-
Notifications
You must be signed in to change notification settings - Fork 62
251 lines (221 loc) · 8.9 KB
/
code_checks.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
name: Code Checks
on:
push:
branches: [master]
pull_request:
types: [opened, reopened, synchronize]
permissions:
contents: read
checks: write
jobs:
linting_and_security:
name: Linting and Security
env:
BUNDLE_ENTERPRISE__CONTRIBSYS__COM: ${{ secrets.BUNDLE_ENTERPRISE__CONTRIBSYS__COM }}
permissions: write-all
runs-on: ubuntu-16-cores-latest
steps:
- uses: actions/checkout@v4
- uses: ruby/setup-ruby@1d0e911f615a112e322369596f10ee0b95b010ae # v1.183.0
with:
bundler-cache: true
- name: Remove Review label
if: github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ready-for-backend-review')
uses: actions-ecosystem/action-remove-labels@v1
with:
number: ${{ github.event.pull_request.number }}
labels: |
ready-for-backend-review
- name: Run bundle-audit (checks gems for CVE issues)
run: bundle exec bundle-audit check --update --ignore CVE-2024-27456
- name: Run Rubocop
run: bundle exec rubocop --parallel --format github
- name: Run Brakeman
run: bundle exec brakeman --ensure-latest --confidence-level=2 --format github
- name: Add Lint Failure label
if: failure() && github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'lint-failure')
uses: actions-ecosystem/action-add-labels@v1
with:
number: ${{ github.event.pull_request.number }}
labels: |
lint-failure
- name: Remove Lint Failure label
if: success() && github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'lint-failure')
uses: actions-ecosystem/action-remove-labels@v1
with:
number: ${{ github.event.pull_request.number }}
labels: |
lint-failure
tests:
name: Test
env:
BUNDLE_ENTERPRISE__CONTRIBSYS__COM: ${{ secrets.BUNDLE_ENTERPRISE__CONTRIBSYS__COM }}
CI: true
RAILS_ENV: test
TERM: xterm-256color
DOCKER_BUILDKIT: 1
COMPOSE_DOCKER_CLI_BUILD: 1
permissions: write-all
runs-on: ubuntu-16-cores-latest
steps:
- uses: actions/checkout@v4
- uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKERHUB_USER }}
password: ${{ secrets.DOCKERHUB_PASSWORD }}
- name: Configure AWS credentials
uses: aws-actions/[email protected]
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: us-gov-west-1
- name: Login to Amazon ECR
id: ecr-login
uses: aws-actions/[email protected]
with:
mask-password: true
- name: Setup Environment
run: |
echo "VETS_API_USER_ID=$(id -u)" >> $GITHUB_ENV
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Remove Review label
if: github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ready-for-backend-review')
uses: actions-ecosystem/action-remove-labels@v1
with:
number: ${{ github.event.pull_request.number }}
labels: |
ready-for-backend-review
- name: Remove Test Passing label
if: github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'test-passing')
uses: actions-ecosystem/action-remove-labels@v1
with:
number: ${{ github.event.pull_request.number }}
labels: |
test-passing
- name: Build Docker Image
uses: docker/build-push-action@v6
env:
DOCKER_BUILD_SUMMARY: false
with:
build-args: |
BUNDLE_ENTERPRISE__CONTRIBSYS__COM=${{ env.BUNDLE_ENTERPRISE__CONTRIBSYS__COM }}
USER_ID=${{ env.VETS_API_USER_ID }}
context: .
