113 lines
4.0 KiB
YAML
113 lines
4.0 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [master]
|
|
pull_request:
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
test:
|
|
name: Lint, PostgreSQL tests, and package
|
|
runs-on: python-ci
|
|
services:
|
|
postgres:
|
|
image: postgres:17
|
|
env:
|
|
POSTGRES_USER: postgres
|
|
POSTGRES_PASSWORD: ci-test-only
|
|
POSTGRES_DB: car_tracker_test
|
|
options: >-
|
|
--health-cmd "pg_isready -U postgres -d car_tracker_test"
|
|
--health-interval 5s
|
|
--health-timeout 5s
|
|
--health-retries 12
|
|
env:
|
|
# Disposable service only. Never replace this with the homelab database URL.
|
|
TEST_DATABASE_URL: postgresql://postgres:ci-test-only@postgres:5432/car_tracker_test
|
|
UV_NO_PROGRESS: "1"
|
|
steps:
|
|
- name: Check out repository
|
|
uses: https://github.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Install uv
|
|
uses: https://github.com/astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
|
|
with:
|
|
version: "0.9.3"
|
|
python-version: "3.13"
|
|
enable-cache: false
|
|
add-problem-matchers: false
|
|
# Gitea's job token must not be sent to the GitHub release API.
|
|
github-token: ""
|
|
|
|
- name: Install locked dependencies
|
|
run: uv sync --locked --dev
|
|
|
|
- name: Lint
|
|
run: uv run --locked ruff check src tests ops/gitops ops/ssh
|
|
|
|
- name: Run offline and PostgreSQL integration tests
|
|
run: timeout 10m uv run --locked python -m unittest discover -s tests -v
|
|
|
|
- name: Build package
|
|
run: uv build --no-sources
|
|
|
|
- name: Check installed wheel and packaged migrations
|
|
run: |
|
|
uv venv /tmp/car-tracker-wheel
|
|
uv pip install --python /tmp/car-tracker-wheel/bin/python --no-deps dist/*.whl
|
|
/tmp/car-tracker-wheel/bin/python -c 'from importlib.resources import files; assert files("car_tracker").joinpath("migrations", "001_silver.sql").is_file(), "SQL migration missing from wheel"'
|
|
|
|
publish:
|
|
name: Build and publish tested image
|
|
needs: test
|
|
# PRs and the gitops state branch must never publish images.
|
|
if: github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
|
|
runs-on: python-ci
|
|
env:
|
|
REGISTRY: gitea.vandeplanque.com
|
|
IMAGE_REPOSITORY: tonio/car-tracker
|
|
IMAGE_SHA: ${{ github.sha }}
|
|
DOCKER_CONFIG: /tmp/car-tracker-docker-auth
|
|
steps:
|
|
- name: Check out tested revision
|
|
uses: https://github.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
|
|
with:
|
|
persist-credentials: false
|
|
ref: ${{ github.sha }}
|
|
|
|
- name: Install Docker client
|
|
run: sh ops/ci/install-docker-cli.sh
|
|
|
|
- name: Authenticate to Gitea registry
|
|
env:
|
|
REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
|
|
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
set -eu
|
|
test -n "$REGISTRY_USER" && test -n "$REGISTRY_TOKEN"
|
|
umask 077
|
|
mkdir -p "$DOCKER_CONFIG"
|
|
printf '%s' "$REGISTRY_TOKEN" | docker login "$REGISTRY" --username "$REGISTRY_USER" --password-stdin
|
|
|
|
- name: Build and publish SHA-tagged image
|
|
run: |
|
|
set -eu
|
|
image="$REGISTRY/$IMAGE_REPOSITORY:$IMAGE_SHA"
|
|
# Do not overwrite a previously published SHA tag on a workflow rerun.
|
|
# Digest pinning, not this mutable registry tag, identifies a run image.
|
|
if docker manifest inspect "$image" >/dev/null 2>&1; then
|
|
echo "Image already published: $image"
|
|
exit 0
|
|
fi
|
|
timeout 35m docker build --label "org.opencontainers.image.revision=$IMAGE_SHA" -t "$image" .
|
|
docker run --rm --network none "$image" car-tracker-db --help
|
|
timeout 5m docker push "$image"
|
|
echo "Published: $image"
|
|
|
|
- name: Remove job registry credentials
|
|
if: always()
|
|
run: rm -rf /tmp/car-tracker-docker-auth
|