python-app.yml

name: Python Container CI Pipeline

on:
  workflow_call:
    inputs:
      PYTHON_VERSION:
        required: true
        type: string
        default: "3.10"
      DEPENDENCY_MANAGER:
        required: false
        type: string
        default: "poetry" # or poetry, pipenv
      ENABLE_SONAR:
        required: false
        type: boolean
        default: false
      ENABLE_CODE_CLIMATE:
        required: false
        type: boolean
        default: false
      ENABLE_SLACK:
        required: false
        type: boolean
        default: false
      ENFORCE_PYLINT:
        required: true
        type: boolean
        default: true
      ENFORCE_BLACK:
        required: true
        type: boolean
        default: true
      ENFORCE_FLAKE8:
        required: false
        type: boolean
        default: true
      ENFORCE_DIVE:
        required: false
        type: boolean
        default: true
      ENFORCE_BANDIT:
        required: false
        type: boolean
        default: true
      PYLINT_CONFIG:
        required: false
        type: string
        default: ""
      # Will by default scan `.` if you want to configure it otherwise use `targets` stanza in config file
      # Important: Make sure to exclude `./venv` from scan paths!
      BANDIT_CONFIG:
        required: false
        type: string
        default: ""
      DIVE_CONFIG:
        required: false
        type: string
        default: ""

      # -----------------------
      CONTAINER_REGISTRY:
        required: false
        type: string
        default: "ghcr.io" # 'docker.io'
      CONTAINER_REPOSITORY:
        required: false
        type: string
        default: "" # in case of Docker Hub: username/image-name
    secrets:
      CONTAINER_REGISTRY_USERNAME:
        description: "Username for container registry"
        required: false
      CONTAINER_REGISTRY_PASSWORD:
        description: "Password for container registry"
        required: false
      SONAR_TOKEN:
        description: "SonarCloud project token"
        required: false
      CC_TEST_REPORTER_ID:
        description: "CodeClimate Test Reported ID"
        required: false
      SLACK_WEBHOOK:
        description: "Slack webhook URL"
        required: false

jobs:
  python-ci:
    runs-on: ubuntu-latest

    permissions:
      contents: read
      packages: write # Push
      id-token: write # Cosign - signing the images with GitHub OIDC Token
      security-events: write # Trivy - write vulnerability report

    steps:
      - uses: actions/checkout@v1

      - uses: actions/setup-python@v1
        id: setup-python
        with:
          python-version: ${{ inputs.PYTHON_VERSION }}

      - name: Get cache metadata
        id: cache-meta
        run: |
          CACHE_KEY=""
          CACHE_PATH=""

          if [ ${{ inputs.DEPENDENCY_MANAGER }} = 'pip' ]; then
            CACHE_KEY="venv-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('**/requirements.txt') }}"
            CACHE_PATH=$(pip cache dir)
          elif [ ${{ inputs.DEPENDENCY_MANAGER }} = 'poetry' ]; then
            CACHE_KEY="venv-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('**/poetry.lock') }}"
            CACHE_PATH="./venv"
          elif [ ${{ inputs.DEPENDENCY_MANAGER }} = 'pipenv' ]; then
            CACHE_KEY="venv-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('**/Pipfile.lock') }}"
            CACHE_PATH="./venv"
          fi
          echo "::set-output name=cache-key::$CACHE_KEY"
          echo "::set-output name=cache-path::$CACHE_PATH"

      - name: Install Poetry
        uses: snok/install-poetry@v1
        if: ${{ inputs.DEPENDENCY_MANAGER == 'poetry' }}
        with:
          virtualenvs-create: false
          virtualenvs-in-project: true
          virtualenvs-path: ${{ steps.cache-meta.outputs.cache-path }}

      - name: Load cached venv
        id: cache
        uses: actions/cache@v2
        with:
          path: ${{ steps.cache-meta.outputs.cache-path }}
          key: ${{ steps.cache-meta.outputs.cache-key }}

      - name: Install cosign
        uses: sigstore/cosign-installer@main

      - name: Install Dependencies
        run: |
          python -m pip install --upgrade pip
          python -m venv venv
          source venv/bin/activate
          pip install pylint flake8 bandit pytest pytest-cov
          if [ ${{ inputs.DEPENDENCY_MANAGER }} = 'pip' ]; then
            pip install -r requirements.txt;
          elif [ ${{ inputs.DEPENDENCY_MANAGER }} = 'poetry' ]; then
            poetry install --no-root
          elif [ ${{ inputs.DEPENDENCY_MANAGER }} = 'pipenv' ]; then
            pip install pipenv
            pipenv install
          fi

      - name: Run Tests
        # Will find config automatically in `pytest.ini`, `pyproject.toml`, `tox.ini` or `setup.cfg` - https://docs.pytest.org/en/6.2.x/customize.html#configuration-file-formats
        run: |
          source venv/bin/activate
          pytest

      - name: Verify code style (Black)
        uses: psf/black@stable
        with:
          options: "--verbose ${{ inputs.ENFORCE_BLACK && '--check' || '' }}"

      - name: Enforce code style (Flake8)
        # Will find config automatically in `setup.cfg`, `tox.ini`, or `.flake8` - https://flake8.pycqa.org/en/latest/user/configuration.html#configuration-locations
        run: |
          source venv/bin/activate
          flake8 ${{ inputs.ENFORCE_FLAKE8 && '' || '--exit-zero' }}

      - name: Lint code
        # Will find config automatically in `pylintrc`, `.pylintrc`, `pyproject.toml`, NOT `setup.cfg` - https://pylint.pycqa.org/en/latest/user_guide/run.html#command-line-options
        run: |
          source venv/bin/activate
          PYLINT_CONDITIONAL_ARGS=()
          if [ -n "${{ inputs.PYLINT_CONFIG }}" ]; then
            PYLINT_CONDITIONAL_ARGS+=( --rcfile=${{ inputs.PYLINT_CONFIG }} )
          fi

          pylint **/*.py  ${{ inputs.ENFORCE_PYLINT && '' || '--exit-zero' }} "${PYLINT_CONDITIONAL_ARGS[@]}"

