Skip to content

fix(notifier): intelligently select use_tls vs start_tls based on smt… #17

fix(notifier): intelligently select use_tls vs start_tls based on smt…

fix(notifier): intelligently select use_tls vs start_tls based on smt… #17

Workflow file for this run

name: CI
on:
push:
branches: [main]
pull_request:
branches: [main]
env:
PYTHON_VERSION: "3.12"
jobs:
lint:
name: Lint (ruff)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/setup-python@v6
with:
python-version: ${{ env.PYTHON_VERSION }}
cache: pip
- run: pip install -r requirements-dev.txt
- run: ruff check .
typecheck:
name: Type check (mypy)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/setup-python@v6
with:
python-version: ${{ env.PYTHON_VERSION }}
cache: pip
- run: pip install -r requirements-dev.txt
- run: mypy app
test:
name: Test & coverage
runs-on: ubuntu-latest
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_USER: sentinel
POSTGRES_PASSWORD: sentinel
POSTGRES_DB: sentinel_test
ports:
- 5432:5432
options: >-
--health-cmd="pg_isready -U sentinel"
--health-interval=5s
--health-timeout=5s
--health-retries=5
env:
TEST_DATABASE_URL: postgresql+asyncpg://sentinel:sentinel@localhost:5432/sentinel_test
SECRET_KEY: ci-test-secret-key-not-for-production-use-0000
ENVIRONMENT: testing
CELERY_TASK_ALWAYS_EAGER: "true"
RATE_LIMIT_ENABLED: "false"
BACKEND_CORS_ORIGINS: '["http://localhost:3000"]'
steps:
- uses: actions/checkout@v6
- uses: actions/setup-python@v6
with:
python-version: ${{ env.PYTHON_VERSION }}
cache: pip
- run: pip install -r requirements-dev.txt
- run: pytest -v --junitxml=test-results/junit.xml
- name: Upload test results
if: always()
uses: actions/upload-artifact@v7
with:
name: test-results
path: test-results/junit.xml
- name: Upload coverage report
if: always()
uses: actions/upload-artifact@v7
with:
name: coverage-report
path: htmlcov/
docker:
name: Docker build validation
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- name: Build image
run: docker build -t sentinel:ci . | tee docker-build.log
- name: Validate docker-compose config
run: |
cp .env.example .env
docker compose config
- name: Upload build log
if: always()
uses: actions/upload-artifact@v7
with:
name: docker-build-log
path: docker-build.log
security:
name: Security checks
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/setup-python@v6
with:
python-version: ${{ env.PYTHON_VERSION }}
cache: pip
- run: pip install -r requirements-dev.txt
- name: Dependency vulnerability scan (pip-audit)
run: pip-audit -r requirements.txt -r requirements-dev.txt
- name: Secret detection (detect-secrets)
run: |
cp .secrets.baseline /tmp/before.json
detect-secrets scan --baseline .secrets.baseline
jq 'del(.generated_at)' /tmp/before.json > /tmp/before-clean.json
jq 'del(.generated_at)' .secrets.baseline > /tmp/after-clean.json
diff /tmp/before-clean.json /tmp/after-clean.json