Mercurial > p > roundup > code
annotate .github/workflows/anchore.yml @ 7752:b2dbab2b34bc
fix(refactor): multiple fixups using ruff linter; more testing.
Converting to using the ruff linter and its rulesets. Fixed a number
of issues.
admin.py:
sort imports
use immutable tuples as default value markers for parameters where a
None value is valid.
reduced some loops to list comprehensions for performance
used ternary to simplify some if statements
named some variables to make them less magic
(e.g. _default_savepoint_setting = 1000)
fixed some tests for argument counts < 2 becomes != 2 so 3 is an
error.
moved exception handlers outside of loops for performance where
exception handler will abort loop anyway.
renamed variables called 'id' or 'dir' as they shadow builtin
commands.
fix translations of form _("string %s" % value) -> _("string %s") %
value so translation will be looked up with the key before
substitution.
end dicts, tuples with a trailing comma to reduce missing comma
errors if modified
simplified sorted(list(self.setting.keys())) to
sorted(self.setting.keys()) as sorted consumes whole list.
in if conditions put compared variable on left and threshold condition
on right. (no yoda conditions)
multiple noqa: suppression
removed unneeded noqa as lint rulesets are a bit different
do_get - refactor output printing logic: Use fast return if not
special formatting is requested; use isinstance with a tuple
rather than two isinstance calls; cleaned up flow and removed
comments on algorithm as it can be easily read from the code.
do_filter, do_find - refactor output printing logic. Reduce
duplicate code.
do_find - renamed variable 'value' that was set inside a loop. The
loop index variable was also named 'value'.
do_pragma - added hint to use list subcommand if setting was not
found. Replaced condition 'type(x) is bool' with 'isinstance(x,
bool)' for various types.
test_admin.py
added testing for do_list
better test coverage for do_get includes: -S and -d for multilinks,
error case for -d with non-link.
better testing for do_find including all output modes
better testing for do_filter including all output modes
fixed expected output for do_pragma that now includes hint to use
pragma list if setting not found.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Fri, 01 Mar 2024 14:53:18 -0500 |
| parents | a17d0abfb212 |
| children | 85c47edfc383 |
| rev | line source |
|---|---|
|
6838
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
1 # This workflow uses actions that are not certified by GitHub. |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
2 # They are provided by a third-party and are governed by |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
3 # separate terms of service, privacy policy, and support |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
4 # documentation. |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
5 |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
6 # This workflow checks out code, builds an image, performs a container image |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
7 # vulnerability scan with Anchore's Grype tool, and integrates the results with GitHub Advanced Security |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
8 # code scanning feature. For more information on the Anchore scan action usage |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
9 # and parameters, see https://github.com/anchore/scan-action. For more |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
10 # information on Anchore's container image scanning tool Grype, see |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
11 # https://github.com/anchore/grype |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
12 name: Anchore Container Scan |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
13 |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
14 on: |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
15 push: |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
16 branches: [ "master" ] |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
17 pull_request: |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
18 # The branches below must be a subset of the branches above |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
19 branches: [ "master" ] |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
20 schedule: |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
21 - cron: '38 21 * * 6' |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
22 |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
23 permissions: |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
24 contents: read |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
25 |
|
6956
ca6b056b79a4
only run on most current push.
John Rouillard <rouilj@ieee.org>
parents:
6838
diff
changeset
|
26 concurrency: |
|
ca6b056b79a4
only run on most current push.
John Rouillard <rouilj@ieee.org>
parents:
6838
diff
changeset
|
27 group: ${{ github.workflow }}-${{ github.ref }} |
|
ca6b056b79a4
only run on most current push.
John Rouillard <rouilj@ieee.org>
parents:
6838
diff
changeset
|
28 cancel-in-progress: true |
|
ca6b056b79a4
only run on most current push.
