Skip to content

Commit 54968e4

Browse files
ix-56hix-56h
authored
Merge branch 'main' into fix_binary_files_handle
2 parents 89e7013 + c541a2c commit 54968e4

File tree

12 files changed

+352
-24
lines changed

12 files changed

+352
-24
lines changed

‎.github/dependabot.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,8 @@ updates:
1515
directory: "/"
1616
schedule: { interval: "weekly" }
1717
labels: [ "dependencies", "gh-actions" ]
18+
19+
- package-ecosystem: docker
20+
directory: /
21+
schedule:
22+
interval: daily

‎.github/workflows/ci.yml‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,15 @@ jobs:
2424
coverage: true
2525

2626
steps:
27-
- uses: actions/checkout@v4
27+
- name: Harden the runner (Audit all outbound calls)
28+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
29+
with:
30+
egress-policy: audit
31+
32+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2833

2934
- name: Set up Python
30-
uses: actions/setup-python@v5
35+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
3136
with:
3237
python-version: ${{ matrix.python-version }}
3338

@@ -37,7 +42,7 @@ jobs:
3742
run: echo "dir=$(python -m pip cache dir)" >> "$GITHUB_OUTPUT"
3843

3944
- name: Cache pip
40-
uses: actions/cache@v4
45+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
4146
with:
4247
path: ${{ steps.pip-cache.outputs.dir }}
4348
key: ${{ runner.os }}-pip-${{ hashFiles('pyproject.toml') }}
@@ -64,7 +69,7 @@ jobs:
6469
6570
- name: Upload coverage to Codecov
6671
if: ${{ matrix.coverage == true }}
67-
uses: codecov/codecov-action@v5
72+
uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
6873
with:
6974
token: ${{ secrets.CODECOV_TOKEN }}
7075
files: coverage.xml
@@ -74,5 +79,5 @@ jobs:
7479
verbose: true
7580

7681
- name: Run pre-commit hooks
77-
uses: pre-commit/action@v3.0.1
82+
uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
7883
if: ${{ matrix.python-version == '3.13' && matrix.os == 'ubuntu-latest' }}

‎.github/workflows/codeql.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
# For most projects, this workflow file will not need changing; you simply need
2+
# to commit it to your repository.
3+
#
4+
# You may wish to alter this file to override the set of languages analyzed,
5+
# or to provide custom queries or build logic.
6+
#
7+
# ******** NOTE ********
8+
# We have attempted to detect the languages in your repository. Please check
9+
# the `language` matrix defined below to confirm you have the correct set of
10+
# supported CodeQL languages.
11+
#
12+
name: "CodeQL"
13+
14+
on:
15+
push:
16+
branches: ["main"]
17+
pull_request:
18+
# The branches below must be a subset of the branches above
19+
branches: ["main"]
20+
schedule:
21+
- cron: "0 0 * * 1"
22+
23+
permissions:
24+
contents: read
25+
26+
jobs:
27+
analyze:
28+
name: Analyze
29+
runs-on: ubuntu-latest
30+
permissions:
31+
actions: read
32+
contents: read
33+
security-events: write
34+
35+
strategy:
36+
fail-fast: false
37+
matrix:
38+
language: ["javascript", "python"]
39+
# CodeQL supports [ $supported-codeql-languages ]
40+
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
41+
42+
steps:
43+
- name: Harden the runner (Audit all outbound calls)
44+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
45+
with:
46+
egress-policy: audit
47+
48+
- name: Checkout repository
49+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
50+
51+
# Initializes the CodeQL tools for scanning.
52+
- name: Initialize CodeQL
53+
uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
54+
with:
55+
languages: ${{ matrix.language }}
56+
# If you wish to specify custom queries, you can do so here or in a config file.
57+
# By default, queries listed here will override any specified in a config file.
58+
# Prefix the list here with "+" to use these queries and those in the config file.
59+
60+
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
61+
# If this step fails, then you should remove it and run the build manually (see below)
62+
- name: Autobuild
63+
uses: github/codeql-action/autobuild@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
64+
65+
# ℹ️ Command-line programs to run using the OS shell.
66+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
67+
68+
# If the Autobuild fails above, remove it and uncomment the following three lines.
69+
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
70+
71+
# - run: |
72+
# echo "Run, Build Application using script"
73+
# ./location_of_script_within_repo/buildscript.sh
74+
75+
- name: Perform CodeQL Analysis
76+
uses: github/codeql-action/analyze@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
77+
with:
78+
category: "/language:${{matrix.language}}"

