Update workflows

exasol · Dec 18, 2024 · 1b4bad6 · 1b4bad6
1 parent 459fe6d
commit 1b4bad6
Show file tree

Hide file tree

Showing 8 changed files with 161 additions and 41 deletions.
diff --git a/.github/workflows/build-and-publish.yml b/.github/workflows/build-and-publish.yml
@@ -9,7 +9,7 @@ on:
 jobs:
 
   cd-job:
-    name: Continues Delivery
+    name: Continuous Delivery
     runs-on: ubuntu-latest
     steps:
 
@@ -34,5 +34,5 @@ jobs:
         run: >
           gh release create ${GITHUB_REF_NAME}
           --title ${GITHUB_REF_NAME}
-          --notes-file doc/changes/changes_${GITHUB_REF_NAME}.md
+          --notes-file ./doc/changes/changes_${GITHUB_REF_NAME}.md
           dist/*
diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
@@ -0,0 +1,24 @@
+name: CD
+
+on:
+  push:
+    tags:
+      - '**'
+
+jobs:
+
+  check-tag-version-job:
+    name: Check Release Tag
+    uses: ./.github/workflows/check-release-tag.yml
+
+  cd-job:
+    name: Continuous Delivery
+    uses: ./.github/workflows/build-and-publish.yml
+    secrets:
+      PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
+
+  publish-docs:
+    needs: [ cd-job ]
+    name: Publish Documentation
+    uses: ./.github/workflows/gh-pages.yml
+
diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
@@ -1,11 +1,15 @@
 name: Checks
 
-on: workflow_call
+on:
+  workflow_call:
+    secrets:
+      ALTERNATIVE_GITHUB_TOKEN:
+        required: false
 
 jobs:
 
-  version-check-job:
-    name: Version Check
+  Version-Check:
+    name: Version
     runs-on: ubuntu-latest
 
     steps:
@@ -20,9 +24,9 @@ jobs:
       - name: Check Version(s)
         run: poetry run version-check version.py
 
-  build-documentation-job:
+  Documentation:
     name: Build Documentation
-    needs: [version-check-job]
+    needs: [ Version-Check ]
     runs-on: ubuntu-latest
 
     steps:
@@ -34,11 +38,11 @@ jobs:
 
       - name: Build Documentation
         run: |
-          poetry run python -m nox -s build-docs
+          poetry run python -m nox -s docs:build
 
-  lint-job:
+  Lint:
     name: Linting (Python-${{ matrix.python-version }})
-    needs: [version-check-job]
+    needs: [ Version-Check ]
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -54,18 +58,19 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
 
-      - name: Run Linter
-        run: poetry run nox -s lint
+      - name: Run lint
+        run: poetry run nox -s lint:code
 
       - name: Upload Artifacts
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4.4.0
         with:
-          name: .lint.txt
+          name: lint-python${{ matrix.python-version }}
           path: .lint.txt
+          include-hidden-files: true
 
-  type-check-job:
+  Type-Check:
     name: Type Checking (Python-${{ matrix.python-version }})
-    needs: [version-check-job]
+    needs: [ Version-Check ]
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -81,13 +86,40 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
 
-      - name: Run Type check
-        run: poetry run nox -s type-check
+      - name: Run type-check
+        run: poetry run nox -s lint:typing
 
