish only after all tests are successful
304+
- publish_to_pypi:
305+
context:
306+
- pypi-publish
307+
requires:
308+
- integration_tests
309+
filters:
310+
branches:
311+
only: master
312+
tags:
313+
only: /^v.*/

0 commit comments

Comments
 (0)