ci.yaml

name: ci
on:
  pull_request:
  push:

permissions: read-all

env:
  IMAGE: app_python
  REGISTRY: winnerokay

jobs:
  lint_test:
    name: Linting and Testing
    runs-on: ubuntu-20.04
    steps:
      - name: Checkout
        uses: actions/checkout@v2.3.4

      - name: Load python cache
        uses: actions/cache@v2.1.6
        with:
          path: |
            app_python/__pycache__
            app_python/.pytest_cache
          key: ${{ runner.os }}-${{ hashFiles('app_python/') }}

      - name: Setup Python
        uses: actions/setup-python@v2.2.2
        with:
          python-version: 3.9

      - name: Setup Poetry
        uses: snok/install-poetry@v1.1.8
        with:
          version: 1.1.8
          virtualenvs-create: true
          virtualenvs-in-project: true

      - name: Load cached venv
        id: cached-poetry-dependencies
        uses: actions/cache@v2
        with:
          path: .venv
          key: venv-${{ runner.os }}-${{ hashFiles('poetry.lock') }}-${{ secrets.CACHE_VERSION }}

      - name: Install dependencies
        if: steps.cached-poetry-dependencies.outputs.cache-hit != 'true'
        run: |
          poetry install
          poetry run mypy --install-types --non-interactive ./

      - name: Typing validation
        run: poetry run mypy --config-file pyproject.toml ./

      - name: Test
        run: poetry run pytest

      - name: Upload coverage artifact
        uses: actions/upload-artifact@v2
        with:
          name: coverage-report
          path: htmlcov

      - name: Format checking
        run: |
          poetry run isort --diff --check-only --settings-path pyproject.toml ./
          poetry run black --diff --check --config pyproject.toml ./
          poetry run darglint --verbosity 2 app_python tests

      - name: Safety checks
        run: |
          poetry check
          poetry run safety check --full-report
          poetry run bandit -ll --recursive app_python

  build:
    name: Build
    if: github.event_name == 'push'
    runs-on: ubuntu-20.04
    needs: [ lint_test ]
    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1.5.1

      - name: Checkout
        uses: actions/checkout@v2.3.4

      - name: Login to Docker Hub
        uses: docker/login-action@v1.10.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Set variables
        id: vars
        run: |
          short_sha=$(git rev-parse --short "${{github.sha}}")
          echo ::set-output name=SHORT_SHA::${short_sha}
          git_ref=${{github.ref}}
          echo ::set-output name=BRANCH::${git_ref##*/}

      - name: Build and push docker image
        uses: docker/build-push-action@v2.7.0
        with:
          file: docker/Dockerfile
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE }}:latest
            ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{steps.vars.outputs.SHORT_SHA}}
            ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{steps.vars.outputs.BRANCH}}
          cache-from: |
            type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE }}:buildcache-${{steps.vars.outputs.BRANCH}}
            type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE }}:buildcache-main
          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE }}:buildcache-${{steps.vars.outputs.BRANCH}},mode=max
          build-args: |
            INSTALL_DEV='false'