Skip to content

Commit 49af380

Browse files
MadsRCMadsRC
authored
ci: integration setups
1 parent 4372fe1 commit 49af380

File tree

12 files changed

+220
-29
lines changed

12 files changed

+220
-29
lines changed

‎.github/workflows/endorlabs.yaml

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
6+
name: Endor Labs
7+
on:
8+
push:
9+
branches: [ "main" ]
10+
pull_request:
11+
branches: [ "main" ]
12+
schedule:
13+
- cron: '15 13 * * 6'
14+
jobs:
15+
scan:
16+
permissions:
17+
security-events: write # Used to upload sarif artifact to GitHub
18+
contents: read # Used to checkout a private repository by actions/checkout.
19+
actions: read # Required for private repositories to upload sarif files. GitHub Advanced Security licenses are required.
20+
id-token: write # Used for keyless authentication to Endor Labs
21+
runs-on: ubuntu-latest
22+
steps:
23+
- name: Checkout repository
24+
uses: actions/checkout@v3
25+
#### Package Build Instructions
26+
### Use this section to define the build steps used by your software package.
27+
### Endor Labs builds your software for you where possible but the required build tools must be made available.
28+
# - name: Setup Java
29+
# uses: actions/setup-java@v3
30+
# with:
31+
# distribution: 'microsoft'
32+
# java-version: '17'
33+
# - name: Build Package
34+
# run: mvn clean install
35+
- name: Endor Labs scan pull request
36+
if: github.event_name == 'pull_request'
37+
uses: endorlabs/github-action@1aedae63420c07dda7f0a7cf76ecfbce5b698170
38+
with:
39+
namespace: "madsrc" # Modify the namespace to your Endor Labs tenant namespace.
40+
sarif_file: findings.sarif
41+
- name: Endor Labs scan monitor
42+
if: github.event_name == 'push'
43+
uses: endorlabs/github-action@1aedae63420c07dda7f0a7cf76ecfbce5b698170
44+
with:
45+
namespace: "madsrc" # Modify the namespace to your Endor Labs tenant namespace.
46+
pr: "false"
47+
sarif_file: findings.sarif
48+
- name: Upload SARIF to github
49+
uses: github/codeql-action/upload-sarif@9885f86fab4879632b7e44514f19148225dfbdcd
50+
with:
51+
sarif_file: findings.sarif

‎.github/workflows/scorecard.yaml

+73
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
# This workflow uses actions that are not certified by GitHub. They are provided
2+
# by a third-party and are governed by separate terms of service, privacy
3+
# policy, and support documentation.
4+
5+
name: Scorecard supply-chain security
6+
on:
7+
# For Branch-Protection check. Only the default branch is supported. See
8+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
9+
branch_protection_rule:
10+
# To guarantee Maintained check is occasionally updated. See
11+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
12+
schedule:
13+
- cron: '17 6 * * 1'
14+
push:
15+
branches: [ "main" ]
16+
17+
# Declare default permissions as read only.
18+
permissions: read-all
19+
20+
jobs:
21+
analysis:
22+
name: Scorecard analysis
23+
runs-on: ubuntu-latest
24+
permissions:
25+
# Needed to upload the results to code-scanning dashboard.
26+
security-events: write
27+
# Needed to publish results and get a badge (see publish_results below).
28+
id-token: write
29+
# Uncomment the permissions below if installing in a private repository.
30+
# contents: read
31+
# actions: read
32+
33+
steps:
34+
- name: "Checkout code"
35+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
36+
with:
37+
persist-credentials: false
38+
39+
- name: "Run analysis"
40+
uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
41+
with:
42+
results_file: results.sarif
43+
results_format: sarif
44+
# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
45+
# - you want to enable the Branch-Protection check on a *public* repository, or
46+
# - you are installing Scorecard on a *private* repository
47+
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
48+
# repo_token: ${{ secrets.SCORECARD_TOKEN }}
49+
50+
# Public repositories:
51+
# - Publish results to OpenSSF REST API for easy access by consumers
52+
# - Allows the repository to include the Scorecard badge.
53+
# - See https://github.com/ossf/scorecard-action#publishing-results.
54+
# For private repositories:
55+
# - `publish_results` will always be set to `false`, regardless
56+
# of the value entered here.
57+
publish_results: true
58+
59+
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
60+
# format to the repository Actions tab.
61+
- name: "Upload artifact"
62+
uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20
63+
with:
64+
name: SARIF file
65+
path: results.sarif
66+
retention-days: 5
67+
68+
# Upload the results to GitHub's code scanning dashboard (optional).
69+
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
70+
- name: "Upload to code-scanning"
71+
uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9
72+
with:
73+
sarif_file: results.sarif

