FindingModelForge/.github/workflows/ci.yml at main · openimagingdata/FindingModelForge · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
name: CI/CD Pipeline

on:
  push:
    branches: [ main, develop ]
    paths:
      - './**'
  pull_request:
    branches: [ main ]
    paths:
      - './**'

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}/findingmodelforge

jobs:
  test:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: .

    steps:
    - uses: actions/checkout@v4

    - name: Install uv
      uses: astral-sh/setup-uv@v2

    - name: Set up Python
      run: uv python install 3.12

    - name: Install dependencies
      run: uv sync --all-extras --dev

    - name: Run linting
      run: uv run ruff check .

    - name: Run formatting check
      run: uv run ruff format --check .

    - name: Run type checking
      run: uv run mypy .

    - name: Run tests
      run: uv run pytest --cov=app --cov-report=xml

    - name: Upload coverage to Codecov
      uses: codecov/codecov-action@v3
      with:
        file: ./coverage.xml
        flags: unittests
        name: codecov-umbrella

  security:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: .

    steps:
    - uses: actions/checkout@v4

    - name: Install uv
      uses: astral-sh/setup-uv@v2

    - name: Set up Python
      run: uv python install 3.12

    - name: Install dependencies
      run: uv sync --all-extras --dev

    - name: Run security checks
      run: |
        uv run pip install safety bandit
        uv run safety check
        uv run bandit -r app/

  build:
    needs: [test, security]
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: .
    permissions:
      contents: read
      packages: write

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    - name: Log in to Container Registry
      uses: docker/login-action@v3
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Extract metadata
      id: meta
      uses: docker/metadata-action@v5
      with:
        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
        tags: |
          type=ref,event=branch
          type=ref,event=pr
          type=sha,prefix={{branch}}-
          type=raw,value=latest,enable={{is_default_branch}}

    - name: Build and push Docker image
      uses: docker/build-push-action@v5
      with:
        context: .
        push: true
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        cache-from: type=gha
        cache-to: type=gha,mode=max

  deploy:
    needs: build
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    environment: production

    steps:
    - name: Deploy to production
      run: |
        echo "Deployment step would go here"
        echo "This could trigger deployment to cloud services"
        echo "For example: Azure Container Instances, AWS ECS, Google Cloud Run, etc."