ci.yaml

name: CI
on:
  workflow_dispatch:
  pull_request:
  push:
    branches:
      - main
    tags:
      - v*
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
jobs:
  build:
    name: Build
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Run build action
        uses: minvws/action-python-poetry-install@2a1cbf8c2270c5fec60acdbfebae3c072c27f1cb # v1.0.2
        with:
          python_version: "3.14"
  lint:
    name: Run code linter
    runs-on: ubuntu-24.04
    needs: build
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Run build action
        uses: minvws/action-python-poetry-install@2a1cbf8c2270c5fec60acdbfebae3c072c27f1cb # v1.0.2
        with:
          python_version: "3.14"
      - name: Lint
        run: poetry run ruff check --select E4,E7,E9,F,I,Q
      - name: Lint
        run: poetry run ruff check --select E4,E7,E9,F,I,Q
  type-check:
    name: Check static types
    runs-on: ubuntu-24.04
    needs: build
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Run build action
        uses: minvws/action-python-poetry-install@2a1cbf8c2270c5fec60acdbfebae3c072c27f1cb # v1.0.2
        with:
          python_version: "3.14"
      - name: Check static types
        run: poetry run mypy app tests
  safety-check:
    name: Scan packages for vulnerabilities
    runs-on: ubuntu-24.04
    needs: build
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Run build action
        uses: minvws/action-python-poetry-install@2a1cbf8c2270c5fec60acdbfebae3c072c27f1cb # v1.0.2
        with:
          python_version: "3.14"
      - name: Scan packages for vulnerabilities
        run: poetry run pip-audit
  spelling-check:
    name: Run spelling check
    runs-on: ubuntu-24.04
    needs: build
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Run build action
        uses: minvws/action-python-poetry-install@2a1cbf8c2270c5fec60acdbfebae3c072c27f1cb # v1.0.2
        with:
          python_version: "3.14"
      - uses: codespell-project/codespell-problem-matcher@9ba2c57125d4908eade4308f32c4ff814c184633 # v1.2.0
      - name: Run spelling check
        run: poetry run codespell .
  editorconfig-checker:
    name: format check editorconfig
    runs-on: ubuntu-24.04
    steps:
      - name: Check out code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Set up editorconfig-checker
        uses: editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c #v2.2.0
      - name: Run editorconfig-checker
        run: editorconfig-checker --exclude "\\.py$"
  test:
    name: Run the tests
    runs-on: ubuntu-24.04
    needs: build
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Run build action
        uses: minvws/action-python-poetry-install@2a1cbf8c2270c5fec60acdbfebae3c072c27f1cb # v1.0.2
        with:
          python_version: "3.14"
      - name: install dependencies
        run: |
          sudo apt update
          sudo apt install -y libpq-dev build-essential postgresql-client
      - name: install liboprf
        run: |
          sudo apt install -y libsodium-dev
          git clone --depth 1 --branch v0.9.3 https://github.com/stef/liboprf.git
          cd liboprf/src
          make
          sudo make install
          sudo ldconfig
      - name: Run the tests
        env:
          FASTAPI_CONFIG_PATH: ./app.ci.conf
        run: |
          poetry run pytest --cov --cov-report=term --cov-report=xml
      - name: Upload coverage report
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: coverage
          path: coverage.xml
  sonar:
    name: SonarCloud
    runs-on: ubuntu-24.04
    needs: test
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
      - name: Download coverage report
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: coverage
      - name: Run SonarQube scan
        uses: minvws/action-sonarqube@v1
        with:
          sonar-token: ${{ secrets.SONAR_TOKEN }}
  detect_modified_files:
    name: Modified files
    runs-on: ubuntu-24.04
    outputs:
      image_files_changed: ${{ steps.image-files-changed.outputs.any_changed }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Check image-related file changes
        id: image-files-changed
        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
        with:
          files: |
            docker/Dockerfile
            pyproject.toml
            poetry.lock
            .github/workflows/ci.yaml
  image_build_scan_push:
    name: Build, scan, and push Docker image
    runs-on: ubuntu-24.04
    needs: [build, lint, type-check, safety-check, spelling-check, test, detect_modified_files]
    # Only run this job on main branch, version tags, or if image-related files have changed
    if: |
      github.ref == 'refs/heads/main' ||
      startsWith(github.ref, 'refs/tags/v') ||
      needs.detect_modified_files.outputs.image_files_changed == 'true'
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Log in to the Container registry
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Create version.json
        run: |
          RELEASE_VERSION="${GITHUB_REF#refs/*/}"
          echo "RELEASE_VERSION=$RELEASE_VERSION" >> $GITHUB_ENV
          echo "{ \"version\": \"${RELEASE_VERSION}\", \"git_ref\": \"$GITHUB_SHA\"}" > version.json
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        with:
          images: ghcr.io/${{ github.repository }}
      - name: Build Docker image
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        env:
          NEW_UID: 1000
          NEW_GID: 1000
        with:
          context: .
          file: docker/Dockerfile
          push: false
          load: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            NEW_UID=${{ env.NEW_UID }}
            NEW_GID=${{ env.NEW_GID }}
            standalone=true
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
          format: "sarif"
          output: "trivy-results.sarif"
          exit-code: "0"
          severity: "CRITICAL,HIGH"
          vuln-type: "library"
      # Re-enable if Code security tab upload is enabled by OPS
      # - name: Upload Trivy scan results to GitHub Security tab
      #   uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
      #   # Only upload SARIF results on main branch or version tags
      #   if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
      #   with:
      #     sarif_file: "trivy-results.sarif"
      - name: Fail build on vulnerabilities
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
          format: "table"
          exit-code: ${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')) && '0' || '1' }}
          severity: "CRITICAL,HIGH"
          vuln-type: "library"
          skip-setup-trivy: true
      - name: Push Docker image
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
        env:
          NEW_UID: 1000
          NEW_GID: 1000
        with:
          context: .
          file: docker/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            NEW_UID=${{ env.NEW_UID }}
            NEW_GID=${{ env.NEW_GID }}
            standalone=true