📦 build(ci): aggiungi workflow CI, release e manutenzione python
- aggiunto esempio workflow CI per python con quality gates
- aggiunto esempio workflow manutenzione con branch cleanup, audit sicurezza e check pacchetti obsoleti
- aggiunto esempio workflow release per build docker e auto-release gitea
📦 build(shared-actions): aggiungi shared-actions python per CI/CD
- aggiunto python-quality-gates.yml per lint, format, type check e test
- aggiunto python-auto-release.yml per changelog e rilascio automatico
- aggiunto python-docker-release.yml per build e push immagini docker
- aggiunto python-dependency-check.yml per audit sicurezza dipendenze
- aggiunto python-dependency-outdated.yml per verifica pacchetti obsoleti
This commit is contained in:
LucaZanni
@@ -0,0 +1,69 @@
|
||||
name: Python Auto Release
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
working-directory:
|
||||
description: 'Directory di lavoro se il progetto non è in root'
|
||||
type: string
|
||||
default: '.'
|
||||
|
||||
jobs:
|
||||
python-auto-release:
|
||||
runs-on: ubuntu-latest
|
||||
defaults:
|
||||
run:
|
||||
working-directory: ${{ inputs.working-directory }}
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: https://gitea.com/actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Generate changelog
|
||||
id: changelog
|
||||
run: |
|
||||
CURRENT_TAG=${GITHUB_REF#refs/tags/}
|
||||
PREV_TAG=$(git tag --sort=-version:refname | sed -n '2p')
|
||||
|
||||
if [ -z "$PREV_TAG" ]; then
|
||||
CHANGELOG=$(git log --pretty=format:"- %s (%h)" "$CURRENT_TAG")
|
||||
else
|
||||
CHANGELOG=$(git log --pretty=format:"- %s (%h)" "${PREV_TAG}..${CURRENT_TAG}")
|
||||
fi
|
||||
|
||||
echo "$CHANGELOG" > /tmp/changelog.txt
|
||||
echo "current_tag=$CURRENT_TAG" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Read app name from pyproject.toml
|
||||
id: app-info
|
||||
run: |
|
||||
APP_NAME=$(python3 -c "
|
||||
import re, pathlib
|
||||
content = pathlib.Path('pyproject.toml').read_text()
|
||||
m = re.search(r'^name\s*=\s*[\"\'](.*?)[\"\']', content, re.MULTILINE)
|
||||
print(m.group(1) if m else 'app')
|
||||
" 2>/dev/null || echo 'app')
|
||||
echo "name=$APP_NAME" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Create release
|
||||
env:
|
||||
GITEA_TOKEN: ${{ gitea.token }}
|
||||
SERVER_URL: ${{ gitea.server_url }}
|
||||
REPOSITORY: ${{ gitea.repository }}
|
||||
run: |
|
||||
CURRENT_TAG=${{ steps.changelog.outputs.current_tag }}
|
||||
APP_NAME=${{ steps.app-info.outputs.name }}
|
||||
CHANGELOG=$(cat /tmp/changelog.txt)
|
||||
|
||||
curl -s -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Authorization: token $GITEA_TOKEN" \
|
||||
"$SERVER_URL/api/v1/repos/$REPOSITORY/releases" \
|
||||
-d "{
|
||||
\"tag_name\": \"$CURRENT_TAG\",
|
||||
\"name\": \"$APP_NAME $CURRENT_TAG\",
|
||||
\"body\": $(echo "$CHANGELOG" | jq -Rs .),
|
||||
\"draft\": false,
|
||||
\"prerelease\": false
|
||||
}"
|
||||
@@ -0,0 +1,101 @@
|
||||
name: Python Dependency Audit
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
python-version:
|
||||
type: string
|
||||
default: '3.11'
|
||||
install-extras:
|
||||
type: string
|
||||
default: 'dev'
|
||||
working-directory:
|
||||
type: string
|
||||
default: '.'