-  tests-job:
+  Security:
+    name: Security Checks (Python-${{ matrix.python-version }})
+    needs: [ Version-Check ]
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11"]
+
+    steps:
+       - name: SCM Checkout
+         uses: actions/checkout@v4
+       - name: Setup Python & Poetry Environment
+         uses: exasol/python-toolbox/.github/actions/[email protected]
+         with:
+           python-version: ${{ matrix.python-version }}
+       - name: Run security linter
+         run: poetry run nox -s lint:security
+       - name: Upload Artifacts
+         uses: actions/[email protected]
+         with:
+           name: security-python${{ matrix.python-version }}
+           path: .security.json
+           include-hidden-files: true
+
+  Tests:
     name: Tests (Python-${{ matrix.python-version }}, Exasol-${{ matrix.exasol-version}})
-    needs: [build-documentation-job, lint-job, type-check-job]
+    needs: [ Documentation, Lint, Type-Check, Security ]
     runs-on: ubuntu-latest
+    env:
+      GITHUB_TOKEN: ${{ secrets.ALTERNATIVE_GITHUB_TOKEN ||  secrets.GITHUB_TOKEN }}
     strategy:
       fail-fast: false
       matrix:
@@ -102,7 +134,6 @@ jobs:
         with:
           tool-cache: true
           large-packages: false
-
       - name: Free disk space by removing large directories
         run: |
           sudo rm -rf /usr/local/graalvm/
@@ -111,13 +142,14 @@ jobs:
           sudo rm -rf /usr/local/share/chromium
           sudo rm -rf /usr/local/lib/node_modules
           sudo rm -rf /opt/ghc
+
       - name: Setup Python & Poetry Environment
         uses: exasol/python-toolbox/.github/actions/[email protected]
         with:
           python-version: ${{ matrix.python-version }}
 
       - name: Calculate Test Coverage
-        run: poetry run nox -s coverage -- -- --db-version ${{ matrix.exasol-version }}
+        run: poetry run nox -s test:coverage -- -- --db-version ${{ matrix.exasol-version }}
         env:
           PYTEST_ADDOPTS: >
             -W 'ignore::DeprecationWarning:luigi:'
@@ -127,7 +159,8 @@ jobs:
             -W 'ignore::DeprecationWarning:exasol_integration_test_docker_environment:'
 
       - name: Upload Artifacts
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4.4.0
         with:
-          name: .coverage
+          name: coverage-python${{ matrix.python-version }}
           path: .coverage
+          include-hidden-files: true
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -7,16 +7,18 @@ on:
       - "gh-pages/*"
       - "main"
       - "master"
+  pull_request:
+    types: [opened, reopened]
   schedule:
     # “At 00:00 on every 7th day-of-month from 1 through 31.” (https://crontab.guru)
     - cron: "0 0 1/7 * *"
 
 jobs:
 
-  ci-job:
-    name: Checks
-    uses: ./.github/workflows/checks.yml
+  CI:
+    uses: ./.github/workflows/merge-gate.yml
+    secrets: inherit
 
-  metrics:
-    needs: [ ci-job ]
+  Metrics:
+    needs: [ CI ]
     uses: ./.github/workflows/report.yml
diff --git a/.github/workflows/gh-pages.yml b/.github/workflows/gh-pages.yml
@@ -1,6 +1,8 @@
 name: Publish Documentation
 
-on: workflow_call
+on: 
+  workflow_call:
+  workflow_dispatch:
 
 jobs:
 
@@ -10,16 +12,18 @@ jobs:
     steps:
       - name: SCM Checkout
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Setup Python & Poetry Environment
         uses: exasol/python-toolbox/.github/actions/[email protected]
 
       - name: Build Documentation
         run: |
-          poetry run python -m nox -s build-docs
+          poetry run nox -s docs:multiversion
 
       - name: Deploy
-        uses: JamesIves/github-pages-deploy-action@v4.4.1
+        uses: JamesIves/github-pages-deploy-action@v4.6.0
         with:
           branch: gh-pages
           folder: .html-documentation