‎.github/workflows/dependency-review.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Dependency Review Action
2+
#
3+
# This Action will scan dependency manifest files that change as part of a Pull Request,
4+
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
5+
# Once installed, if the workflow run is marked as required,
6+
# PRs introducing known-vulnerable packages will be blocked from merging.
7+
#
8+
# Source repository: https://github.com/actions/dependency-review-action
9+
name: 'Dependency Review'
10+
on: [pull_request]
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
dependency-review:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- name: Harden the runner (Audit all outbound calls)
20+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
21+
with:
22+
egress-policy: audit
23+
24+
- name: 'Checkout Repository'
25+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
26+
- name: 'Dependency Review'
27+
uses: actions/dependency-review-action@da24556b548a50705dd671f47852072ea4c105d9 # v4.7.1

‎.github/workflows/deploy-pr.yml‎

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
name: Manage PR Temp Envs
2+
'on':
3+
pull_request:
4+
types:
5+
- labeled
6+
- unlabeled
7+
- closed
8+
9+
permissions:
10+
contents: read
11+
pull-requests: write
12+
13+
env:
14+
APP_NAME: gitingest
15+
FLUX_OWNER: '${{ github.repository_owner }}'
16+
FLUX_REPO: '${{ secrets.CR_FLUX_REPO }}'
17+
18+
jobs:
19+
deploy-pr-env:
20+
if: >-
21+
${{ github.event.action == 'labeled' && github.event.label.name ==
22+
'deploy-pr-temp-env' }}
23+
runs-on: ubuntu-latest
24+
steps:
25+
- name: Create GitHub App token
26+
uses: actions/create-github-app-token@v2
27+
id: app-token
28+
with:
29+
app-id: '${{ secrets.CR_APP_CI_APP_ID }}'
30+
private-key: '${{ secrets.CR_APP_CI_PRIVATE_KEY }}'
31+
owner: '${{ env.FLUX_OWNER }}'
32+
repositories: '${{ env.FLUX_REPO }}'
33+
34+
- name: Checkout Flux repo
35+
uses: actions/checkout@v4
36+
with:
37+
repository: '${{ env.FLUX_OWNER }}/${{ env.FLUX_REPO }}'
38+
token: '${{ steps.app-token.outputs.token }}'
39+
path: flux-repo
40+
persist-credentials: false
41+
42+
- name: Export PR ID
43+
shell: bash
44+
run: 'echo "PR_ID=${{ github.event.pull_request.number }}" >> $GITHUB_ENV'
45+
46+
- name: Ensure template exists
47+
shell: bash
48+
run: >
49+
T="flux-repo/pr-template/${APP_NAME}"
50+
51+
[[ -d "$T" ]] || { echo "Missing $T"; exit 1; }
52+
53+
[[ $(find "$T" -type f | wc -l) -gt 0 ]] || { echo "No files in $T";
54+
exit 1; }
55+
56+
- name: Render & copy template
57+
shell: bash
58+
run: |
59+
SRC="flux-repo/pr-template/${APP_NAME}"
60+
DST="flux-repo/deployments/prs-${APP_NAME}/${PR_ID}"
61+
mkdir -p "$DST"
62+
cp -r "$SRC/." "$DST/"
63+
find "$DST" -type f -print0 \
64+
| xargs -0 -n1 sed -i "s|@PR-ID@|${PR_ID}|g"
65+
66+
- name: Sanity‑check rendered output
67+
shell: bash
68+
run: >
69+
E=$(find "flux-repo/pr-template/${APP_NAME}" -type f | wc -l)
70+
71+
G=$(find "flux-repo/deployments/prs-${APP_NAME}/${PR_ID}" -type f | wc
72+
-l)
73+
74+
(( G == E )) || { echo "Expected $E files, got $G"; exit 1; }
75+
76+
- name: Commit & push creation
