feat: can now show the pipeline tree via cli or api #13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # GitHub Actions CI/CD for Python Template | |
| # This workflow installs dependencies, runs linting, type checks, security checks, tests, and deploys. | |
| name: CI/CD | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| branches: [ main] | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }} | |
| jobs: | |
| compute-env: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| push_latest: ${{ steps.settag.outputs.push_latest }} | |
| tags: ${{ steps.meta.outputs.tags }} | |
| steps: | |
| - name: downcase REPO | |
| run: | | |
| echo "IMAGE_NAME=${GITHUB_REPOSITORY,,}" >>${GITHUB_ENV} | |
| - name: Compute docker tag | |
| id: settag | |
| run: | | |
| # If this is a push to the main branch -> tag as 'dev' | |
| if [[ "$GITHUB_EVENT_NAME" == "push" && "$GITHUB_REF" == "refs/heads/main" ]]; then | |
| DOCKER_TAG="dev" | |
| PUSH_LATEST="false" | |
| # If this is a push of a tag (refs/tags/v*) -> use the tag name and also push 'latest' | |
| elif [[ "$GITHUB_REF" == refs/tags/* ]]; then | |
| DOCKER_TAG="${GITHUB_REF#refs/tags/}" | |
| PUSH_LATEST="true" | |
| else | |
| echo "Unable to determine docker tag for event: $GITHUB_EVENT_NAME ref: $GITHUB_REF" | |
| exit 1 | |
| fi | |
| echo "docker_tag=$DOCKER_TAG" >> $GITHUB_OUTPUT | |
| echo "push_latest=$PUSH_LATEST" >> $GITHUB_OUTPUT | |
| - name: Compose docker build tags | |
| id: meta | |
| run: | | |
| if [ "${{ steps.settag.outputs.push_latest }}" = "true" ]; then | |
| echo "tags=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.settag.outputs.docker_tag }},${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest" >> $GITHUB_OUTPUT | |
| else | |
| echo "tags=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.settag.outputs.docker_tag }}" >> $GITHUB_OUTPUT | |
| fi | |
| echo "Computed tags: ${{ steps.meta.outputs.tags }}" | |
| tests: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v7 | |
| - name: Export and Install project dependencies | |
| run: | | |
| uv sync --frozen | |
| - name: Lint with ruff | |
| run: uv run --with ruff ruff check src tests | |
| continue-on-error: true | |
| - name: Type check with ty | |
| run: uv run --with ty ty check src | |
| continue-on-error: true | |
| - name: Security check with bandit | |
| run: uv run --with bandit bandit -r . | |
| continue-on-error: true | |
| - name: Run TruffleHog | |
| uses: trufflesecurity/trufflehog@main | |
| with: | |
| extra_args: --results=verified,unknown | |
| - name: Run tests | |
| run: | | |
| uv run --group testing pytest -q tests | |
| hadolint: | |
| runs-on: ubuntu-latest | |
| needs: [tests] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Run hadolint on Dockerfile | |
| uses: hadolint/[email protected] | |
| publish: | |
| needs: [tests, hadolint, compute-env] | |
| permissions: | |
| contents: read | |
| packages: write | |
| attestations: write | |
| id-token: write | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Log in to the Container registry | |
| uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build and push Docker image | |
| id: push | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| push: true | |
| file: Dockerfile | |
| tags: ${{ needs.compute-env.outputs.tags }} |