diff --git a/.github/workflows/merge-gate.yml b/.github/workflows/merge-gate.yml
@@ -0,0 +1,46 @@
+name: Merge-Gate
+
+on:
+  workflow_call:
+    secrets:
+      ALTERNATIVE_GITHUB_TOKEN:
+        required: false
+
+jobs:
+
+  fast-checks:
+    name: Fast
+    uses: ./.github/workflows/checks.yml
+
+  slow-checks:
+    name: Slow
+    runs-on: ubuntu-latest
+
+    # Even though the environment "manual-approval" will be created automatically,
+    # it still needs to be configured to require interactive review.
+    # See project settings on GitHub (Settings / Environments / manual-approval).
+    environment: manual-approval
+
+    # Replace the steps below with the required actions 
+    # and/or add additional jobs if required
+    # Note: 
+    #   If you add additional jobs, make sure they are added as a requirement 
+    #   to the approve-merge job's input requirements (needs).
+    steps:
+      - name: Tests
+        run: |
+          echo "Slow tests ran successfully"
+
+
+  # This job ensures inputs have been executed successfully.
+  approve-merge:
+    name: Allow Merge 
+    runs-on: ubuntu-latest
+    # If you need additional jobs to be part of the merge gate, add them below
+    needs: [ fast-checks, slow-checks ]
+
+    # Each job requires a step, so we added this dummy step.
+    steps:
+      - name: Approve 
+        run: |
+          echo "Merge Approved"
diff --git a/.github/workflows/pr-merge.yml b/.github/workflows/pr-merge.yml
@@ -8,6 +8,18 @@ on:
 
 jobs:
 
+  # This job can be removed if certain preconditions are met. See
+  # https://exasol.github.io/python-toolbox/user_guide/workflows.html#pr-merge-workflow
+
+  ci-job:
+    name: Checks
+    uses: ./.github/workflows/checks.yml
+    secrets: inherit
+
   publish-docs:
     name: Publish Documentation
     uses: ./.github/workflows/gh-pages.yml
+
+  metrics:
+    needs: [ ci-job ]
+    uses: ./.github/workflows/report.yml
diff --git a/.github/workflows/report.yml b/.github/workflows/report.yml
@@ -9,7 +9,6 @@ on:
 jobs:
 
   report:
-    name: Generate Status Report
     runs-on: ubuntu-latest
     env:
       GITHUB_TOKEN: ${{ secrets.ALTERNATIVE_GITHUB_TOKEN ||  secrets.GITHUB_TOKEN }}
@@ -24,32 +23,32 @@ jobs:
         uses: exasol/python-toolbox/.github/actions/[email protected]
 
       - name: Download Artifacts
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4.1.8
         with:
           path: ./artifacts
 
       - name: Copy Artifacts into Root Folder
-        if: ${{ (hashFiles('./artifacts/.coverage/.coverage') != '') && (hashFiles('./artifacts/.lint.txt/.lint.txt') != '')}}
         working-directory: ./artifacts
         run: |
-          cp .coverage/.coverage ../
-          cp .lint.txt/.lint.txt ../  
+          cp coverage-python3.9/.coverage ../
+          cp lint-python3.9/.lint.txt ../
+          cp security-python3.9/.security.json ../
 
       - name: Generate Report
-        run: poetry run nox -s report -- -- --format json | tee metrics.json
+        run: poetry run nox -s project:report -- -- --format json | tee metrics.json
 
       - name: Upload Artifacts
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4.4.0
         with:
           name: metrics.json
           path: metrics.json
 
       - name: Generate GitHub Summary
-        if: ${{ (hashFiles('./artifacts/.coverage/.coverage') != '') && (hashFiles('./artifacts/.lint.txt/.lint.txt') != '')}}
         run: |
           echo -e "# Summary\n" >> $GITHUB_STEP_SUMMARY
-          poetry run nox -s report -- -- --format markdown >> $GITHUB_STEP_SUMMARY
+          poetry run nox -s project:report -- -- --format markdown >> $GITHUB_STEP_SUMMARY
           echo -e "\n\n# Coverage\n" >> $GITHUB_STEP_SUMMARY
           poetry run coverage report -- --format markdown >> $GITHUB_STEP_SUMMARY
           echo  -e "\n\n# Static Code Analysis\n" >> $GITHUB_STEP_SUMMARY
           cat .lint.txt >> $GITHUB_STEP_SUMMARY
+          poetry run tbx security pretty-print .security.json >> $GITHUB_STEP_SUMMARY