ci.yml

name: Continuos Integration

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  schedule:
    - cron:  '0 0 * * 1' # Every Monday at 00:00 UTC

jobs:
  python-check:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: [
          "3.7",
          "3.8",
          "3.9",
          "3.10",
          "pypy-3.8"
        ]

    steps:
      - uses: actions/checkout@v3

      - uses: actions/setup-python@v3
        with:
          python-version: ${{ matrix.python-version }}
          cache: "pip"
          cache-dependency-path: "requirements/*.txt"

      - name: Install Python dependencies
        run: pip install -r requirements/dev.txt

      - name: Python test and coverage
        run: pytest

      - name: Save html coverage report
        if: ${{ always() && matrix.python-version == '3.10' }}
        uses: actions/upload-artifact@v2
        with:
          name: html-coverage-report
          path: tests/coverage-results/htmlcov/

      - name: Python type check
        run: mypy .

      - name: Python linter
        run: |
          prospector
          prospector --profile tests/.prospector.yaml tests

      - name: Code format
        run: |
          isort --check --diff .
          black --check --diff .

      - name: Security vulnerability scan
        run: |
          bandit --recursive scripts/docky_cli
          safety check --file requirements/dev.txt --full-report

      - name: Test documentation
        run: |
          sphinx-apidoc --module-first --private --output-dir docs/modules scripts/docky_cli
          sphinx-build -W -T -v -n docs public

  docker-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Build Docker image
        run: docker build --tag docky --file docker/Dockerfile .

      - name: Dockerfile linter
        uses: hadolint/hadolint-action@v2.0.0
        with:
          dockerfile: docker/Dockerfile

      - name: Docker image security vulnerability scan
        continue-on-error: true
        uses: snyk/actions/docker@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          image: docky
          args: --severity-threshold=medium --file=docker/Dockerfile

  project-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          ref: ${{ github.event.pull_request.head.sha }} # Checkout pull request HEAD commit instead of merge commit
          fetch-depth: 0

      - uses: actions/setup-python@v3
        with:
          python-version: "3.10"
          cache: "pip"
          cache-dependency-path: "requirements/*.txt"

      - name: Install Python dependencies
        run: pip install -r requirements/dev.txt

      - name: Check commit messages
        run: gitlint --commits 772eaa91b3439a567009a54af61d2962c179dd11..

      - name: Code format
        run: ec -verbose