actions¶

Reusable GitHub Actions workflows and composite actions shared by all the repositories of RS-Python.

Overview¶

The CI/CD of the RS-Python repositories, and the dependencies between them, are described in Repositories and CI/CD. This repository factorises its common parts:

a reusable workflow that checks the code quality of a repository,
composite actions used by the build and publication workflows,
maintenance workflows of the GitHub organisation.

Reusable workflows¶

Workflow	Description
reusable-check-quality.yml	Check the code quality of the calling repository: pre-commit, license headers (SkyWalking Eyes), Trivy (vulnerabilities and misconfigurations), Bandit, Flake8, Mypy, Pylint, Safety, Pytest with coverage, and SonarQube Cloud with its quality gate.
reusable-update-trivy-cache.yml	Download the Trivy databases and save them in the GitHub cache of the calling repository, so the Trivy scans don't download them each time (avoids the `TOOMANYREQUESTS` errors from the registries).

Usage, from the .github/workflows/check-code-quality.yml file of a repository:

jobs:
  check-code-quality:
    uses: RS-PYTHON/actions/.github/workflows/reusable-check-quality.yml@develop
    with:
      caller-repository: ${{ github.repository }}
      caller-ref: ${{ github.ref }}
      caller-ref_name: ${{ github.ref_name }}
    secrets:
      SAFETY_API_KEY: ${{ secrets.SAFETY_API_KEY }}
      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

The other inputs (Python and Poetry versions, directories covered by the tests, Sonar exclusions, tools whose errors are ignored...) are described in the workflow file.

Every repository that runs Trivy scans (with reusable-check-quality.yml, publish-docker or directly) must also update its Trivy cache every day, from the .github/workflows/update-trivy-cache.yml file:

on:
  schedule: # works only on the default branch !
    - cron: "30 0 * * *" # every day at 00:30
  workflow_dispatch: # manual trigger

jobs:
  update-trivy-cache:
    uses: RS-PYTHON/actions/.github/workflows/reusable-update-trivy-cache.yml@develop
    permissions:
      actions: write # to delete the old caches

Composite actions¶

Action	Description
build-wheel	Build the wheel and sdist packages of a Poetry project.
cancel-workflow-runs	Cancel the workflow runs of any repository, to avoid duplicate runs of the same workflow.
get-image-tag	Return the first Docker image tag that exists in a list, e.g. `does-not-exist,latest` returns `latest`.
get-repo-branch	Return the first branch of a git repository that exists in a list, e.g. `does-not-exist,develop` returns `develop`.
publish-docker	Build and push a Docker image, and scan it with Trivy.
restore-trivy-cache	Restore the Trivy databases saved by `reusable-update-trivy-cache.yml` and skip their update in the next Trivy steps (to call before `aquasecurity/trivy-action` with `cache: false`).
set-binary-env	Set the variables of the publication of the Docker images from the git context: branch name, Docker tags, debug mode.
setup-poetry	Install Python and Poetry.
tag-push-docker	Tag and push the temporary Docker images with their final tags, after the tests have passed.

Usage: uses: RS-PYTHON/actions/.github/actions/<action>@develop.

Maintenance workflows¶

Workflow	Description
all-repos-check-quality.yml	Run the code quality check on all the repositories of the organisation (manual trigger).
clean-old-docker.yml	Delete the old Docker images of the GitHub Container Registry of the organisation (every day), with the scripts of the js folder.
check-code-quality.yml	Check the code quality of this repository.
update-trivy-cache.yml	Update the Trivy cache of this repository (every day).

Documentation¶

All the RS-Python repositories use these workflows and actions, e.g. rs-server, rs-client-libraries and rs-dpr-service.