Skip to content

Commit 7d9df9c

Browse files
behnazh-wbehnazh-w
authored
ci: prepare repo for development (#1)
Signed-off-by: behnazh-w <[email protected]>
1 parent 8472819 commit 7d9df9c

File tree

128 files changed

+3153
-943
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

128 files changed

+3153
-943
lines changed

‎.flake8

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# Copyright (c) 2022 - 2022, Oracle and/or its affiliates. All rights reserved.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/.
3+
4+
# Unfortunately, flake8 does not support pyproject.toml configuration.
5+
# https://github.com/PyCQA/flake8/issues/234
6+
[flake8]
7+
# Disabling the following:
8+
# E203: whitespace before ':'. Conflict with black.
9+
# E266: too many leading '#' for block comment
10+
# W503: line break before binary operator
11+
# D105: Missing docstring in magic method
12+
# D104: Missing docstring in public package
13+
# D404: First word of the docstring should not be `This`
14+
# PT009: use a regular assert instead of unittest-style
15+
ignore = E203,E266,W503,D105,D404,PT009
16+
# Disabling the following for tests:
17+
# D400: First line should end with a period
18+
# D200: One-line docstring should fit on one line with quotes
19+
# D102: Missing docstring in public method
20+
# D104: Missing docstring in public package
21+
# D107: Missing docstring in __init__
22+
per-file-ignores =
23+
__init__.py:D104
24+
tests/*:D400,D200,D102,D104,D107
25+
max-line-length = 120
26+
show-source = true
27+
28+
# Enable Bugbear's extended opinionated checks.
29+
# https://github.com/PyCQA/flake8-bugbear#how-to-enable-opinionated-warnings
30+
extend-select = B9
31+
32+
# Ensure that flake8 warnings are silenced correctly.
33+
# https://github.com/plinss/flake8-noqa#options
34+
noqa-require-code = true
35+
36+
docstring-convention = numpy

‎.gitattributes

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# Copyright (c) 2022 - 2022, Oracle and/or its affiliates. All rights reserved.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/.
3+
4+
# Set default behavior to automatically normalize line endings.
5+
* text=auto
6+
7+
# Force batch scripts to always use CRLF line endings so that if a repo is accessed
8+
# in Windows via a file share from Linux, the scripts will work.
9+
*.{cmd,[cC][mM][dD]} text eol=crlf
10+
*.{bat,[bB][aA][tT]} text eol=crlf
11+
*.{ps1,[pP][sS]1} text eol=crlf
12+
13+
# Force bash scripts to always use LF line endings so that if a repo is accessed
14+
# in Unix via a file share from Windows, the scripts will work.
15+
*.sh text eol=lf

‎.github/codeql/codeql-config.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# Copyright (c) 2022 - 2022, Oracle and/or its affiliates. All rights reserved.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/.
3+
4+
name: CodeQL configuration
5+
paths:
6+
- src/macaron

‎.github/dependabot.yaml

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# Copyright (c) 2022 - 2022, Oracle and/or its affiliates. All rights reserved.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/.
3+
4+
# This configuration file enables Dependabot version updates.
5+
# https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot-version-updates
6+
# https://github.com/dependabot/feedback/issues/551
7+
8+
version: 2
9+
updates:
10+
- package-ecosystem: pip
11+
directory: /
12+
schedule:
13+
interval: weekly
14+
commit-message:
15+
prefix: chore
16+
prefix-development: chore
17+
include: scope
18+
open-pull-requests-limit: 13
19+
target-branch: staging
20+
# Add additional reviewers for PRs opened by Dependabot. For more information, see:
21+
# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#reviewers
22+
# reviewers:
23+
# -
24+
25+
- package-ecosystem: github-actions
26+
directory: /
27+
schedule:
28+
interval: weekly
29+
commit-message:
30+
prefix: chore
31+
prefix-development: chore
32+
include: scope
33+
open-pull-requests-limit: 13
34+
target-branch: staging
35+
# Add additional reviewers for PRs opened by Dependabot. For more information, see:
36+
# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#reviewers
37+
# reviewers:
38+
# -

