Skip to content
Validate On Pull Request

Fetch a source secret on demand and keep it until it expires #132

Sign in to view logs

Fetch a source secret on demand and keep it until it expires

Fetch a source secret on demand and keep it until it expires #132

Workflow file for this run

.github/workflows/on-pull-request.yml at ced7903
name: Validate On Pull Request
on:
pull_request:
concurrency:
group: pull-request-${{ github.event.pull_request.number }}
cancel-in-progress: true
permissions:
contents: read
jobs:
lint:
name: Run Lint
runs-on: ubuntu-latest
steps:
- name: Check out repository
uses: actions/checkout@v6
- name: Load test environment
run: cat env/test.env >> "$GITHUB_ENV"
- name: Set up Python
uses: actions/setup-python@v6
with:
python-version: "3.11"
- name: Set up uv
uses: astral-sh/setup-uv@v8.2.0
with:
enable-cache: true
version: "0.10.9"
- name: Sync dependencies
run: uv sync --locked --dev --all-extras
- name: Run Ruff
run: |
uv run ruff check
uv run ruff format --check
static-checks:
name: Run Static Checks
runs-on: ubuntu-latest
steps:
- name: Check out repository
uses: actions/checkout@v6
- name: Load test environment
run: cat env/test.env >> "$GITHUB_ENV"
- name: Set up Python
uses: actions/setup-python@v6
with:
python-version: "3.11"
- name: Set up uv
uses: astral-sh/setup-uv@v8.2.0
with:
enable-cache: true
version: "0.10.9"
- name: Sync dependencies
run: uv sync --locked --dev --all-extras
- name: Run Pyright
run: uv run pyright
test:
name: Run Tests (${{ matrix.dialect }})
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
include:
- dialect: sqlite
database_url: sqlite+aiosqlite:///./.drukbox-test.db
- dialect: postgres
database_url: postgresql+psycopg://postgres:postgres@127.0.0.1:55432/drukbox_test
services:
postgres:
image: postgres:17
env:
POSTGRES_DB: drukbox_test
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 55432:5432
options: >-
--health-cmd "pg_isready -U postgres -d drukbox_test"
--health-interval 5s
--health-timeout 5s
--health-retries 10
steps:
- name: Check out repository
uses: actions/checkout@v6
- name: Load test environment
run: cat env/test.env >> "$GITHUB_ENV"
- name: Select test database for matrix dialect
run: echo "TEST_DATABASE_URL=${{ matrix.database_url }}" >> "$GITHUB_ENV"
- name: Set up Python
uses: actions/setup-python@v6
with:
python-version: "3.11"
- name: Set up uv
uses: astral-sh/setup-uv@v8.2.0
with:
enable-cache: true
version: "0.10.9"
- name: Sync dependencies
run: uv sync --locked --dev --all-extras
- name: Run test suite
run: uv run pytest -v
docker-build:
name: Build Docker Image
runs-on: ubuntu-latest
steps:
- name: Check out repository
uses: actions/checkout@v6
- name: Build container image
run: docker build -t drukbox:validate .
api-tests:
name: Run API Tests (docker provider)
runs-on: ubuntu-latest
# Black-box e2e against a real deployment. The docker provider provisions
# local containers on the runner, so this needs no cloud credentials.
env:
DATABASE_URL: sqlite+aiosqlite:////tmp/drukbox.db
SECRETS_KEY: MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA=
SERVICE_TOKENS: ci-token
DEFAULT_HOST_PROVIDER: docker
# The sandbox reaches the secrets exchange on the Docker bridge; the API test only checks delivery.
SECRETS_EXCHANGE_URL: http://172.17.0.1:8080
DOCKER_DEFAULT_IMAGE: drukbox/sandbox:ci
UVICORN_HOST: 127.0.0.1
steps:
- name: Check out repository
uses: actions/checkout@v6
- name: Build sandbox image
run: docker build -t drukbox/sandbox:ci images/local/
- name: Build drukbox image
run: docker build -t drukbox:api-test .
- name: Start drukbox
run: |
docker run --name drukbox-api-test --detach \
--network host \
--mount type=bind,src=/var/run/docker.sock,dst=/var/run/docker.sock \
--group-add "$(stat -c '%g' /var/run/docker.sock)" \
--env DATABASE_URL \
--env SECRETS_KEY \
--env SERVICE_TOKENS \
--env DEFAULT_HOST_PROVIDER \
--env SECRETS_EXCHANGE_URL \
--env DOCKER_DEFAULT_IMAGE \
--env UVICORN_HOST \
drukbox:api-test \
/bin/sh -c '.venv/bin/alembic upgrade head && exec .venv/bin/uvicorn api.app:app --port 8780'
for _ in $(seq 1 60); do
curl -fsS http://127.0.0.1:8780/healthz >/dev/null 2>&1 && exit 0
sleep 1
done
echo "drukbox failed to start" >&2
docker logs drukbox-api-test
exit 1
- name: Set up Node
uses: actions/setup-node@v6
with:
node-version: "20"
- name: Install API test dependencies
run: npm --prefix api-tests ci
- name: Run API tests
run: npm --prefix api-tests test
env:
SERVICE_URL: http://127.0.0.1:8780
SERVICE_TOKEN: ci-token
- name: Verify sandbox cleanup
run: |
remaining="$(docker ps -aq --filter label=managed-by=drukbox)"
if [ -n "$remaining" ]; then
docker ps -a --filter label=managed-by=drukbox
exit 1
fi
- name: Dump drukbox log on failure
if: failure()
run: docker logs drukbox-api-test || true
- name: Remove drukbox container
if: always()
run: docker rm -f drukbox-api-test || true