oidc2fer/.github/workflows/ci-tests.yml

name: 💚 CI Tests

on:
  push:
    branches:
      - main
    tags:
      - 'v*'
  pull_request:
    branches:
      - '*'

jobs:
  lint-git:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' # Makes sense only for pull requests
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
            fetch-depth: 0
      - name: show
        run: git log
      - name: Enforce absence of print statements in code
        run: |
          ! git diff origin/${{ github.event.pull_request.base.ref }}..HEAD -- . ':(exclude).github/**' | grep "print("
      - name: Check absence of fixup commits
        run: |
          ! git log | grep 'fixup!'
      - name: Install gitlint
        run: pip install --user requests gitlint
      - name: Lint commit messages added to main
        run: ~/.local/bin/gitlint --commits origin/${{ github.event.pull_request.base.ref }}..HEAD

  check-changelog:
    runs-on: ubuntu-latest
    if: |
      contains(github.event.pull_request.labels.*.name, 'noChangeLog') == false &&
      github.event_name == 'pull_request'
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
            fetch-depth: 0
      - name: Check that the CHANGELOG has been modified in the current branch
        run: git log --name-only --pretty="" origin/${{ github.event.pull_request.base.ref }}..HEAD | grep CHANGELOG

  lint-changelog:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Check CHANGELOG max line length
        run: |
          max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
          if [ $max_line_length -ge 80 ]; then
            echo "ERROR: CHANGELOG has lines longer than 80 characters."
            exit 1
          fi

  lint-back:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: src/satosa
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Install Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: '3.14'
      - name: Install development dependencies
        run: |
          # Python's xmlsec requirement
          sudo apt-get update -y -q && sudo apt-get install -y -q xmlsec1 libxmlsec1-dev
          pip install --user .[dev]
      - name: Check code formatting with ruff
        run: ~/.local/bin/ruff format . --diff
      - name: Lint code with ruff
        run: ~/.local/bin/ruff check .
      - name: Lint code with pylint
        run: ~/.local/bin/pylint .

  test-back:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: src/satosa
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Install Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: '3.14'
      - name: Install development dependencies
        run: |
          # Python's xmlsec requirement
          sudo apt-get update -y -q && sudo apt-get install -y -q xmlsec1 libxmlsec1-dev
          pip install --user .[dev]
      - name: Run tests
        run: ~/.local/bin/pytest

  helmfile-lint:
    runs-on: ubuntu-latest
    # skip this job on forks since they won't have access to the required secrets
    if: github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request'
    container:
      image: ghcr.io/helmfile/helmfile:v1.2.0
    steps:
      -
        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
        id: app-token
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.PRIVATE_KEY }}
          owner: numerique-gouv
          repositories: secrets
      -
        name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          submodules: recursive
          token: ${{ steps.app-token.outputs.token }}
      -
        name: Install mkcert
        run: |
          apt-get update -y -q && apt-get install -y -q libnss3-tools
          curl -Ss -L -o mkcert https://github.com/FiloSottile/mkcert/releases/download/v1.4.4/mkcert-v1.4.4-linux-amd64
          chmod +x mkcert
          mv mkcert /usr/local/bin/
          TRUST_STORES=none mkcert -install
      -
        name: Helmfile lint
        env:
          SOPS_AGE_KEY: ${{ secrets.SOPS_PRIVATE }}
        run: |
          HELMFILE=src/helm/helmfile.yaml.gotmpl
          environments=$(< $HELMFILE awk -F'[ :]+' '/^  [^ ]/ {print $2} /^---/ { exit }')
          for env in $environments; do
            echo "################### $env lint ###################"
            helmfile -e $env -f "$HELMFILE" lint || exit 1
            echo -e "\n"
          done