‎.github/workflows/_build.yaml

+134
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
# Copyright (c) 2022 - 2022, Oracle and/or its affiliates. All rights reserved.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/.
3+
4+
# This is a trusted builder implemented as a reusable workflow that can be called by other
5+
# Actions workflows. It checks, tests, and builds the artifacts including SBOM and documentations,
6+
# and computes hash digests as output to be used by a SLSA provenance generator. The artifacts are
7+
# always uploaded for every job to be used for debugging purposes, but they will be removed within
8+
# the specified retention days.
9+
#
10+
# Even though we run the build in a matrix to check against different platforms, due to a known
11+
# limitation of reusable workflows that do not support setting strategy property from the caller
12+
# workflow, we only generate artifacts for ubuntu-latest and Python 3.11, which can be used to
13+
# create a release. For details see:
14+
#
15+
# https://docs.github.com/en/actions/using-workflows/reusing-workflows#limitations
16+
#
17+
# Note: if the build workflow needs to access secrets, they need to be passed by the caller using
18+
# `secrets: inherit`. See also
19+
#
20+
# https://docs.github.com/en/actions/using-workflows/reusing-workflows
21+
# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
22+
#
23+
# for the security recommendations.
24+
25+
name: Build the package
26+
on:
27+
workflow_call:
28+
outputs:
29+
artifacts-sha256:
30+
description: The hash of the artifacts
31+
value: ${{ jobs.build.outputs.artifacts-sha256 }}
32+
permissions:
33+
contents: read
34+
env:
35+
ARTIFACT_OS: ubuntu-latest # The default OS for release.
36+
ARTIFACT_PYTHON: '3.11' # The default Python version for release.
37+
38+
jobs:
39+
build:
40+
outputs:
41+
artifacts-sha256: ${{ steps.compute-hash.outputs.artifacts-sha256 }}
42+
name: Build Python ${{ matrix.python }} on ${{ matrix.os }}
43+
runs-on: ${{ matrix.os }}
44+
strategy:
45+
fail-fast: false
46+
matrix:
47+
# It is recommended to pin a Runner version specifically:
48+
# https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners
49+
os: [ubuntu-latest]
50+
python: ['3.11']
51+
steps:
52+
53+
- name: Check out repository
54+
uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
55+
with:
56+
fetch-depth: 0
57+
58+
- name: Set up Python
59+
uses: actions/setup-python@13ae5bb136fac2878aff31522b9efb785519f984 # v4.3.0
60+
with:
61+
python-version: ${{ matrix.python }}
62+
63+
# Using the Makefile assumes an activated virtual environment, which doesn't exist
64+
# when running in an Action environment (https://github.com/actions/setup-python/issues/359).
65+
# Instead we create an empty .venv folder so that the Makefile continues to function
66+
# while Python operates within the runner's global environment. It is safe to ignore
67+
# warnings from the Makefile about the missing virtual environment.
68+
- name: Create empty virtual environment for Actions
69+
run: mkdir .venv
70+
- name: Install dependencies
71+
run: make setup
72+
73+
# Audit all currently installed packages for security vulnerabilities.
74+
- name: Audit installed packages
75+
run: make audit
76+
77+
# Build the sdist and wheel distribution of the package and docs as a zip file.
78+
# We don't need to check and test the package separately because `make dist` runs
79+
# those targets first and only builds the package if they succeed.
80+
- name: Build the package
81+
run: make dist
82+
env:
83+
GITHUB_TOKEN: ${{ github.token }}
84+
85+
# Generate the requirements.txt that contains the hash digests of the dependencies and
86+
# generate the SBOM using CyclonDX SBOM generator.
87+
- name: Generate requirements.txt and SBOM
88+
if: matrix.os == env.ARTIFACT_OS && matrix.python == env.ARTIFACT_PYTHON
89+
run: make requirements sbom
90+
91+
# Remove the old requirements.txt file (which includes _all_ packages) and generate a
92+
# new one for the package and its actual and required dependencies only.
93+
- name: Prune packages and generate required requirements.txt
94+
if: matrix.os == env.ARTIFACT_OS && matrix.python == env.ARTIFACT_PYTHON
95+
run: |
96+
rm requirements.txt
97+
make prune requirements
98+
99+
# Find the paths to the artifact files that will be included in the release, compute
100+
# the SHA digest for all the release files and encode them using Base64, and export it
101+
# from this job.
102+
- name: Compute package hash
103+
if: matrix.os == env.ARTIFACT_OS && matrix.python == env.ARTIFACT_PYTHON
104+
id: compute-hash
105+
shell: bash
106+
run: |
107+
set -euo pipefail
108+
TARBALL_PATH=$(find dist/ -type f -name "*.tar.gz")
109+
WHEEL_PATH=$(find dist/ -type f -name "*.whl")
110+
GO_ACTION_PARSER=$(find bin/ -type f -name "actionparser")
111+
GO_BASH_PARSER=$(find bin/ -type f -name "bashparser")
112+
REQUIREMENTS_PATH=$(find dist/ -type f -name "*-requirements.txt")
113+
SBOM_PATH=$(find dist/ -type f -name "*-sbom.json")
114+
SBOM_GO_PATH=$(find dist/ -type f -name "*-sbom-go.json")
115+
HTML_DOCS_PATH=$(find dist/ -type f -name "*-docs-html.zip")
116+
BUILD_EPOCH_PATH=$(find dist/ -type f -name "*-build-epoch.txt")
117+
DIGEST=$(sha256sum "$TARBALL_PATH" "$WHEEL_PATH" "$REQUIREMENTS_PATH" "$SBOM_PATH" \
118+
"$SBOM_GO_PATH" "$GO_ACTION_PARSER" "$GO_BASH_PARSER" "$HTML_DOCS_PATH" "$BUILD_EPOCH_PATH" | base64 -w0)
119+
echo "Digest of artifacts is $DIGEST."
120+
echo "artifacts-sha256=$DIGEST" >> "$GITHUB_OUTPUT"
121+
122+
# For now only generate artifacts for the specified OS and Python version in env variables.
123+
# Currently reusable workflows do not support setting strategy property from the caller workflow.
124+
- name: Upload the package artifact for debugging and release
125+
if: matrix.os == env.ARTIFACT_OS && matrix.python == env.ARTIFACT_PYTHON
126+
uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
127+
with:
128+
name: artifact-${{ matrix.os }}-python-${{ matrix.python }}
129+
path: |
130+
dist
131+
bin/actionparser
132+
bin/bashparser
133+
if-no-files-found: error
134+
retention-days: 7

