mirror of
https://github.com/ansible-collections/kubernetes.core.git
synced 2026-07-25 08:54:51 +00:00
6bb9cce51b
* feat(ci): add security check to block .claude/ and .vscode/ directories Add workflow that calls the security_check_directories action from cloud-content-ci-automation to fail PRs containing files under .claude/ or .vscode/ directories. Integrates with all_green_check.yaml as a required job for PRs. Ref: ACA-6411 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(ci): suppress SonarCloud S7637 for reusable actions using @main Internal reusable actions from ansible-network/github_actions and ansible-collections/cloud-content-ci-automation use @main refs for simpler maintenance. Suppress the 'use full commit SHA' rule for workflow files. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(ci): use correct org and pin action to commit SHA Address review feedback: - Change org from ansible-collections to ansible - Pin to commit SHA 74b5fe87 instead of @main Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * docs: add changelog fragment for security check workflow Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Update changelogs/fragments/1173-security-check-workflow.yml --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: Bianca Henderson <beeankha@gmail.com>
98 lines
2.8 KiB
YAML
98 lines
2.8 KiB
YAML
---
|
|
name: all_green
|
|
|
|
concurrency:
|
|
group: ${{ github.head_ref || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
on: # yamllint disable-line rule:truthy
|
|
pull_request:
|
|
types:
|
|
- opened
|
|
- reopened
|
|
- synchronize
|
|
branches:
|
|
- main
|
|
- stable-*
|
|
push:
|
|
branches:
|
|
- main
|
|
- stable-*
|
|
|
|
jobs:
|
|
security-check:
|
|
if: github.event_name == 'pull_request'
|
|
uses: ./.github/workflows/security-check.yaml
|
|
|
|
linters:
|
|
if: github.event_name == 'pull_request'
|
|
uses: ./.github/workflows/linters.yaml
|
|
|
|
sanity:
|
|
uses: ./.github/workflows/sanity-tests.yaml
|
|
|
|
units:
|
|
uses: ./.github/workflows/unit-tests.yaml
|
|
|
|
coverage:
|
|
name: Unit test coverage
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
with:
|
|
path: ansible_collections/kubernetes/core
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
- name: Run unit tests with coverage
|
|
working-directory: ansible_collections/kubernetes/core
|
|
env:
|
|
PYTHONPATH: ${{ github.workspace }}
|
|
run: |
|
|
python -m pip install --upgrade pip
|
|
python -m pip install ansible-compat
|
|
python -m pip install https://github.com/ansible/ansible/archive/stable-2.19.tar.gz
|
|
# Same deps as the units matrix (build_install_collection); do not use
|
|
# tests/unit/requirements.txt — its kubernetes pin breaks test_core.py.
|
|
python -m pip install -r requirements.txt -r test-requirements.txt
|
|
python -m coverage run --source=plugins -m pytest tests/unit \
|
|
--ansible-host-pattern localhost
|
|
python -m coverage xml -o coverage.xml
|
|
|
|
- name: Upload coverage artifact
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: coverage
|
|
path: ansible_collections/kubernetes/core/coverage.xml
|
|
|
|
all_green:
|
|
if: ${{ always() }}
|
|
needs:
|
|
- security-check
|
|
- linters
|
|
- sanity
|
|
- units
|
|
- coverage
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- run: |
|
|
python -c "
|
|
required = ['sanity', 'units', 'coverage']
|
|
if '${{ github.event_name }}' == 'pull_request':
|
|
required = ['security-check', 'linters', 'sanity', 'units', 'coverage']
|
|
results = {
|
|
'security-check': '${{ needs.security-check.result }}',
|
|
'linters': '${{ needs.linters.result }}',
|
|
'sanity': '${{ needs.sanity.result }}',
|
|
'units': '${{ needs.units.result }}',
|
|
'coverage': '${{ needs.coverage.result }}',
|
|
}
|
|
ok = all(results[j] == 'success' for j in required)
|
|
skipped_ok = all(results[j] in ('success', 'skipped') for j in results)
|
|
assert ok and skipped_ok, f'required={required} results={results}'
|
|
"
|