push: false
load: true
tags: vets-api
cache-from: type=gha
cache-to: type=gha,mode=max
- name: Setup Database
uses: nick-fields/retry@7152eba30c6575329ac0576536151aca5a72780e # v3.0.0
with:
timeout_minutes: 20
retry_wait_seconds: 3 # Seconds
max_attempts: 3
command: |
docker compose -f docker-compose.test.yml run web bash \
-c "CI=true RAILS_ENV=test DISABLE_BOOTSNAP=true bundle exec parallel_test -n 13 -e 'bin/rails db:reset'"
- name: Run Specs
timeout-minutes: 20
run: |
docker compose -f docker-compose.test.yml run web bash \
-c "CI=true DISABLE_BOOTSNAP=true bundle exec parallel_rspec spec/ modules/ -n 13 -o '--color --tty'"
- name: Upload Coverage Report
uses: actions/upload-artifact@v4
if: always()
with:
name: Coverage Report
path: coverage
include-hidden-files: true
- name: Upload Test Results
uses: actions/upload-artifact@v4
if: always()
with:
name: Test Results
path: log/*.xml
if-no-files-found: ignore
- name: Add Test Failure label
if: failure() && github.event_name == 'pull_request'
uses: actions-ecosystem/action-add-labels@v1
with:
number: ${{ github.event.pull_request.number }}
labels: |
test-failure
- name: Remove Test Failure label
if: success() && github.event_name == 'pull_request'
uses: actions-ecosystem/action-remove-labels@v1
with:
number: ${{ github.event.pull_request.number }}
labels: |
test-failure
- name: Add Test Passing label
if: success() && github.event_name == 'pull_request'
uses: actions-ecosystem/action-add-labels@v1
with:
number: ${{ github.event.pull_request.number }}
labels: |
test-passing
- name: Add omit-backend-approval label
if: |
github.event_name == 'pull_request' && github.event.pull_request.draft == false &&
(
contains(toJSON(github.event.pull_request.requested_teams.*.name), 'mobile') ||
contains(toJSON(github.event.pull_request.requested_teams.*.name), 'lighthouse') ||
contains(toJSON(github.event.pull_request.requested_teams.*.name), 'identity')
)
uses: actions-ecosystem/action-add-labels@v1
with:
number: ${{ github.event.pull_request.number }}
labels: |
omit-backend-approval
- name: Add require-backend-approval label
uses: actions-ecosystem/action-add-labels@v1
if: |
github.event_name == 'pull_request' && github.event.pull_request.draft == false &&
!contains(toJSON(github.event.pull_request.requested_teams.*.name), 'mobile') &&
!contains(toJSON(github.event.pull_request.requested_teams.*.name), 'lighthouse') &&
!contains(toJSON(github.event.pull_request.requested_teams.*.name), 'identity')
with:
number: ${{ github.event.pull_request.number }}
labels: |
require-backend-approval
- name: Add Review label
uses: actions-ecosystem/action-add-labels@v1
if: |
github.event_name == 'pull_request' && success() && github.event.pull_request.draft == false &&
!contains(github.event.pull_request.labels.*.name, 'code-health-failure') &&
!contains(github.event.pull_request.labels.*.name, 'codeowners-addition-failure') &&
!contains(github.event.pull_request.labels.*.name, 'codeowners-delete-failure') &&
!contains(github.event.pull_request.labels.*.name, 'lint-failure') &&
!contains(github.event.pull_request.labels.*.name, 'test-failure')
with:
number: ${{ github.event.pull_request.number }}
labels: |
ready-for-backend-review
publish_results:
name: Publish Test Results and Coverage
if: always()
needs: [tests]
permissions: write-all
runs-on: ubuntu-16-cores-latest
steps:
- uses: actions/download-artifact@v4
- name: Publish Test Results to GitHub
uses: EnricoMi/publish-unit-test-result-action@v2
if: always()
with:
check_name: Test Results
comment_mode: off
files: Test Results/*.xml
github_token: ${{ secrets.GITHUB_TOKEN }}
- name: Fix up coverage report to work with coverage-check-action
run: sed -i 's/"line"/"covered_percent"/g' 'Coverage Report/.last_run.json'
- name: Publish Coverage Report
uses: devmasx/[email protected]
if: hashFiles('Coverage Report/.last_run.json') != ''
with:
type: simplecov
result_path: Coverage Report/.last_run.json
min_coverage: 90
token: ${{ secrets.GITHUB_TOKEN }}