Skip to content

Commit f3769c9

Browse files
author
Datata1
committed
test: change ci
1 parent 511e941 commit f3769c9

File tree

1 file changed

+123
-87
lines changed

1 file changed

+123
-87
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 123 additions & 87 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: Python tests
1+
name: Python CI
22

33
on:
44
pull_request:
@@ -13,96 +13,132 @@ permissions:
1313
pull-requests: write
1414

1515
jobs:
16-
pytest:
16+
security_check:
17+
name: Security Check (Bandit)
1718
runs-on: ubuntu-latest
19+
permissions:
20+
contents: read
21+
pull-requests: write
22+
23+
steps:
24+
- name: Checkout repository
25+
uses: actions/checkout@v4
26+
27+
- name: Install uv package manager
28+
uses: astral-sh/setup-uv@v6
29+
with:
30+
activate-environment: true
31+
32+
- name: Install dependencies
33+
run: uv sync --extra dev
34+
shell: bash
35+
36+
- name: Run Bandit security check
37+
id: bandit_check
38+
run: |
39+
echo "Running Bandit security check..."
40+
# Wir nutzen 'uv run', um sicherzustellen, dass bandit im venv ausgeführt wird
41+
# set +e erlaubt, dass der Step weiterläuft, auch wenn Bandit Fehler findet (Exit Code 1)
42+
set +e
43+
uv run bandit -r . -c pyproject.toml --format=custom --msg-template "{abspath}:{line}: {test_id}[{severity}]: {msg}" -o bandit-results.txt
44+
BANDIT_EXIT_CODE=$?
45+
set -e
46+
47+
echo "Bandit scan finished. Exit code: $BANDIT_EXIT_CODE"
48+
49+
# Zeige Ergebnisse im Log an
50+
if [ -f bandit-results.txt ]; then
51+
cat bandit-results.txt
52+
fi
53+
54+
echo "BANDIT_EXIT_CODE=${BANDIT_EXIT_CODE}" >> $GITHUB_ENV
55+
shell: bash
56+
57+
- name: Prepare Bandit comment body
58+
id: prep_bandit_comment
59+
if: github.event_name == 'pull_request'
60+
run: |
61+
echo "Preparing Bandit comment body..."
62+
COMMENT_BODY_FILE="bandit-comment-body.md"
63+
echo "COMMENT_BODY_FILE=${COMMENT_BODY_FILE}" >> $GITHUB_ENV
64+
65+
echo "### 🛡️ Bandit Security Scan Results" > $COMMENT_BODY_FILE
66+
echo "" >> $COMMENT_BODY_FILE
67+
68+
# WICHTIG: Hier wurde der Pfad korrigiert (das 'backend/' Prefix entfernt)
69+
if [ -s bandit-results.txt ]; then
70+
echo "\`\`\`text" >> $COMMENT_BODY_FILE
71+
cat bandit-results.txt >> $COMMENT_BODY_FILE
72+
echo "\`\`\`" >> $COMMENT_BODY_FILE
73+
else
74+
echo "✅ No security issues found by Bandit." >> $COMMENT_BODY_FILE
75+
fi
76+
shell: bash
77+
78+
- name: Find Comment
79+
uses: peter-evans/find-comment@v3
80+
id: fc
81+
with:
82+
issue-number: ${{ github.event.pull_request.number }}
83+
comment-author: 'github-actions[bot]'
84+
body-includes: Bandit Security Scan Results
85+
86+
- name: Post Bandit results as PR comment
87+
if: github.event_name == 'pull_request'
88+
uses: peter-evans/create-or-update-comment@v4
89+
with:
90+
token: ${{ secrets.GITHUB_TOKEN }}
91+
repository: ${{ github.repository }}
92+
issue-number: ${{ github.event.pull_request.number }}
93+
comment-id: ${{ steps.fc.outputs.comment-id }}
94+
body-file: ${{ env.COMMENT_BODY_FILE }}
95+
edit-mode: replace
96+
97+
- name: Fail if Bandit found issues
98+
if: env.BANDIT_EXIT_CODE != '0'
99+
run: exit ${{ env.BANDIT_EXIT_CODE }}
100+
101+
- name: Minimize uv cache
102+
run: uv cache prune --ci
18103

104+
pytest:
105+
name: Python Tests
106+
runs-on: ubuntu-latest
19107
permissions:
20108
contents: read
21109
pull-requests: write
22110

