Skip to content

Commit f273a17

Browse files
Xiangs18Xiangs18
authored
Merge pull request #22 from kbaseapps/dev-add_workflows
SECURITY-50: Add GHA workflows
2 parents d951457 + d0da285 commit f273a17

File tree

13 files changed

+226
-21
lines changed

13 files changed

+226
-21
lines changed

‎.env.example‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
# FLASK_DEBUG=1
2-
# FLASK_ENV=development
3-
# KBASE_ENDPOINT=https://ci.kbase.us/services/
4-
# KBASE_SECURE_CONFIG_PARAM_service_token=xyz
5-
# KBASE_SECURE_CONFIG_PARAM_CACHING_SERVICE_URL=https://ci.kbase.us/services/cache/v1
6-
# KBASE_SECURE_CONFIG_PARAM_HOMOLOGY_URL=https://homology.kbase.us
7-
# KBASE_SECURE_CONFIG_PARAM_ID_MAPPER_URL=https://ci.kbase.us/services/idmapper/api/v1
8-
# KBASE_SECURE_CONFIG_PARAM_HOMOLOGY_NAMESPACE=NCBI_Refseq
1+
FLASK_DEBUG=1
2+
FLASK_ENV=development
3+
KBASE_ENDPOINT=https://ci.kbase.us/services/
4+
KBASE_SECURE_CONFIG_PARAM_service_token=xyz
5+
KBASE_SECURE_CONFIG_PARAM_CACHING_SERVICE_URL=https://ci.kbase.us/services/cache/v1
6+
KBASE_SECURE_CONFIG_PARAM_HOMOLOGY_URL=https://homology.kbase.us
7+
KBASE_SECURE_CONFIG_PARAM_ID_MAPPER_URL=https://ci.kbase.us/services/idmapper/api/v1
8+
KBASE_SECURE_CONFIG_PARAM_HOMOLOGY_NAMESPACE=NCBI_Refseq

‎.github/codeql.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: "Code scanning - action"
2+
3+
on:
4+
push:
5+
pull_request:
6+
schedule:
7+
- cron: '0 19 * * 0'
8+
9+
jobs:
10+
CodeQL-Build:
11+
12+
# CodeQL runs on ubuntu-latest and windows-latest
13+
runs-on: ubuntu-latest
14+
15+
steps:
16+
- name: Checkout repository
17+
uses: actions/checkout@v4
18+
with:
19+
# We must fetch at least the immediate parents so that if this is
20+
# a pull request then we can checkout the head.
21+
fetch-depth: 2
22+
23+
# If this run was triggered by a pull request event, then checkout
24+
# the head of the pull request instead of the merge commit.
25+
- run: git checkout HEAD^2
26+
if: ${{ github.event_name == 'pull_request' }}
27+
28+
# Initializes the CodeQL tools for scanning.
29+
- name: Initialize CodeQL
30+
uses: github/codeql-action/init@v3
31+
# Override language selection by uncommenting this and choosing your languages
32+
# with:
33+
# languages: go, javascript, csharp, python, cpp, java
34+
35+
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
36+
# If this step fails, then you should remove it and run the build manually (see below)
37+
- name: Autobuild
38+
uses: github/codeql-action/autobuild@v3
39+
40+
# ℹ️ Command-line programs to run using the OS shell.
41+
# 📚 https://git.io/JvXDl
42+
43+
# ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
44+
# and modify them (or add more) to build your code if your project
45+
# uses a compiled language
46+
47+
#- run: |
48+
# make bootstrap
49+
# make release
50+
51+
- name: Perform CodeQL Analysis
52+
uses: github/codeql-action/analyze@v3

‎.github/dependabot.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
version: 2
2+
updates:
3+
4+
# Docker
5+
- package-ecosystem: docker
6+
directory: "/"
7+
schedule:
8+
interval: "monthly"
9+
open-pull-requests-limit: 25
10+
11+
# Python
12+
- package-ecosystem: "pip" # See documentation for possible values
13+
directory: "/" # Location of package manifests
14+
schedule:
15+
interval: "monthly"
16+
open-pull-requests-limit: 25
17+
18+
# GitHub Actions
19+
- package-ecosystem: "github-actions"
20+
directory: ".github/workflows"
21+
schedule:
22+
interval: "monthly"
23+
open-pull-requests-limit: 25

‎.github/workflows/manual-build.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
name: Manual Build & Push
3+
on:
4+
workflow_dispatch:
5+
jobs:
6+
build-push:
7+
uses: kbase/.github/.github/workflows/reusable_build-push.yml@main
8+
with:
9+
name: '${{ github.event.repository.name }}-develop'
10+
tags: br-${{ github.ref_name }}
11+
secrets: inherit