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
python-dependency-audit:
|
||||
runs-on: ubuntu-latest
|
||||
defaults:
|
||||
run:
|
||||
working-directory: ${{ inputs.working-directory }}
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: https://gitea.com/actions/checkout@v4
|
||||
|
||||
- name: Setup Python
|
||||
uses: https://github.com/actions/setup-python@v5
|
||||
with:
|
||||
python-version: ${{ inputs.python-version || '3.11' }}
|
||||
|
||||
- name: Cache pip
|
||||
uses: https://gitea.com/actions/cache@v4
|
||||
with:
|
||||
path: ~/.cache/pip
|
||||
key: ${{ runner.os }}-pip-${{ inputs.python-version }}-${{ hashFiles('**/pyproject.toml', '**/requirements*.txt') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-pip-${{ inputs.python-version }}-
|
||||
${{ runner.os }}-pip-
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
python -m pip install --upgrade pip pip-audit
|
||||
if [ -n "${{ inputs.install-extras }}" ]; then
|
||||
pip install -e ".[${{ inputs.install-extras }}]"
|
||||
elif [ -f requirements.txt ]; then
|
||||
pip install -r requirements.txt
|
||||
else
|
||||
pip install -e "."
|
||||
fi
|
||||
|
||||
- name: Security audit (pip-audit)
|
||||
id: audit
|
||||
run: |
|
||||
pip-audit --format=json --output=audit.json 2>/dev/null || true
|
||||
VULNS=$(python3 -c "
|
||||
import json, sys
|
||||
try:
|
||||
data = json.load(open('audit.json'))
|
||||
deps = data.get('dependencies', [])
|
||||
count = sum(len(d.get('vulns', [])) for d in deps)
|
||||
print(count)
|
||||
except Exception:
|
||||
print(0)
|
||||
")
|
||||
echo "vulnerabilities=$VULNS" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Open issue if vulnerabilities found
|
||||
if: steps.audit.outputs.vulnerabilities != '0'
|
||||
env:
|
||||
GITEA_TOKEN: ${{ gitea.token }}
|
||||
SERVER_URL: ${{ gitea.server_url }}
|
||||
REPOSITORY: ${{ gitea.repository }}
|
||||
run: |
|
||||
VULNS="${{ steps.audit.outputs.vulnerabilities }}"
|
||||
DATE=$(date '+%Y-%m-%d')
|
||||
|
||||
VULN_LIST=$(python3 -c "
|
||||
import json
|
||||
try:
|
||||
data = json.load(open('audit.json'))
|
||||
lines = []
|
||||
for dep in data.get('dependencies', []):
|
||||
for v in dep.get('vulns', []):
|
||||
lines.append(f\"- {dep['name']} {dep.get('version','?')}: {v.get('id','?')} ({v.get('description','')[:80]})\")
|
||||
print('\n'.join(lines[:20]))
|
||||
except Exception:
|
||||
print('N/A')
|
||||
")
|
||||
|
||||
printf '## Security Audit Python — %s\n\n### Vulnerabilità trovate: %s\n\n```\n%s\n```\n' \
|
||||
"$DATE" "$VULNS" "$VULN_LIST" > /tmp/body.md
|
||||
|
||||
curl -s -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Authorization: token $GITEA_TOKEN" \
|
||||
"$SERVER_URL/api/v1/repos/$REPOSITORY/issues" \
|
||||
-d "{
|
||||
\"title\": \"[$DATE] Security Python: $VULNS vulnerabilità rilevate\",
|
||||
\"body\": $(jq -Rs . /tmp/body.md)
|
||||
}"
|
||||
@@ -0,0 +1,89 @@
|
||||
name: Python Dependency Outdated
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
python-version:
|
||||
type: string
|
||||
default: '3.11'
|
||||
install-extras:
|
||||
type: string
|
||||
default: 'dev'
|
||||
working-directory:
|
||||
type: string
|
||||
default: '.'
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
python-dependency-outdated:
|
||||
runs-on: ubuntu-latest
|
||||
defaults:
|
||||
run:
|
||||
working-directory: ${{ inputs.working-directory }}
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: https://gitea.com/actions/checkout@v4
|
||||
|
||||
- name: Setup Python
|
||||
uses: https://github.com/actions/setup-python@v5
|
||||
with:
|
||||
python-version: ${{ inputs.python-version || '3.11' }}
|
||||
|
||||
- name: Cache pip
|
||||
uses: https://gitea.com/actions/cache@v4
|
||||
with:
|
||||
path: ~/.cache/pip
|
||||
key: ${{ runner.os }}-pip-${{ inputs.python-version }}-${{ hashFiles('**/pyproject.toml', '**/requirements*.txt') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-pip-${{ inputs.python-version }}-
|
||||
${{ runner.os }}-pip-
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
python -m pip install --upgrade pip
|
||||
if [ -n "${{ inputs.install-extras }}" ]; then
|
||||
pip install -e ".[${{ inputs.install-extras }}]"
|
||||
elif [ -f requirements.txt ]; then
|
||||
pip install -r requirements.txt
|
||||
else
|
||||
pip install -e "."