23111
steps:
24-
- name: Checkout repository
25-
uses: actions/checkout@v4
26-
27-
- name: Install uv package manager
28-
uses: astral-sh/setup-uv@v6
29-
with:
30-
activate-environment: true
31-
32-
- name: Install dependencies using uv
33-
run: |
34-
uv sync --extra dev
35-
shell: bash
36-
37-
- name: Run Bandit security check on backend code
38-
id: bandit_check
39-
run: |
40-
echo "Running Bandit security check..."
41-
set +e
42-
bandit -r . -c pyproject.toml --format=custom --msg-template "{abspath}:{line}: {test_id}[{severity}]: {msg}" -o bandit-results.txt
43-
cat bandit-results.txt
44-
BANDIT_EXIT_CODE=$?
45-
set -e
46-
echo "Bandit scan finished. Exit code: $BANDIT_EXIT_CODE"
47-
echo "BANDIT_EXIT_CODE=${BANDIT_EXIT_CODE}" >> $GITHUB_ENV
48-
shell: bash
49-
50-
- name: Prepare Bandit comment body
51-
id: prep_bandit_comment
52-
if: github.event_name == 'pull_request'
53-
run: |
54-
echo "Preparing Bandit comment body..."
55-
COMMENT_BODY_FILE="bandit-comment-body.md"
56-
echo "COMMENT_BODY_FILE=${COMMENT_BODY_FILE}" >> $GITHUB_ENV
57-
58-
echo "### 🛡️ Bandit Security Scan Results" > $COMMENT_BODY_FILE
59-
echo "" >> $COMMENT_BODY_FILE
60-
echo "" >> $COMMENT_BODY_FILE
61-
echo "" >> $COMMENT_BODY_FILE
62-
63-
if [ -s backend/bandit-results.txt ]; then
64-
echo "\`\`\`text" >> $COMMENT_BODY_FILE
65-
cat backend/bandit-results.txt >> $COMMENT_BODY_FILE
66-
echo "\`\`\`" >> $COMMENT_BODY_FILE
67-
else
68-
echo "✅ No security issues found by Bandit." >> $COMMENT_BODY_FILE
69-
fi
70-
shell: bash
71-
72-
- name: Find Comment
73-
uses: peter-evans/find-comment@v3
74-
id: fc
75-
with:
76-
issue-number: ${{ github.event.pull_request.number }}
77-
comment-author: 'github-actions[bot]'
78-
body-includes: Bandit Security Scan Results
79-
80-
- name: Post Bandit results as PR comment
81-
if: github.event_name == 'pull_request' && always()
82-
uses: peter-evans/create-or-update-comment@v4
83-
with:
84-
token: ${{ secrets.GITHUB_TOKEN }}
85-
repository: ${{ github.repository }}
86-
issue-number: ${{ github.event.pull_request.number }}
87-
comment-id: ${{ steps.fc.outputs.comment-id }}
88-
body-file: ${{ env.COMMENT_BODY_FILE }}
89-
edit-mode: replace
90-
91-
- name: Run tests with pytest using uv
92-
run: |
93-
pytest --junitxml=junit/test-results.xml --cov-report=xml --cov-report=html --cov=. | tee pytest-coverage.txt
94-
shell: bash
95-
96-
- name: Pytest coverage comment
97-
if: github.event_name == 'pull_request' && always()
98-
uses: MishaKav/pytest-coverage-comment@main
99-
with:
100-
unique-id-for-comment: coverage-report
101-
pytest-xml-coverage-path: coverage.xml
102-
pytest-coverage-path: pytest-coverage.txt
103-
junitxml-path: junit/test-results.xml
104-
title: Pytest Coverage Report
105-
junitxml-title: Test Execution Summary
106-
107-
- name: Minimize uv cache
108-
run: uv cache prune --ci
112+
- name: Checkout repository
113+
uses: actions/checkout@v4
114+
115+
- name: Install uv package manager
116+
uses: astral-sh/setup-uv@v6
117+
with:
118+
activate-environment: true
119+
120+
- name: Install dependencies
121+
run: uv sync --extra dev
122+
shell: bash
123+
124+
- name: Run tests with pytest
125+
env:
126+
TOKEN: 'dummy-token-for-ci'
127+
CODESPHERE_TOKEN: 'dummy-token-for-ci'
128+
run: |
129+
uv run pytest --junitxml=junit/test-results.xml --cov-report=xml --cov-report=html --cov=. | tee pytest-coverage.txt
130+
shell: bash
131+
132+
- name: Pytest coverage comment
133+
if: github.event_name == 'pull_request' && always()
134+
uses: MishaKav/pytest-coverage-comment@main
135+
with:
136+
unique-id-for-comment: coverage-report
137+
pytest-xml-coverage-path: coverage.xml
138+
pytest-coverage-path: pytest-coverage.txt
139+
junitxml-path: junit/test-results.xml
140+
title: Pytest Coverage Report
141+
junitxml-title: Test Execution Summary
142+
143+
- name: Minimize uv cache
144+
run: uv cache prune --ci

0 commit comments

Comments
 (0)