forked from etingof/pysmi
-
Notifications
You must be signed in to change notification settings - Fork 3
141 lines (136 loc) · 3.76 KB
/
release.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
name: Manual
on:
push:
tags:
- "v[0-9]+.[0-9]+.[0-9]+"
jobs:
review_secrets:
name: security-detect-secrets
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v2
with:
submodules: false
fetch-depth: "0"
- name: Trufflehog Actions Scan
uses: edplato/trufflehog-actions-scan@v0.9j-beta
with:
scanArguments: "--max_depth 30 -x .github/workflows/exclude-patterns.txt"
semgrep:
runs-on: ubuntu-latest
name: security-sast-semgrep
steps:
- uses: actions/checkout@v2
- name: Semgrep
id: semgrep
uses: returntocorp/semgrep-action@v1
with:
publishToken: ${{ secrets.SEMGREP_APP_TOKEN }}
build:
name: build
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- name: Setup python
uses: actions/setup-python@v2
with:
python-version: 3.7
- name: Run image
uses: abatilo/actions-poetry@v2.0.0
with:
poetry-version: "1.1.11"
- name: Build
run: |
poetry install
poetry build
- uses: actions/upload-artifact@v2.2.4
with:
name: dist
path: dist
- uses: actions/upload-artifact@v2.2.4
with:
name: output
path: output
run-unit-tests:
name: test-unit
strategy:
matrix:
os: [ubuntu-latest, macos-latest]
python: ["3.7", "3.8", "3.9"]
poetry-version: ["1.1.11"]
fail-fast: false
runs-on: ${{ matrix.os }}
needs:
- build
steps:
- uses: actions/checkout@v2
- name: Setup python
uses: actions/setup-python@v2
with:
python-version: ${{ matrix.python }}
- name: Run image
uses: abatilo/actions-poetry@v2.0.0
with:
poetry-version: ${{ matrix.poetry-version }}
- name: run tests
run: |
poetry install
poetry run pytest --junitxml=test-results/results.xml --cov=./ --cov-report=xml tests
- uses: actions/upload-artifact@v2.2.4
with:
name: unit tests test-results
path: test-results
- uses: codecov/codecov-action@v2
with:
token: ${{ secrets.CODECOV_TOKEN }}
flags: ${{ matrix.os }}, ${{ matrix.poetry-version }}
fail_ci_if_error: true # optional (default = false)
publish:
name: Build Release
needs:
#- pre-commit
- review_secrets
- semgrep
- build
- run-unit-tests
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
with:
submodules: false
# Very important: semantic-release won't trigger a tagged
# build if this is not set false
persist-credentials: false
- name: Setup python
uses: actions/setup-python@v2
with:
python-version: "3.7"
- name: Run image
uses: abatilo/actions-poetry@v2.0.0
with:
poetry-version: "1.1.11"
- name: Build
run: |
poetry install
poetry build
- name: Semantic Release
uses: cycjimmy/semantic-release-action@v2.6.0
with:
semantic_version: 17
extra_plugins: |
@semantic-release/exec
@semantic-release/git
@google/semantic-release-replace-plugin
env:
GITHUB_TOKEN: ${{ secrets.SEMREL_TOKEN }}
PYPI_USERNAME: ${{ secrets.PYPI_USERNAME }}
PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
update-semver:
name: Move Respository semver tags
if: startsWith(github.ref, 'refs/tags/v')
needs: publish
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- uses: haya14busa/action-update-semver@v1