85 lines
3.0 KiB
YAML
85 lines
3.0 KiB
YAML
name: CI/CD
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
# ---------------------------------------------------------------------
|
|
# 1. Unit tests — moeten slagen voordat er iets gebouwd wordt
|
|
# ---------------------------------------------------------------------
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
- name: Installeer dependencies
|
|
run: pip install -r requirements.txt
|
|
- name: Lint (ruff)
|
|
run: ruff check .
|
|
- name: Unit tests (pytest)
|
|
run: pytest tests/ -v
|
|
|
|
# ---------------------------------------------------------------------
|
|
# 2. SonarQube — codekwaliteit-gate
|
|
# ---------------------------------------------------------------------
|
|
sonarqube:
|
|
runs-on: ubuntu-latest
|
|
needs: test
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0 # SonarQube wil de volledige git-historie zien
|
|
- name: SonarQube scan
|
|
uses: sonarsource/sonarqube-scan-action@v4
|
|
env:
|
|
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
|
|
SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }}
|
|
|
|
# ---------------------------------------------------------------------
|
|
# 3. Image bouwen + Trivy security-scan + naar Gitea-registry pushen
|
|
# ---------------------------------------------------------------------
|
|
build-and-scan:
|
|
runs-on: ubuntu-latest
|
|
needs: [test, sonarqube]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Build Docker image
|
|
run: docker build -t gitea.thuis.local/willem/glucose-dashboard:${{ gitea.sha }} .
|
|
|
|
- name: Trivy scan
|
|
uses: aquasecurity/trivy-action@master
|
|
with:
|
|
image-ref: gitea.thuis.local/willem/glucose-dashboard:${{ gitea.sha }}
|
|
severity: CRITICAL,HIGH
|
|
exit-code: "1" # laat de pipeline falen bij kritieke kwetsbaarheden
|
|
|
|
- name: Login bij Gitea-registry
|
|
run: echo "${{ secrets.GITEA_TOKEN }}" | docker login gitea.thuis.local -u willem --password-stdin
|
|
|
|
- name: Tag en push
|
|
run: |
|
|
docker tag gitea.thuis.local/willem/glucose-dashboard:${{ gitea.sha }} gitea.thuis.local/willem/glucose-dashboard:latest
|
|
docker push gitea.thuis.local/willem/glucose-dashboard:${{ gitea.sha }}
|
|
docker push gitea.thuis.local/willem/glucose-dashboard:latest
|
|
|
|
# ---------------------------------------------------------------------
|
|
# 4. Deploy — SSH naar de LXC en herstart met de nieuwe image
|
|
# ---------------------------------------------------------------------
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
needs: build-and-scan
|
|
steps:
|
|
- name: Deploy via SSH
|
|
uses: appleboy/ssh-action@v1
|
|
with:
|
|
host: ${{ secrets.DEPLOY_HOST }}
|
|
username: ${{ secrets.DEPLOY_USER }}
|
|
key: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
script: |
|
|
cd /opt/glucose-dashboard
|
|
docker compose pull
|
|
docker compose up -d
|