‎.github/workflows/_release-notifications.yaml

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# Copyright (c) 2022 - 2022, Oracle and/or its affiliates. All rights reserved.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/.
3+
4+
# Send a Slack release notification. Instructions to set up Slack to receive
5+
# messages can be found here: https://github.com/slackapi/slack-github-action#setup-2
6+
7+
name: Release Notifications
8+
on:
9+
workflow_call:
10+
inputs:
11+
repo_name:
12+
required: true
13+
type: string
14+
release_tag:
15+
required: true
16+
type: string
17+
release_url:
18+
required: true
19+
type: string
20+
secrets:
21+
SLACK_WEBHOOK_URL:
22+
required: true
23+
24+
# Grant no permissions to this workflow.
25+
permissions: {}
26+
27+
jobs:
28+
slack:
29+
name: Slack release notification
30+
runs-on: ubuntu-latest
31+
steps:
32+
33+
- name: Notify via Slack
34+
run: |
35+
curl --header "Content-Type: application/json; charset=UTF-8" --request POST --data "$SLACK_WEBHOOK_MSG" "$SLACK_WEBHOOK_URL"
36+
env:
37+
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
38+
SLACK_WEBHOOK_MSG: |
39+
{
40+
"text": "${{ inputs.repo_name }} published a new release ${{ inputs.release_tag }}",
41+
"blocks": [
42+
{
43+
"type": "section",
44+
"text": {
45+
"type": "mrkdwn",
46+
"text": "*${{ inputs.repo_name }}* published a new release <${{ inputs.release_url }}|${{ inputs.release_tag }}>"
47+
}
48+
}
49+
]
50+
}

