📝 [open-zaak/open-zaak#1649] Document envvars #616

Workflow file for this run

	name: ci

	# Run this workflow every time a new commit pushed to your repository
	on:
	push:
	branches:
	- master
	tags:
	- '*'
	pull_request:
	workflow_dispatch:

	env:
	IMAGE_NAME: maykinmedia/open-klant
	DJANGO_SETTINGS_MODULE: openklant.conf.ci
	DB_PASSWORD: ''
	DB_USER: postgres
	# ALLOWED_HOSTS: openklant.nl

	jobs:
	# determine changed files to decide if certain jobs can be skipped or not
	changed-files:
	runs-on: ubuntu-latest # windows-latest \| macos-latest
	name: Determine changed files
	steps:

	- uses: actions/checkout@v2
	with:
	fetch-depth: 2

	- name: Get changed PY files
	id: changed-py-files
	uses: tj-actions/[email protected]
	with:
	files: \|
	^src/.+\.py
	- name: Get changed JS files
	id: changed-js-files
	uses: tj-actions/[email protected]
	with:
	files: \|
	^src/.+\.js
	- name: Get changed requirements files
	id: changed-requirements
	uses: tj-actions/[email protected]
	with:
	files: ^requirements/.+\.txt$

	outputs:
	changed-py-files: ${{ steps.changed-py-files.outputs.any_changed }}
	changed-js-files: ${{ steps.changed-js-files.outputs.any_changed }}
	changed-requirements: ${{ steps.changed-requirements.outputs.any_changed }}

	tests:
	name: Tests (PG ${{ matrix.postgres }})
	runs-on: ubuntu-latest
	needs:
	- changed-files

	# only run tests if source files have changed (e.g. skip for PRs that only update docs)
	if: ${{ needs.changed-files.outputs.changed-py-files == 'true'\|\| needs.changed-files.outputs.changed-requirements == 'true'\|\| github.event_name == 'push' \|\| github.event_name == 'workflow_dispatch' }}

	strategy:
	matrix:
	postgres: ['13', '14', '15', '16']

	services:
	postgres:
	image: postgres:${{ matrix.postgres }}
	env:
	POSTGRES_HOST_AUTH_METHOD: trust
	ports:
	- 5432:5432
	# needed because the postgres container does not provide a healthcheck
	options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5

	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v5
	with:
	python-version: '3.11'
	- uses: actions/setup-node@v4
	with:
	node-version: '18'

	- name: Install dependencies
	run: pip install -r requirements/dev.txt codecov
	- name: Build frontend
	run: \|
	npm ci
	npm run build
	- name: Run tests
	run: \|
	python src/manage.py collectstatic --noinput --link
	coverage run src/manage.py test src
	env:
	DJANGO_SETTINGS_MODULE: openklant.conf.ci
	SECRET_KEY: dummy
	DB_USER: postgres
	DB_PASSWORD: ''

	- name: Publish coverage report
	uses: codecov/codecov-action@v3

	check-envvar-docs:
	runs-on: ubuntu-latest
	name: Documentation build

	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v5
	with:
	python-version: '3.11'
	cache: 'pip'
	cache-dependency-path: 'requirements/*.txt'
	- name: Install dependencies
	run: pip install -r requirements/ci.txt pytest
	- name: Generate environment variable documentation using OAf and check if it was updated
	run: \|
	bin/generate_envvar_docs.sh
	changes=$(git diff docs/installation/config.rst)
	if [ ! -z "$changes" ]; then
	echo $changes
	echo "Please update the environment documentation by running \`bin/generate_envvar_docs.sh\`"
	exit 1
	fi
	env:
	DJANGO_SETTINGS_MODULE: openklant.conf.ci

	docker:
	needs: tests
	name: Build Docker image
	runs-on: ubuntu-latest

	steps:
	- uses: actions/checkout@v4
	- name: Determine tag/commit hash
	id: vars
	run: \|
	# Strip git ref prefix from version
	VERSION=$(echo "${{ github.ref }}" \| sed -e 's,./$.$,\1,')
	# Strip "v" prefix from tag name (if present at all)
	[[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION \| sed -e 's/^v//')
	# Use Docker `latest` tag convention
	[ "$VERSION" == "master" ] && VERSION=latest
	echo "tag=${VERSION}" >> $GITHUB_OUTPUT
	echo "git_hash=${GITHUB_SHA}" >> $GITHUB_OUTPUT
	- name: Build the Docker image
	run: \|
	docker build \
	--tag $IMAGE_NAME:${{ steps.vars.outputs.tag }} \
	--build-arg COMMIT_HASH=${{ steps.vars.outputs.git_hash }} \
	--build-arg RELEASE=${{ steps.vars.outputs.tag }} \
	.
	- run: docker image save -o image.tar $IMAGE_NAME:${{ steps.vars.outputs.tag }}
	- name: Store image artifact
	uses: actions/upload-artifact@v3
	with:
	name: docker-image
	path: image.tar
	retention-days: 1

	image_scan:
	runs-on: ubuntu-latest
	name: Scan docker image
	needs:
	- docker

	steps:
	- name: Download built image
	uses: actions/download-artifact@v3
	with:
	name: docker-image
	- name: Scan image with Trivy
	uses: aquasecurity/trivy-action@master
	with:
	input: /github/workspace/image.tar # from download-artifact
	format: 'sarif'
	output: 'trivy-results-docker.sarif'
	ignore-unfixed: true
	- name: Upload results to GH Security tab
	uses: github/codeql-action/upload-sarif@v3
	with:
	sarif_file: 'trivy-results-docker.sarif'

	publish:
	needs:
	- tests
	- docker

	name: Push Docker image
	runs-on: ubuntu-latest
	if: github.event_name == 'push' # exclude PRs

	steps:
	- uses: actions/checkout@v4
	- name: Download built image
	uses: actions/download-artifact@v3
	with:
	name: docker-image

	- name: Determine tag/commit hash
	id: vars
	run: \|
	# Strip git ref prefix from version
	VERSION=$(echo "${{ github.ref }}" \| sed -e 's,./$.$,\1,')

	# Strip "v" prefix from tag name (if present at all)
	[[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION \| sed -e 's/^v//')

	# Use Docker `latest` tag convention
	[ "$VERSION" == "master" ] && VERSION=latest

	echo "tag=${VERSION}" >> $GITHUB_OUTPUT

	- name: Load image
	run: \|
	docker image load -i image.tar

	- name: Log into registry
	run: echo "${{ secrets.DOCKER_TOKEN }}" \| docker login -u ${{ secrets.DOCKER_USERNAME }} --password-stdin

	- name: Push the Docker image
	run: docker push $IMAGE_NAME:${{ steps.vars.outputs.tag }}

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

📝 [open-zaak/open-zaak#1649] Document envvars #616

Workflow file

📝 [open-zaak/open-zaak#1649] Document envvars #616

Jobs

Run details

Workflow file for this run