3b5923b7e1
- run scan on each push/pull request update - can be run locally using make test_trivy_repo - exit with error code 0/success when vulnerabilities are found, as not to make the workflow fail, a separate periodic run that exits with code 1 should be added in parallel - update trivy to v0.43.0 - https://github.com/aquasecurity/trivy/releases/tag/v0.43.0 - also consider TRIVY_EXIT_CODE when running trivy on the latest docker image - ref. https://github.com/shaarli/Shaarli/issues/1531
109 lines
2.8 KiB
YAML
109 lines
2.8 KiB
YAML
name: Shaarli CI
|
|
on: [push, pull_request]
|
|
jobs:
|
|
php:
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
php-versions: ['7.4', '8.0', '8.1', '8.2']
|
|
name: PHP ${{ matrix.php-versions }}
|
|
steps:
|
|
- name: Set locales
|
|
run: |
|
|
sudo locale-gen de_DE.utf8 && \
|
|
sudo locale-gen en_US.utf8 && \
|
|
sudo locale-gen fr_FR.utf8 && \
|
|
sudo dpkg-reconfigure --frontend=noninteractive locales
|
|
|
|
- name: Install Gettext
|
|
run: sudo apt-get install gettext
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@v3
|
|
|
|
- name: Setup PHP
|
|
uses: shivammathur/setup-php@v2
|
|
with:
|
|
php-version: ${{ matrix.php-versions }}
|
|
extensions: gd, xml, curl, mbstring, intl, gettext
|
|
tools: composer:v2
|
|
|
|
- name: Check PHP version
|
|
run: php -v
|
|
|
|
- name: Setup Composer from PHP version + update
|
|
run: composer config --unset platform && composer config platform.php ${{ matrix.php-versions }}
|
|
|
|
- name: Update dependencies for PHP 8.x
|
|
if: ${{ matrix.php-versions == '8.0' || matrix.php-versions == '8.1' }}
|
|
run: |
|
|
composer update && \
|
|
composer remove --dev phpunit/phpunit && \
|
|
composer require --dev phpunit/php-text-template ^2.0 && \
|
|
composer require --dev phpunit/phpunit ^9.0
|
|
|
|
- name: Update dependencies for PHP 7.x
|
|
if: ${{ matrix.php-versions != '8.0' && matrix.php-versions != '8.1' }}
|
|
run: composer update
|
|
|
|
- name: Clean up
|
|
run: make clean
|
|
|
|
- name: Check permissions
|
|
run: make check_permissions
|
|
|
|
- name: Run PHPCS
|
|
run: make code_sniffer
|
|
|
|
- name: Run tests
|
|
run: make all_tests
|
|
|
|
node:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v3
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v3
|
|
with:
|
|
node-version: '14.x'
|
|
|
|
- name: Yarn install
|
|
run: yarnpkg install
|
|
|
|
- name: Verify successful frontend builds
|
|
run: yarnpkg run build
|
|
|
|
- name: JS static analysis
|
|
run: make eslint
|
|
|
|
- name: Linter for SASS syntax
|
|
run: make sasslint
|
|
|
|
python:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v3
|
|
|
|
- name: Setup Python
|
|
uses: actions/setup-python@v4
|
|
with:
|
|
python-version: 3.8
|
|
|
|
- name: Install dependencies
|
|
run: pip install mkdocs
|
|
|
|
- name: Build documentation
|
|
run: mkdocs build --clean
|
|
|
|
trivy-repo:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v3
|
|
|
|
- name: Run trivy scanner on repository (non-blocking)
|
|
run: make test_trivy_repo TRIVY_EXIT_CODE=0
|