‎.github/workflows/codeql-analysis.yaml

+71
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
# Copyright (c) 2022 - 2022, Oracle and/or its affiliates. All rights reserved.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/.
3+
4+
# Run CodeQL over the package. For more configuration options see codeql/codeql-config.yaml
5+
# and: https://github.com/github/codeql-action
6+
7+
name: CodeQL
8+
on:
9+
push:
10+
branches:
11+
- main
12+
- staging
13+
pull_request:
14+
branches:
15+
- main
16+
- staging
17+
# Avoid unnecessary scans of pull requests.
18+
paths:
19+
- '**/*.py'
20+
schedule:
21+
- cron: 20 15 * * 3
22+
permissions:
23+
contents: read
24+
25+
jobs:
26+
analyze:
27+
name: Analyze
28+
runs-on: ubuntu-latest
29+
permissions:
30+
actions: read
31+
contents: read
32+
security-events: write
33+
strategy:
34+
fail-fast: false
35+
matrix:
36+
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
37+
# Learn more about CodeQL language support at https://git.io/codeql-language-support
38+
language: [python]
39+
python: ['3.11']
40+
steps:
41+
42+
- name: Checkout repository
43+
uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
44+
45+
- name: Set up Python ${{ matrix.python }}
46+
uses: actions/setup-python@13ae5bb136fac2878aff31522b9efb785519f984 # v4.3.0
47+
with:
48+
python-version: ${{ matrix.python }}
49+
50+
# For more details see the comment in _build.yaml.
51+
- name: Create empty virtual environment for Actions
52+
run: mkdir .venv
53+
- name: Install dependencies
54+
run: make setup
55+
56+
# Initializes the CodeQL tools for scanning.
57+
- name: Initialize CodeQL
58+
uses: github/codeql-action/init@c3b6fce4ee2ca25bc1066aa3bf73962fda0e8898 # v2.1.31
59+
with:
60+
languages: ${{ matrix.language }}
61+
config-file: .github/codeql/codeql-config.yaml
62+
# Override the default behavior so that the action doesn't attempt
63+
# to auto-install Python dependencies
64+
setup-python-dependencies: false
65+
# If you wish to specify custom queries, you can do so here or in a config file.
66+
# By default, queries listed here will override any specified in a config file.
67+
# Prefix the list here with "+" to use these queries and those in the config file.
68+
# queries: ./path/to/local/query, your-org/your-repo/queries@main
69+
70+
- name: Perform CodeQL Analysis
71+
uses: github/codeql-action/analyze@c3b6fce4ee2ca25bc1066aa3bf73962fda0e8898 # v2.1.31

‎.github/workflows/dependabot-automerge.yaml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Copyright (c) 2022 - 2022, Oracle and/or its affiliates. All rights reserved.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/.
3+
4+
# Automatically merge Dependabot PRs upon approval by leaving
5+
# a comment on Dependabot's pull-request.
6+
7+
name: Automerge Dependabot PR
8+
on:
9+
pull_request_review:
10+
types: [submitted]
11+
12+
permissions:
13+
pull-requests: write
14+
15+
jobs:
16+
comment:
17+
if: ${{ github.event.review.state == 'approved' && github.event.pull_request.user.login == 'dependabot[bot]' }}
18+
runs-on: ubuntu-latest
19+
steps:
20+
- name: Merge Dependabot PR
21+
run: gh pr comment --body "@dependabot squash and merge" "$PR_URL"
22+
env:
23+
PR_URL: ${{ github.event.pull_request.html_url }}
24+
GITHUB_TOKEN: ${{ secrets.DEPENDABOT_AUTOMERGE_TOKEN }}

0 commit comments

Comments
 (0)