‎.github/workflows/sonarcloud.yaml

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
on:
2+
# Trigger analysis when pushing in master or pull requests, and when creating
3+
# a pull request.
4+
push:
5+
branches:
6+
- master
7+
pull_request:
8+
types: [opened, synchronize, reopened]
9+
name: SonarCloud analysis
10+
jobs:
11+
sonarcloud:
12+
runs-on: ubuntu-latest
13+
steps:
14+
- uses: actions/checkout@v4
15+
with:
16+
# Disabling shallow clone is recommended for improving relevancy of reporting
17+
fetch-depth: 0
18+
- name: SonarCloud Scan
19+
uses: sonarsource/sonarcloud-github-action@49e6cd3b187936a73b8280d59ffd9da69df63ec9
20+
env:
21+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
22+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

‎.vscode/settings.json

+4
Original file line numberDiff line numberDiff line change
@@ -13,5 +13,9 @@
1313
"python.testing.pytestEnabled": true,
1414
"files.exclude": {
1515
"**/__pycache__": true
16+
},
17+
"sonarlint.connectedMode.project": {
18+
"connectionId": "madsrc",
19+
"projectKey": "MadsRC_sophrosyne"
1620
}
1721
}

‎Makefile

+8-15
Original file line numberDiff line numberDiff line change
@@ -20,10 +20,6 @@ dist/sophrosyne-$(VERSION)-py3-none-any.whl: src/sophrosyne/* src/sophrosyne/grp
2020
@mkdir -p $(@D)
2121
poetry build --format=wheel
2222

23-
dist/bruno.tar:
24-
mkdir -p $(@D)
25-
docker build -t bruno:latest -f bruno.dockerfile --no-cache --attest=type=provenance,mode=max --attest=type=sbom --platform=linux/arm64 --output type=oci,dest=- . > $@
26-
2723
dist/sophrosyne.tar: dist/sophrosyne-$(VERSION)-py3-none-any.whl build/requirements.txt
2824
mkdir -p $(@D)
2925
docker build --build-arg="dist_file=sophrosyne-$(VERSION)-py3-none-any.whl" --secret id=requirements,src=build/requirements.txt --no-cache --tag sophrosyne:$(VERSION) --attest=type=provenance,mode=max --attest=type=sbom --platform=linux/arm64 --output type=oci,dest=- . > $@
@@ -60,26 +56,19 @@ build/.image_loaded_sentinel: dist/sophrosyne.tar
6056
@printf "\n"
6157
touch $@
6258

63-
build/.bruno_image_loaded_sentinel: dist/bruno.tar
64-
mkdir -p $(@D)
65-
docker load --input dist/bruno.tar
66-
@# For some reason the previous command doesn't include a newline in its output
67-
@printf "\n"
68-
touch $@
69-
7059
build/integration/root_token:
7160
mkdir -p $(@D)
7261
openssl rand -hex 128 > $@
7362

7463

7564
.PHONY: test/integration
76-
test/integration: test/integration/healthy_instance test/integration/auth01
65+
test/integration: test/integration/healthy_instance test/integration/auth01 test/integration/auth_required
7766

7867
.PHONY: test/integration/%
79-
test/integration/%: build/.certificate_sentinel build/.bruno_image_loaded_sentinel build/.image_loaded_sentinel build/integration/root_token
80-
$(MAKE) destroy/test/integration/%
68+
test/integration/%: build/.certificate_sentinel build/.image_loaded_sentinel build/integration/root_token
69+
$(MAKE) destroy/test/integration/$*
8170
VERSION=$(VERSION) ROOT_TOKEN="$$(cat build/integration/root_token)" docker compose -f tests/integration/$*/docker-compose.yml up --exit-code-from tester
82-
$(MAKE) destroy/test/integration/%
71+
$(MAKE) destroy/test/integration/$*
8372