‎.github/workflows/pr_build.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
---
2+
name: Pull Request Build, Tag, & Push
3+
on:
4+
pull_request:
5+
branches:
6+
- develop
7+
- main
8+
- master
9+
types:
10+
- opened
11+
- reopened
12+
- synchronize
13+
- closed
14+
jobs:
15+
build-develop-open:
16+
if: github.base_ref == 'develop' && github.event.pull_request.merged == false
17+
uses: kbase/.github/.github/workflows/reusable_build.yml@main
18+
secrets: inherit
19+
build-develop-merge:
20+
if: github.base_ref == 'develop' && github.event.pull_request.merged == true
21+
uses: kbase/.github/.github/workflows/reusable_build-push.yml@main
22+
with:
23+
name: '${{ github.event.repository.name }}-develop'
24+
tags: pr-${{ github.event.number }},latest
25+
secrets: inherit
26+
build-main-open:
27+
if: (github.base_ref == 'main' || github.base_ref == 'master') && github.event.pull_request.merged == false
28+
uses: kbase/.github/.github/workflows/reusable_build-push.yml@main
29+
with:
30+
name: '${{ github.event.repository.name }}'
31+
tags: pr-${{ github.event.number }}
32+
secrets: inherit
33+
build-main-merge:
34+
if: (github.base_ref == 'main' || github.base_ref == 'master') && github.event.pull_request.merged == true
35+
uses: kbase/.github/.github/workflows/reusable_build-push.yml@main
36+
with:
37+
name: '${{ github.event.repository.name }}'
38+
tags: pr-${{ github.event.number }},latest-rc
39+
secrets: inherit
40+
trivy-scans:
41+
if: (github.base_ref == 'develop' || github.base_ref == 'main' || github.base_ref == 'master' ) && github.event.pull_request.merged == false
42+
uses: kbase/.github/.github/workflows/reusable_trivy-scans.yml@main
43+
secrets: inherit

‎.github/workflows/release-main.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
name: Release - Build & Push Image
3+
on:
4+
release:
5+
branches:
6+
- main
7+
- master
8+
types: [ published ]
9+
jobs:
10+
check-source-branch:
11+
uses: kbase/.github/.github/workflows/reusable_validate-branch.yml@main
12+
with:
13+
build_branch: '${{ github.event.release.target_commitish }}'
14+
validate-release-tag:
15+
needs: check-source-branch
16+
uses: kbase/.github/.github/workflows/reusable_validate-release-tag.yml@main
17+
with:
18+
release_tag: '${{ github.event.release.tag_name }}'
19+
build-push:
20+
needs: validate-release-tag
21+
uses: kbase/.github/.github/workflows/reusable_build-push.yml@main
22+
with:
23+
name: '${{ github.event.repository.name }}'
24+
tags: '${{ github.event.release.tag_name }},latest'
25+
secrets: inherit

‎.github/workflows/test.yml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
name: KBase Sketch Service test
2+
3+
on:
4+
pull_request:
5+
types:
6+
- opened
7+
- reopened
8+
- synchronize
9+
- ready_for_review
10+
push:
11+
# run workflow when merging to main or develop
12+
branches:
13+
- main
14+
- master
15+
- develop
16+
17+
jobs:
18+
sketch_service_tests:
19+
runs-on: ubuntu-latest
20+
21+
steps:
22+
- name: Repo checkout
23+
uses: actions/checkout@v4
24+
25+
- name: Setup Python
26+
uses: actions/setup-python@v5
27+
with:
28+
python-version: 3.9.19
29+
30+
- name: Install dependencies and set up test config
31+
env:
32+
TEST_TOKEN: ${{secrets.KBASE_CI_TOKEN}}
33+
run: |
34+
35+
# install python libraries
36+
python -m pip install --upgrade pip
37+
pip install -r requirements.txt
38+
pip install -r dev-requirements.txt
39+
40+
# set up test config
41+
cp -n .env.example .env
42+
sed -i "s#^KBASE_SECURE_CONFIG_PARAM_service_token=.*#KBASE_SECURE_CONFIG_PARAM_service_token=$TEST_TOKEN#" .env
43+
44+
- name: Run tests
45+
shell: bash
46+
run: |
47+
docker compose up -d
48+
docker compose run web test
49+
50+
- name: Upload coverage to Codecov
51+
uses: codecov/codecov-action@v5
52+
with:
53+
token: ${{ secrets.CODECOV_TOKEN }}
54+
fail_ci_if_error: true

‎.travis.yml‎

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM python:3.7-slim-stretch
1+
FROM python:3.9.19-slim
22

33
ARG DEVELOPMENT
44

@@ -18,7 +18,7 @@ COPY requirements.txt /kb/module/requirements.txt
1818
COPY dev-requirements.txt /kb/module/dev-requirements.txt
1919
WORKDIR /kb/module
2020
RUN pip install --upgrade pip && \
21-
pip install pandas==0.24.1 && \
21+
pip install pandas==2.2.3 && \
2222
pip install --upgrade -r requirements.txt \
2323
kbase-workspace-client==0.2.1 && \
2424
pip install --extra-index-url https://pypi.anaconda.org/kbase/simple \

‎dev-requirements.txt‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
mypy==0.812
22
bandit==1.7.0
3-
mccabe==0.6.1
4-
flake8==3.8.4
5-
coverage==5.4
3+
mccabe==0.7.0
4+
flake8==5.0.4
5+
pytest==7.4.0
6+
pytest-cov==4.1.0

0 commit comments

Comments
 (0)