      - name: Code security check
        # Will find config automatically in `.bandit`, others have to specified with --ini - see https://github.com/PyCQA/bandit/issues/396#issuecomment-475152672
        run: |
          source venv/bin/activate
          BANDIT_CONDITIONAL_ARGS=()
          if [ -n "${{ inputs.BANDIT_CONFIG }}" ]; then
            BANDIT_CONDITIONAL_ARGS+=( --exclude ./venv --ini ${{ inputs.BANDIT_CONFIG }} )
          else
            BANDIT_CONDITIONAL_ARGS+=( . --exclude ./venv )
          fi
          bandit -r ${{ inputs.ENFORCE_BANDIT && '' || '--exit-zero' }} "${BANDIT_CONDITIONAL_ARGS[@]}"

      - name: Send report to CodeClimate
        uses: paambaati/codeclimate-action@v3.0.0
        if: ${{ inputs.ENABLE_CODE_CLIMATE }}
        env:
          CC_TEST_REPORTER_ID: ${{ secrets.CC_TEST_REPORTER_ID }}
        with:
          coverageLocations: |
            ${{github.workspace}}/coverage.xml:coverage.py

      - name: SonarCloud scanner
        uses: sonarsource/sonarcloud-github-action@master
        if: ${{ inputs.ENABLE_SONAR }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

      - name: Get repository accesses
        id: get-repo
        run: |
          REPO=""
          USERNAME=""
          PASSWORD=""
          if [ ${{ inputs.CONTAINER_REGISTRY }} = 'ghcr.io' ]; then
            REPO=$(echo ${{ github.repository }} | tr '[:upper:]' '[:lower:]')
            USERNAME=${{ github.actor }}
            PASSWORD=${{ secrets.GITHUB_TOKEN }}
          else
            REPO=${{ inputs.CONTAINER_REPOSITORY }}
            USERNAME=${{ secrets.CONTAINER_REGISTRY_USERNAME }}
            PASSWORD=${{ secrets.CONTAINER_REGISTRY_PASSWORD }}
          fi

          echo "::set-output name=repo::$REPO"
          echo "::set-output name=username::$USERNAME"
          echo "::set-output name=password::$PASSWORD"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v1
        with:
          registry: ${{ inputs.CONTAINER_REGISTRY }}
          username: ${{ steps.get-repo.outputs.username }}
          password: ${{ steps.get-repo.outputs.password }}

      - name: Generate tags and image meta
        id: meta
        uses: docker/metadata-action@v3
        with:
          images: |
            ${{ inputs.CONTAINER_REGISTRY }}/${{ steps.get-repo.outputs.repo }}
          tags: |
            type=ref,event=tag
            type=sha

      - name: Build image
        uses: docker/build-push-action@v2
        with:
          context: .
          load: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=registry,ref=${{ inputs.CONTAINER_REGISTRY }}/${{ steps.get-repo.outputs.repo }}:latest
          cache-to: type=registry,ref=${{ inputs.CONTAINER_REGISTRY }}/${{ steps.get-repo.outputs.repo }}:latest,mode=max

      - name: Analyze image efficiency
        uses: MartinHeinz/dive-action@v0.1.3
        with:
          image: "${{ inputs.CONTAINER_REGISTRY }}/${{ steps.get-repo.outputs.repo }}:${{ steps.meta.outputs.version }}"
          config: ${{ inputs.DIVE_CONFIG }}
          exit-zero: ${{ !inputs.ENFORCE_DIVE }}

      - name: Trivy vulnerability scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: "${{ inputs.CONTAINER_REGISTRY }}/${{ steps.get-repo.outputs.repo }}:${{ steps.meta.outputs.version }}"
          format: "sarif"
          output: "trivy-results.sarif"

      - name: Push container image
        uses: docker/build-push-action@v2
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          cache-from: type=registry,ref=${{ inputs.CONTAINER_REGISTRY }}/${{ steps.get-repo.outputs.repo }}:latest
          cache-to: type=registry,ref=${{ inputs.CONTAINER_REGISTRY }}/${{ steps.get-repo.outputs.repo }}:latest,mode=max

      - name: Sign the published Docker image
        env:
          COSIGN_EXPERIMENTAL: "true"
        run: cosign sign ${{ inputs.CONTAINER_REGISTRY }}/${{ steps.get-repo.outputs.repo }}:${{ steps.meta.outputs.version }}

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v1
        with:
          sarif_file: "trivy-results.sarif"

      - name: Prepare content for Slack notification
        if: ${{ always() && inputs.ENABLE_SLACK }}
        id: gen-slack-messages
        run: |
          TITLE=""
          if [ "${{ job.status }}" = "success" ]; then
            TITLE="Job Success"
          elif [ "${{ job.status }}" = "failure" ]; then
            TITLE="Job Failed"
          else
            TITLE="Job Cancelled"
          fi
          echo "::set-output name=message::$MESSAGE"
          echo "::set-output name=title::$TITLE"

      - name: Slack notification
        uses: rtCamp/action-slack-notify@v2
        if: ${{ always() && inputs.ENABLE_SLACK }}
        env:
          SLACK_CHANNEL: general
          SLACK_COLOR: ${{ job.status }}
          SLACK_ICON: https://github.com/${{ github.actor }}.png?size=48
          SLACK_TITLE: ${{ steps.gen-slack-messages.outputs.title }}
          SLACK_USERNAME: ${{ github.actor }}
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}