77+
shell: bash
78+
run: >
79+
cd flux-repo
80+
81+
git config user.name "${{ steps.app-token.outputs.app-slug }}[bot]"
82+
83+
git config user.email "${{ steps.app-token.outputs.app-slug
84+
}}[bot]@users.noreply.github.com"
85+
86+
git add .
87+
88+
git commit -m "chore(prs-${APP_NAME}): create temp env for PR #${{
89+
env.PR_ID }} [skip ci]" || echo "Nothing to commit"
90+
91+
git remote set-url origin \
92+
https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/${{ env.FLUX_OWNER }}/${{ env.FLUX_REPO }}.git
93+
git push origin HEAD:main
94+
95+
- name: Comment preview URL on PR
96+
uses: thollander/actions-comment-pull-request@v3
97+
with:
98+
github-token: '${{ secrets.GITHUB_TOKEN }}'
99+
pr-number: '${{ github.event.pull_request.number }}'
100+
comment-tag: 'pr-preview'
101+
create-if-not-exists: 'true'
102+
message: |
103+
⚙️ Preview environment for PR #${{ env.PR_ID }} is available at:
104+
https://pr-${{ env.PR_ID }}.${{ env.APP_NAME }}.coderamp.dev/
105+
106+
remove-pr-env:
107+
if: >-
108+
(github.event.action == 'unlabeled' && github.event.label.name ==
109+
'deploy-pr-temp-env') || (github.event.action == 'closed')
110+
runs-on: ubuntu-latest
111+
steps:
112+
- name: Create GitHub App token
113+
uses: actions/create-github-app-token@v2
114+
id: app-token
115+
with:
116+
app-id: '${{ secrets.CR_APP_CI_APP_ID }}'
117+
private-key: '${{ secrets.CR_APP_CI_PRIVATE_KEY }}'
118+
owner: '${{ env.FLUX_OWNER }}'
119+
repositories: '${{ env.FLUX_REPO }}'
120+
121+
- name: Checkout Flux repo
122+
uses: actions/checkout@v4
123+
with:
124+
repository: '${{ env.FLUX_OWNER }}/${{ env.FLUX_REPO }}'
125+
token: '${{ steps.app-token.outputs.token }}'
126+
path: flux-repo
127+
persist-credentials: false
128+
129+
- name: Export PR ID
130+
shell: bash
131+
run: 'echo "PR_ID=${{ github.event.pull_request.number }}" >> $GITHUB_ENV'
132+
133+
- name: Remove deployed directory
134+
shell: bash
135+
run: |
136+
DST="flux-repo/deployments/prs-${APP_NAME}/${PR_ID}"
137+
if [[ -d "$DST" ]]; then
138+
rm -rf "$DST"
139+
echo "✅ Deleted $DST"
140+
else
141+
echo "⏭️ Nothing to delete at $DST"
142+
fi
143+
144+
- name: Commit & push deletion
145+
shell: bash
146+
run: >
147+
cd flux-repo
148+
149+
git config user.name "${{ steps.app-token.outputs.app-slug }}[bot]"
150+
151+
git config user.email "${{ steps.app-token.outputs.app-slug
152+
}}[bot]@users.noreply.github.com"
153+
154+
git add -A
155+
156+
git commit -m "chore(prs-${APP_NAME}): remove temp env for PR #${{
157+
env.PR_ID }} [skip ci]" || echo "Nothing to commit"
158+
159+
git remote set-url origin \
160+
https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/${{ env.FLUX_OWNER }}/${{ env.FLUX_REPO }}.git
161+
git push origin HEAD:main
162+
163+
- name: Comment preview URL on PR
164+
uses: thollander/actions-comment-pull-request@v3
165+
with:
166+
github-token: '${{ secrets.GITHUB_TOKEN }}'
167+
pr-number: '${{ github.event.pull_request.number }}'
168+
comment-tag: 'pr-preview'
169+
create-if-not-exists: 'true'
170+
message: |
171+
⚙️ Preview environment was undeployed.

0 commit comments

Comments
 (0)