|
||||
fi
|
||||
|
||||
- name: Check outdated packages
|
||||
id: outdated
|
||||
run: |
|
||||
pip list --outdated --format=json > outdated.json 2>/dev/null || echo '[]' > outdated.json
|
||||
COUNT=$(python3 -c "import json; print(len(json.load(open('outdated.json'))))")
|
||||
echo "count=$COUNT" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Open issue if packages outdated
|
||||
if: steps.outdated.outputs.count != '0'
|
||||
env:
|
||||
GITEA_TOKEN: ${{ gitea.token }}
|
||||
SERVER_URL: ${{ gitea.server_url }}
|
||||
REPOSITORY: ${{ gitea.repository }}
|
||||
run: |
|
||||
COUNT="${{ steps.outdated.outputs.count }}"
|
||||
DATE=$(date '+%Y-%m-%d')
|
||||
|
||||
OUTDATED_LIST=$(python3 -c "
|
||||
import json
|
||||
try:
|
||||
data = json.load(open('outdated.json'))
|
||||
lines = [f\"- {p['name']}: {p['version']} → {p['latest_version']}\" for p in data[:20]]
|
||||
print('\n'.join(lines))
|
||||
except Exception:
|
||||
print('N/A')
|
||||
")
|
||||
|
||||
printf '## Dipendenze Python Obsolete — %s\n\n### Pacchetti da aggiornare: %s\n\n```\n%s\n```\n' \
|
||||
"$DATE" "$COUNT" "$OUTDATED_LIST" > /tmp/body.md
|
||||
|
||||
curl -s -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Authorization: token $GITEA_TOKEN" \
|
||||
"$SERVER_URL/api/v1/repos/$REPOSITORY/issues" \
|
||||
-d "{
|
||||
\"title\": \"[$DATE] Dipendenze Python: $COUNT pacchetti obsoleti\",
|
||||
\"body\": $(jq -Rs . /tmp/body.md)
|
||||
}"
|
||||
@@ -0,0 +1,116 @@
|
||||
name: Python Docker Release
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
python-version:
|
||||
type: string
|
||||
default: '3.11'
|
||||
install-extras:
|
||||
description: 'Extras pip da installare (es: dev, test)'
|
||||
type: string
|
||||
default: 'dev'
|
||||
runner:
|
||||
type: string
|
||||
default: 'catthehacker-latest'
|
||||
working-directory:
|
||||
description: 'Directory di lavoro se il progetto non è in root'
|
||||
type: string
|
||||
default: '.'
|
||||
dockerfile:
|
||||
description: 'Path al Dockerfile'
|
||||
type: string
|
||||
default: './Dockerfile'
|
||||
|
||||
jobs:
|
||||
python-docker-release:
|
||||
runs-on: ${{ inputs.runner }}
|
||||
defaults:
|
||||
run:
|
||||
working-directory: ${{ inputs.working-directory }}
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: https://gitea.com/actions/checkout@v4
|
||||
|
||||
- name: Setup Python
|
||||
uses: https://github.com/actions/setup-python@v5
|
||||
with:
|
||||
python-version: ${{ inputs.python-version || '3.11' }}
|
||||
|
||||
- name: Cache pip
|
||||
uses: https://gitea.com/actions/cache@v4
|
||||
with:
|
||||
path: ~/.cache/pip
|
||||
key: ${{ runner.os }}-pip-${{ inputs.python-version }}-${{ hashFiles('**/pyproject.toml', '**/requirements*.txt') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-pip-${{ inputs.python-version }}-
|
||||
${{ runner.os }}-pip-
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
python -m pip install --upgrade pip
|
||||
if [ -n "${{ inputs.install-extras }}" ]; then
|
||||
pip install -e ".[${{ inputs.install-extras }}]"
|
||||
elif [ -f requirements-dev.txt ]; then
|
||||
pip install -r requirements-dev.txt
|
||||
elif [ -f requirements.txt ]; then
|
||||
pip install -r requirements.txt
|
||||
else
|
||||
pip install -e "."
|
||||
fi
|
||||
|
||||
- name: Lint (ruff)
|
||||
run: ruff check .
|
||||
|
||||
- name: Format check (ruff)
|
||||
run: ruff format --check .
|
||||
|
||||
- name: Type check (mypy)
|
||||
run: mypy .