John Rouillard <rouilj@ieee.org>
parents:
6838
diff
changeset
|
29 |
|
6838
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
30 jobs: |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
31 Anchore-Build-Scan: |
|
7194
8dc5b3739367
Prevent github actions from running if commit includes 'no-github-ci'
John Rouillard <rouilj@ieee.org>
parents:
7186
diff
changeset
|
32 if: "!contains(github.event.head_commit.message, 'no-github-ci')" |
|
6838
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
33 permissions: |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
34 contents: read # for actions/checkout to fetch code |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
35 security-events: write # for github/codeql-action/upload-sarif to upload SARIF results |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
36 actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
37 runs-on: ubuntu-latest |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
38 steps: |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
39 - name: Checkout the code |
|
7728
a17d0abfb212
chore: update to latest actions
John Rouillard <rouilj@ieee.org>
parents:
7647
diff
changeset
|
40 uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 |
|
6838
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
41 - name: Build the Docker image |
|
7147
7f4d20ebae4a
another try. Use same shell that builds roundup image to update base.
John Rouillard <rouilj@ieee.org>
parents:
7146
diff
changeset
|
42 run: docker pull python:3-alpine; docker build . --file scripts/Docker/Dockerfile --tag localbuild/testimage:latest |
|
7273
6bffcc837bf7
Add list of docker to allow checking size.
John Rouillard <rouilj@ieee.org>
parents:
7270
diff
changeset
|
43 - name: List the Docker image |
|
6bffcc837bf7
Add list of docker to allow checking size.
John Rouillard <rouilj@ieee.org>
parents:
7270
diff
changeset
|
44 run: docker image ls |
|
6838
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
45 - name: Run the Anchore scan action itself with GitHub Advanced Security code scanning integration enabled |
|
7728
a17d0abfb212
chore: update to latest actions
John Rouillard <rouilj@ieee.org>
parents:
7647
diff
changeset
|
46 uses: anchore/scan-action@c35e932c2a7c572bfdb1c3dbcdadb2d4fc62418d # 3.6.1 |
|
7044
619563fbe2d3
Fix version identofier for Anchore scan
John Rouillard <rouilj@ieee.org>
parents:
7043
diff
changeset
|
47 id: scan |
|
6838
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
48 with: |
|
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
49 image: "localbuild/testimage:latest" |
|
7116
86dae713d4c6
Try to make anchore failure fail build but upload results
John Rouillard <rouilj@ieee.org>
parents:
7046
diff
changeset
|
50 fail-build: true |
|
6838
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
51 - name: Upload Anchore Scan Report |
|
7116
86dae713d4c6
Try to make anchore failure fail build but upload results
John Rouillard <rouilj@ieee.org>
parents:
7046
diff
changeset
|
52 if: always() |
|
7728
a17d0abfb212
chore: update to latest actions
John Rouillard <rouilj@ieee.org>
parents:
7647
diff
changeset
|
53 uses: github/codeql-action/upload-sarif@65c74964a9ed8c44ed9f19d4bbc5757a6a8e9ab9 # v2.16.1 |
|
6838
3387f458ed27
add workflow - docker container security check
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
54 with: |
|
7044
619563fbe2d3
Fix version identofier for Anchore scan
John Rouillard <rouilj@ieee.org>
parents:
7043
diff
changeset
|
55 sarif_file: ${{ steps.scan.outputs.sarif }} |
|
619563fbe2d3
Fix version identofier for Anchore scan
John Rouillard <rouilj@ieee.org>
parents:
7043
diff
changeset
|
56 - name: Inspect action SARIF report |
|
7116
86dae713d4c6
Try to make anchore failure fail build but upload results
John Rouillard <rouilj@ieee.org>
parents:
7046
diff
changeset
|
57 if: always() |
|
7044
619563fbe2d3
Fix version identofier for Anchore scan
John Rouillard <rouilj@ieee.org>
parents:
7043
diff
changeset
|
58 run: cat ${{ steps.scan.outputs.sarif }} |
