ci: updated GH workflows #44

Workflow file for this run

	name: Main CI/CD Pipeline

	on:
	push:
	branches: ['**']
	paths-ignore:
	- '**.md'
	- 'images/**'
	pull_request:
	branches:
	- main
	paths-ignore:
	- '**.md'
	- 'images/**'
	workflow_dispatch:

	env:
	CERTBOT_LAMBDA_DIR: 'lambdas/certbot'
	UV_VERSION: '0.9.26'
	RUFF_VERSION: '0.14.13'
	BANDIT_VERSION: '1.9.3'
	TF_VERSION: '1.12.1'
	TF_LINT_VERSION: 'latest'
	TF_DOCS_VERSION: 'latest'
	TF_WORKING_DIR: 'terraform/'
	TRIVY_VERSION: 'v0.68.2'

	jobs:
	python-lint:
	name: Python Linting
	runs-on: ubuntu-latest
	steps:
	- name: Check-out code
	uses: actions/checkout@v6

	- name: Ruff check (linter)
	uses: astral-sh/ruff-action@v3
	with:
	version: ${{ env.RUFF_VERSION }}
	args: "check --output-format=github"

	- name: Ruff format (formatter)
	uses: astral-sh/ruff-action@v3
	with:
	version: ${{ env.RUFF_VERSION }}
	args: "format --diff"

	python-test:
	name: Python Tests
	runs-on: ubuntu-latest
	steps:
	- name: Check-out code
	uses: actions/checkout@v6

	- name: Check if tests directory exists
	id: check-tests
	run: \|
	if [ -d "tests" ] && [ -n "$(ls -A tests 2>/dev/null)" ]; then
	echo "exists=true" >> $GITHUB_OUTPUT
	else
	echo "exists=false" >> $GITHUB_OUTPUT
	echo "::notice::Skipping tests - tests directory does not exist or is empty"
	fi

	- name: Set up uv
	if: steps.check-tests.outputs.exists == 'true'
	uses: astral-sh/setup-uv@v7
	with:
	version: ${{ env.UV_VERSION }}

	# Test dependencies are declared in pyproject.toml
	- name: Install dependencies (workspace)
	if: steps.check-tests.outputs.exists == 'true'
	run: uv sync --all-packages --extra test

	- name: Run tests with pytest
	if: steps.check-tests.outputs.exists == 'true'
	env:
	AWS_DEFAULT_REGION: 'us-east-1'
	run: \|
	uv run pytest tests/ \
	--cov=${{ env.CERTBOT_LAMBDA_DIR }} \
	--cov-report=xml \
	--cov-report=html \
	--cov-report=term-missing \
	--junitxml=junit/test-results.xml

	- name: Upload coverage to Codecov
	if: steps.check-tests.outputs.exists == 'true'
	uses: codecov/codecov-action@v5
	with:
	files: ./coverage.xml
	flags: unittests
	name: codecov-umbrella

	- name: Upload test results
	if: always() && steps.check-tests.outputs.exists == 'true'
	uses: actions/upload-artifact@v5
	with:
	name: pytest-results
	path: \|
	junit/test-results.xml
	htmlcov/

	# Terraform Validation
	terraform-validate:
	name: Terraform Validation
	runs-on: ubuntu-latest

	steps:
	- uses: actions/checkout@v6

	- name: Setup Terraform
	uses: hashicorp/setup-terraform@v3
	with:
	terraform_version: ${{ env.TF_VERSION }}

	- name: Terraform Format Check
	run: \|
	terraform fmt -check -recursive ${{ env.TF_WORKING_DIR }}

	- name: Terraform Init
	working-directory: ${{ env.TF_WORKING_DIR }}
	run: \|
	terraform init -backend=false

	- name: Terraform Validate
	working-directory: ${{ env.TF_WORKING_DIR }}
	run: \|
	terraform validate

	- name: TFLint
	uses: terraform-linters/setup-tflint@v6
	with:
	tflint_version: ${{ env.TF_LINT_VERSION }}

	- name: Run TFLint
	run: \|
	tflint --init
	tflint --recursive

	# Security Scanning
	security-scan:
	name: Security Scanning
	runs-on: ubuntu-latest
	permissions:
	contents: read
	security-events: write

	steps:
	- uses: actions/checkout@v6
	with:
	fetch-depth: 0

	- name: Setup Trivy (manual)
	uses: aquasecurity/setup-trivy@v0.2.5
	with:
	cache: true
	version: ${{ env.TRIVY_VERSION }}

	- name: Run Trivy security scan
	uses: aquasecurity/trivy-action@0.33.1
	with:
	scan-type: 'fs'
	scan-ref: '.'
	format: 'sarif'
	output: 'trivy-results.sarif'
	skip-setup-trivy: true

	- name: Upload Trivy results to GitHub Security
	uses: github/codeql-action/upload-sarif@v4
	with:
	sarif_file: 'trivy-results.sarif'

	- name: Set up uv
	uses: astral-sh/setup-uv@v7
	with:
	version: ${{ env.UV_VERSION }}

	- name: Python Security Check (Bandit)
	run: \|
	uvx bandit@${{ env.BANDIT_VERSION }} -r . -f screen \|\| true

	- name: Check for secrets (Gitleaks)
	uses: gitleaks/gitleaks-action@v2
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	pre-commit:
	name: Pre-Commit hooks
	runs-on: ubuntu-latest

	steps:
	- uses: actions/checkout@v6

	- name: Setup Terraform
	uses: hashicorp/setup-terraform@v3
	with:
	terraform_version: ${{ env.TF_VERSION }}

	- name: Setup TFLint
	uses: terraform-linters/setup-tflint@v6
	with:
	tflint_version: ${{ env.TF_LINT_VERSION }}

	- name: Setup Trivy
	uses: aquasecurity/setup-trivy@v0.2.5
	with:
	cache: true
	version: ${{ env.TRIVY_VERSION }}

	- name: Setup Terraform docs
	uses: jaxxstorm/action-install-gh-release@v2.1.0
	with:
	repo: terraform-docs/terraform-docs
	tag: ${{ env.TF_DOCS_VERSION }}

	- name: Run pre-commit hooks
	uses: pre-commit/action@v3.0.1

Navigation Menu

ci: updated GH workflows #44

Workflow file

ci: updated GH workflows #44

Uh oh!

Workflow file for this run