mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 11:16:47 +00:00
8383a07ae3
The test and lint workflows set no permissions, so their GITHUB_TOKEN had the repository's default access (CodeQL actions/missing-workflow-permissions). Both only check out and build the code: they now ask for contents: read. .github/workflows/codeql-analysis.yml was disabled on GitHub; code scanning runs through GitHub's default CodeQL setup instead. The file only kept the old analysis category (and its 2023 alerts) around.
88 lines
2.5 KiB
YAML
88 lines
2.5 KiB
YAML
name: Test Suite
|
|
|
|
on:
|
|
push:
|
|
branches: ['**']
|
|
pull_request:
|
|
branches: [master]
|
|
|
|
# the jobs only read the code
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
test:
|
|
name: Python ${{ matrix.python-version }}
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
python-version: ['3.10', '3.11', '3.12', '3.13']
|
|
|
|
steps:
|
|
- name: Checkout Code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Python ${{ matrix.python-version }}
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: ${{ matrix.python-version }}
|
|
cache: 'pip'
|
|
cache-dependency-path: |
|
|
conf/requirements.txt
|
|
dev/requirements.txt
|
|
|
|
# Build headers for the sdist-only bindings (libvirt-python, python-ldap)
|
|
- name: Install System Dependencies
|
|
run: |
|
|
sudo apt-get update -qq
|
|
sudo apt-get install -y --no-install-recommends \
|
|
libvirt-dev \
|
|
libldap2-dev \
|
|
libsasl2-dev \
|
|
pkg-config \
|
|
gcc
|
|
|
|
- name: Install Python Dependencies
|
|
run: |
|
|
python -m pip install --upgrade pip setuptools
|
|
pip install -r dev/requirements.txt
|
|
|
|
- name: Configure WebVirtCloud Settings
|
|
run: |
|
|
cp webvirtcloud/settings.py.template webvirtcloud/settings.py
|
|
SECRET_KEY=$(python -c 'import secrets; print(secrets.token_urlsafe(50))')
|
|
sed -i "s|^SECRET_KEY = .*|SECRET_KEY = \"${SECRET_KEY}\"|" webvirtcloud/settings.py
|
|
|
|
- name: Check For Missing Migrations
|
|
run: python manage.py makemigrations --check --dry-run
|
|
|
|
- name: Run Django Migrations
|
|
run: python manage.py migrate --noinput
|
|
|
|
# Includes the vrtManager tests; fails below the coverage floor in pyproject.toml
|
|
- name: Run Test Suite
|
|
run: |
|
|
coverage run manage.py test
|
|
coverage report --skip-covered
|
|
|
|
- name: Validate OpenAPI Schema
|
|
run: python manage.py spectacular --validate --fail-on-warn --file /dev/null
|
|
|
|
# Security warnings (HSTS, secure cookies) depend on the deployment;
|
|
# gate on errors only.
|
|
- name: Deployment Checks
|
|
run: python manage.py check --deploy --fail-level ERROR
|
|
|
|
- name: Audit Installed Packages
|
|
run: pip-audit
|
|
|
|
docker:
|
|
name: Docker Image
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout Code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Build Image
|
|
run: docker build -t webvirtcloud:ci .
|