|
||||
|
||||
- name: Test (pytest)
|
||||
run: pytest --tb=short -q
|
||||
|
||||
- name: Login to container registry
|
||||
uses: https://gitea.com/docker/login-action@v3
|
||||
with:
|
||||
registry: gitea.pzetatouch.it
|
||||
username: ${{ secrets.G_USER }}
|
||||
password: ${{ secrets.NPM_TOKEN }}
|
||||
|
||||
- name: Determine image tags
|
||||
id: tags
|
||||
run: |
|
||||
APP_NAME=$(python -c "
|
||||
import tomllib, pathlib
|
||||
data = tomllib.loads(pathlib.Path('pyproject.toml').read_text())
|
||||
print(data['project']['name'])
|
||||
" 2>/dev/null || python3 -c "
|
||||
import re, pathlib
|
||||
content = pathlib.Path('pyproject.toml').read_text()
|
||||
m = re.search(r'^name\s*=\s*[\"\'](.*?)[\"\']', content, re.MULTILINE)
|
||||
print(m.group(1) if m else 'unknown')
|
||||
")
|
||||
VERSION=$(python -c "
|
||||
import tomllib, pathlib
|
||||
data = tomllib.loads(pathlib.Path('pyproject.toml').read_text())
|
||||
print(data['project']['version'])
|
||||
" 2>/dev/null || python3 -c "
|
||||
import re, pathlib
|
||||
content = pathlib.Path('pyproject.toml').read_text()
|
||||
m = re.search(r'^version\s*=\s*[\"\'](.*?)[\"\']', content, re.MULTILINE)
|
||||
print(m.group(1) if m else '0.0.0')
|
||||
")
|
||||
REGISTRY="gitea.pzetatouch.it/pzeta_touch"
|
||||
echo "version_tag=${REGISTRY}/${APP_NAME}:${VERSION}" >> $GITHUB_OUTPUT
|
||||
echo "latest_tag=${REGISTRY}/${APP_NAME}:latest" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Build and push Docker image
|
||||
uses: https://gitea.com/docker/build-push-action@v6
|
||||
with:
|
||||
push: true
|
||||
context: ${{ inputs.working-directory }}
|
||||
file: ${{ inputs.dockerfile }}
|
||||
tags: |
|
||||
${{ steps.tags.outputs.version_tag }}
|
||||
${{ steps.tags.outputs.latest_tag }}
|
||||
@@ -0,0 +1,65 @@
|
||||
name: Python Quality Gates
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
python-version:
|
||||
type: string
|
||||
default: '3.11'
|
||||
install-extras:
|
||||
description: 'Extras pip da installare (es: dev, test). Lasciare vuoto per solo requirements.txt'
|
||||
type: string
|
||||
default: 'dev'
|
||||
working-directory:
|
||||
description: 'Directory di lavoro se il progetto non è in root'
|
||||
type: string
|
||||
default: '.'
|
||||
|
||||
jobs:
|
||||
python-quality-gates:
|
||||
runs-on: ubuntu-latest
|
||||
defaults:
|
||||
run:
|
||||
working-directory: ${{ inputs.working-directory }}
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: https://gitea.com/actions/checkout@v4
|
||||
|
||||
- name: Setup Python
|
||||
uses: https://github.com/actions/setup-python@v5
|
||||
with:
|
||||
python-version: ${{ inputs.python-version || '3.11' }}
|
||||
|
||||
- name: Cache pip
|
||||
uses: https://gitea.com/actions/cache@v4
|
||||
with:
|
||||
path: ~/.cache/pip
|
||||
key: ${{ runner.os }}-pip-${{ inputs.python-version }}-${{ hashFiles('**/pyproject.toml', '**/requirements*.txt') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-pip-${{ inputs.python-version }}-
|
||||
${{ runner.os }}-pip-
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
python -m pip install --upgrade pip
|
||||
if [ -n "${{ inputs.install-extras }}" ]; then
|
||||
pip install -e ".[${{ inputs.install-extras }}]"
|
||||
elif [ -f requirements-dev.txt ]; then
|
||||
pip install -r requirements-dev.txt
|
||||
elif [ -f requirements.txt ]; then
|
||||
pip install -r requirements.txt
|
||||
else
|
||||
pip install -e "."
|
||||
fi
|
||||
|
||||
- name: Lint (ruff)
|
||||
run: ruff check .
|
||||
|
||||
- name: Format check (ruff)
|
||||
run: ruff format --check .
|
||||
|
||||
- name: Type check (mypy)
|
||||
run: mypy .
|
||||
|
||||
- name: Test (pytest)
|
||||
run: pytest --tb=short -q
|
||||
Reference in New Issue
Block a user