8473
.PHONY: destroy/test/integration/%
8574
destroy/test/integration/%:
@@ -106,3 +95,7 @@ build/.certificate_sentinel:
10695
chmod 0777 build/server.key
10796
chmod 0777 build/server.crt
10897
touch $@
98+
99+
.PHONY:
100+
dev/install:
101+
poetry install --with dev,test

‎README.md

+10
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,15 @@
11
# Sophrosyne
22

3+
[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=MadsRC_sophrosyne&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=MadsRC_sophrosyne)
4+
[![Bugs](https://sonarcloud.io/api/project_badges/measure?project=MadsRC_sophrosyne&metric=bugs)](https://sonarcloud.io/summary/new_code?id=MadsRC_sophrosyne)
5+
[![Code Smells](https://sonarcloud.io/api/project_badges/measure?project=MadsRC_sophrosyne&metric=code_smells)](https://sonarcloud.io/summary/new_code?id=MadsRC_sophrosyne)
6+
[![Coverage](https://sonarcloud.io/api/project_badges/measure?project=MadsRC_sophrosyne&metric=coverage)](https://sonarcloud.io/summary/new_code?id=MadsRC_sophrosyne)
7+
[![Duplicated Lines (%)](https://sonarcloud.io/api/project_badges/measure?project=MadsRC_sophrosyne&metric=duplicated_lines_density)](https://sonarcloud.io/summary/new_code?id=MadsRC_sophrosyne)
8+
[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/MadsRC/sophrosyne/badge)](https://securityscorecards.dev/viewer/?uri=github.com/MadsRC/sophrosyne)
9+
[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/8804/badge)](https://www.bestpractices.dev/projects/8804)
10+
![build](https://github.com/ossf/scorecard/workflows/build/badge.svg?branch=main)
11+
![CodeQL](https://github.com/ossf/scorecard/workflows/CodeQL/badge.svg?branch=main)
12+
313
Sophrosyne is a horizontally scaleable content moderation API built for the
414
age of Generative AI.
515

‎bruno.dockerfile

-11
This file was deleted.

‎renovate.json

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
{
2+
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
3+
"configMigration": true,
4+
"extends": [
5+
"config:recommended",
6+
"docker:pinDigests",
7+
"helpers:pinGitHubActionDigests",
8+
":pinDevDependencies"
9+
],
10+
"packageRules": [
11+
{
12+
"matchDepTypes": [
13+
"action"
14+
],
15+
"pinDigests": true,
16+
"matchSourceUrlPrefixes": [
17+
"https://github.com/"
18+
],
19+
"prBodyDefinitions": {
20+
"OpenSSF": "[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/{{sourceRepo}}/badge)](https://securityscorecards.dev/viewer/?uri=github.com/{{sourceRepo}})"
21+
},
22+
"prBodyColumns": [
23+
"Package",
24+
"Type",
25+
"Update",
26+
"Change",
27+
"Pending",
28+
"OpenSSF"
29+
]
30+
}
31+
],
32+
"docker-compose": {
33+
"enabled": true
34+
},
35+
"dockerfile": {
36+
"enabled": true
37+
},
38+
"pre-commit": {
39+
"enabled": true
40+
},
41+
"vulnerabilityAlerts": {
42+
"enabled": true,
43+
"labels": [
44+
"vulnerability"
45+
]
46+
}
47+
}

‎sonar-project.properties

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
sonar.projectKey=MadsRC_sophrosyne
2+
sonar.organization=madsrc

‎tests/integration/auth01/docker-compose.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
services:
22

33
tester:
4-
image: bruno:latest
4+
image: ghcr.io/madsrc/bru:latest
55
depends_on:
66
api:
77
condition: service_healthy

‎tests/integration/auth_required/docker-compose.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
services:
22

33
tester:
4-
image: bruno:latest
4+
image: ghcr.io/madsrc/bru:latest
55
depends_on:
66
api:
77
condition: service_healthy

‎tests/integration/healthy_instance/docker-compose.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
services:
22

33
tester:
4-
image: bruno:latest
4+
image: ghcr.io/madsrc/bru:latest
55
depends_on:
66
api:
77
condition: service_healthy

0 commit comments

Comments
 (0)