From 964b58778d6d486444cabd6150ff5e6ae0c3b797 Mon Sep 17 00:00:00 2001 From: catborise Date: Sat, 3 Oct 2026 12:58:43 +0300 Subject: [PATCH] ci: test Python 3.13, check migrations, schema, deploy and audit - Matrix 3.10-3.13; pip cache keyed on the requirements. - New steps: makemigrations --check, spectacular --validate --fail-on-warn, check --deploy --fail-level ERROR, pip-audit of the installed environment (the Django 4.2.30 advisories are ignored until the Django 5.2 upgrade), and a Docker image build. - The separate vrtManager unittest run is dropped; manage.py test already runs those tests. - CodeQL also runs on pull requests to master. - Docker installs into a plain venv instead of using the distro's python3-lxml and python3-libvirt; lxml>=6.1, since the distro's lxml 5.2.1 has CVE-2026-41066. - dev requirements add ruff and pip-audit. --- .github/workflows/codeql-analysis.yml | 2 +- .github/workflows/test.yml | 63 +++++++++++++++++++-------- Dockerfile | 6 +-- README.md | 9 ++-- conf/requirements.txt | 2 +- dev/requirements.txt | 2 + 6 files changed, 55 insertions(+), 29 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 1c5421d4..064f8a89 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -9,7 +9,7 @@ on: push: branches: [master] pull_request: - branches-ignore: [master] + branches: [master] schedule: - cron: '0 21 * * 3' diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 8e71d944..400b3519 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -13,7 +13,7 @@ jobs: strategy: fail-fast: false matrix: - python-version: ['3.10', '3.11', '3.12'] + python-version: ['3.10', '3.11', '3.12', '3.13'] steps: - name: Checkout Code @@ -24,8 +24,11 @@ jobs: with: python-version: ${{ matrix.python-version }} cache: 'pip' - cache-dependency-path: 'conf/requirements.txt' + cache-dependency-path: | + conf/requirements.txt + dev/requirements.txt + # Build headers for the sdist-only bindings (libvirt-python, python-ldap) - name: Install System Dependencies run: | sudo apt-get update -qq @@ -33,19 +36,13 @@ jobs: libvirt-dev \ libldap2-dev \ libsasl2-dev \ - python3-lxml \ - zlib1g-dev \ - libxslt1-dev \ pkg-config \ - gcc \ - libssl-dev \ - libxml2-dev + gcc - name: Install Python Dependencies run: | - python -m pip install --upgrade pip setuptools wheel - pip install -r conf/requirements.txt - if [ -f dev/requirements.txt ]; then pip install -r dev/requirements.txt; fi + python -m pip install --upgrade pip setuptools + pip install -r dev/requirements.txt - name: Configure WebVirtCloud Settings run: | @@ -53,14 +50,44 @@ jobs: SECRET_KEY=$(python -c 'import secrets; print(secrets.token_urlsafe(50))') sed -i "s|^SECRET_KEY = .*|SECRET_KEY = \"${SECRET_KEY}\"|" webvirtcloud/settings.py + - name: Check For Missing Migrations + run: python manage.py makemigrations --check --dry-run + - name: Run Django Migrations - run: | - python manage.py migrate --noinput + run: python manage.py migrate --noinput - - name: Run Django Test Suite - run: | - python manage.py test + # Includes the vrtManager tests + - name: Run Test Suite + run: python manage.py test - - name: Run vrtManager Unit Tests + - name: Validate OpenAPI Schema + run: python manage.py spectacular --validate --fail-on-warn --file /dev/null + + # Security warnings (HSTS, secure cookies) depend on the deployment; + # gate on errors only. + - name: Deployment Checks + run: python manage.py check --deploy --fail-level ERROR + + # The ignored IDs are Django 4.2.30 advisories, fixed in Django 5.2.17. + # Remove them with the Django 5.2 upgrade. + - name: Audit Installed Packages run: | - python -m unittest discover -s vrtManager -p "test_*.py" + pip-audit \ + --ignore-vuln PYSEC-2026-198 \ + --ignore-vuln PYSEC-2026-199 \ + --ignore-vuln PYSEC-2026-201 \ + --ignore-vuln PYSEC-2026-2090 \ + --ignore-vuln PYSEC-2026-2091 \ + --ignore-vuln PYSEC-2026-2092 \ + --ignore-vuln PYSEC-2026-3717 \ + --ignore-vuln PYSEC-2026-4035 + + docker: + name: Docker Image + runs-on: ubuntu-latest + steps: + - name: Checkout Code + uses: actions/checkout@v4 + + - name: Build Image + run: docker build -t webvirtcloud:ci . diff --git a/Dockerfile b/Dockerfile index be297797..a6871054 100644 --- a/Dockerfile +++ b/Dockerfile @@ -16,8 +16,6 @@ RUN apt-get update -qqy \ python3-venv \ python3-pip \ python3-dev \ - python3-lxml \ - python3-libvirt \ libvirt-dev \ zlib1g-dev \ nginx \ @@ -32,10 +30,10 @@ RUN apt-get update -qqy \ # Setup webvirtcloud WORKDIR /srv/webvirtcloud -# Install Python dependencies first with system-site-packages to leverage prebuilt bindings +# Install Python dependencies first; libvirt-python and python-ldap build from source COPY conf/requirements.txt conf/requirements.txt # hadolint ignore=DL3013,DL3042,SC1091 -RUN python3 -m venv --system-site-packages venv && \ +RUN python3 -m venv venv && \ . venv/bin/activate && \ pip3 install --no-cache-dir -U pip wheel && \ pip3 install --no-cache-dir -r conf/requirements.txt diff --git a/README.md b/README.md index b8a98174..b1a1534e 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ [![Gitpod ready-to-code](https://img.shields.io/badge/Gitpod-ready--to--code-blue?logo=gitpod)](https://gitpod.io/#https://github.com/retspen/webvirtcloud) # WebVirtCloud -###### Python >=3.10 & Django 4.2 LTS (tested on Python 3.10 – 3.12) +###### Python >=3.10 & Django 4.2 LTS (tested on Python 3.10 – 3.13) ## Purpose and Scope @@ -436,13 +436,12 @@ Use the same virtualenv as in [Local Development Setup](#local-development-setup source .venv/bin/activate ``` -### 2. Run Test Suite +### 2. Run Test Suite and Linter ```bash -# Run Django test suite (accounts, admin, instances, logs, etc.): +# All tests, including vrtManager: python manage.py test -# Run vrtManager unit tests: -python -m unittest discover -s vrtManager -p "test_*.py" +ruff check . ``` > **Live Hypervisor Testing (Optional):** diff --git a/conf/requirements.txt b/conf/requirements.txt index 24866802..7435ab46 100644 --- a/conf/requirements.txt +++ b/conf/requirements.txt @@ -12,7 +12,7 @@ eventlet==0.41.2 gunicorn==26.2.0 libsass==0.23.0 libvirt-python>=9.0.0 -lxml>=4.9.0 +lxml>=6.1 ldap3==2.9.1 markdown==3.10 paramiko==5.0.0 diff --git a/dev/requirements.txt b/dev/requirements.txt index f5030a81..358be511 100644 --- a/dev/requirements.txt +++ b/dev/requirements.txt @@ -7,3 +7,5 @@ pyflakes==4.0.0 pylint==4.0.9 yapf==0.43.0 black==26.5.1 +pip-audit==2.10.1 +ruff==0.16.10