diff --git a/.actrc b/.actrc new file mode 100644 index 0000000..53f2d09 --- /dev/null +++ b/.actrc @@ -0,0 +1,3 @@ +--container-architecture linux/amd64 +-P ubuntu-latest=catthehacker/ubuntu:act-latest +--rm diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index b81f4b0..c3231f9 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -8,20 +8,28 @@ jobs: deploy: runs-on: ubuntu-latest steps: - - name: Pull package data - uses: actions/checkout@v4 - - - name: Setup Python - uses: actions/setup-python@v5 + - uses: actions/checkout@v4 + - uses: actions/setup-python@v5 with: python-version: "3.12" - - - name: Setup up uv - run: curl -LsSf https://astral.sh/uv/0.4.5/install.sh | sh + - uses: yezz123/setup-uv@v4 + - uses: snyk/actions/setup@master - name: Build package run: uv build + - name: Export requirements file for Snyk + run: | + uv pip compile pyproject.toml -o requirements.txt + pip3 install -r requirements.txt + + - name: Run Snyk + uses: snyk/actions/node@master + env: + SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} + with: + command: monitor --command=python3 --skip-unresolved=true + - name: Publish to PyPI uses: pypa/gh-action-pypi-publish@v1.4.1 with: diff --git a/.github/workflows/testing.yml b/.github/workflows/testing.yml index 21656a6..abf75d7 100644 --- a/.github/workflows/testing.yml +++ b/.github/workflows/testing.yml @@ -29,14 +29,8 @@ jobs: run: uv run ruff check tenint --exit-zero - name: Run unit tests - run: uv run pytest tests --cov-report xml:cov/coverage.xml + run: uv run pytest tests --cov-report term-missing - - name: Save Coverage Report - uses: actions/upload-artifact@v4 - with: - name: coverage_report - path: cov - retention-days: 1 security_tests: runs-on: ubuntu-latest @@ -48,12 +42,15 @@ jobs: uses: actions/setup-python@v5 with: python-version: "3.8" - - name: Setup up uv - run: curl -LsSf https://astral.sh/uv/0.4.5/install.sh | sh - - - name: Run pip-audit + - uses: yezz123/setup-uv@v4 + - uses: snyk/actions/setup@master + - name: Export a requirements file for Snyk run: | - uv export --format requirements-txt | uv tool run pip-audit - - - name: Run Bandit code auditor - run: uv tool run --with "bandit[toml,baseline,sarif]" bandit -c pyproject.toml -r . -ll + uv pip compile pyproject.toml -o requirements.txt + pip3 install -r requirements.txt + - name: Snyk Scan + uses: snyk/actions/node@master + env: + SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} + with: + command: test --command=python3 --skip-unresolved=true diff --git a/.gitignore b/.gitignore index e602e22..852787b 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,9 @@ .DS_Store __pycache__ *.pyc +.*_cache .coverage +.env +.vars +.secrets +requirements.txt