Development Conventions

repos:
  - repo: local
    hooks:
      - id: trufflehog
        name: TruffleHog
        description: Detect secrets in your data.
        entry:
          bash -c 'trufflehog git file://. --since-commit HEAD --results=verified,unknown --fail'
          # For running trufflehog in docker, use the following entry instead:
          # entry: bash -c 'docker run --rm -v "$(pwd):/workdir" -i --rm trufflesecurity/trufflehog:latest git file:///workdir --since-commit HEAD --results=verified,unknown --fail'        language: system
        stages: ["commit", "push"]
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v3.2.0
    hooks:
      - id: trailing-whitespace
      - id: end-of-file-fixer
      - id: check-yaml
      - id: check-toml
      - id: check-added-large-files
      - id: mixed-line-ending
        args: ["--fix=lf"]
      - id: pretty-format-json
        args: ["--autofix"]
  - repo: local
    hooks:
      - id: prettier
        name: Run Prettier
        entry: npx prettier --write
        language: system
        files: \.json$|\.md$|\.yaml$|\.yml$
        types: [file]
        pass_filenames: true
  - repo: https://github.com/psf/black
    rev: 24.10.0
    hooks:
      - id: black
  - repo: local
    hooks:
      - id: run-ut
        name: Run Pytest Tests with Coverage
        entry: poetry run pytest --cov=ures --cov-report=term-missing
        language: system
        types: [python]
        always_run: true
        pass_filenames: false

name: Token Secret Check

on: [push, pull_request]

jobs:
  secretCheck:
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Secret Scanning
        uses: trufflesecurity/trufflehog@main
        with:
          extra_args: --results=verified,unknown

name: Linter

on: [push, pull_request]

jobs:
  superLint:
    name: Liters
    runs-on: ubuntu-20.04
    permissions:
      contents: read
      packages: read
      # To report GitHub Actions status checks
      statuses: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          # super-linter needs the full git history to get the
          # list of files that changed across commits
          fetch-depth: 0

      - name: Configure 1Password Service Account
        uses: 1password/load-secrets-action/configure@v2
        with:
          # Persist the 1Password Service Account Authorization token
          # for next steps.
          # Keep in mind that every single step in the job is now
          # able to access the token.
          service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}

      - name: Load Docker credentials
        id: load-docker-credentials
        uses: 1password/load-secrets-action@v2
        with:
          export-env: false
        env:
          GITHUB_TOKEN: "op://DevOps/Git PAT - StoneHome - Action/credential"

      - name: Super-linter
        uses: super-linter/super-linter/slim@v7.2.1 # x-release-please-version
        env:
          # To report GitHub Actions status checks
          GITHUB_TOKEN: ${{ steps.load-docker-credentials.outputs.GITHUB_TOKEN }}
          VALIDATE_YAML: true
          VALIDATE_PYTHON_BLACK: true
          VALIDATE_JUPYTER_NBQA_BLACK: true
          VALIDATE_JSON: true
          VALIDATE_JSON_PRETTIER: true
          VALIDATE_GITLEAKS: true
          VALIDATE_ENV: true
          VALIDATE_DOCKERFILE_HADOLINT: true
          VALIDATE_GIT_COMMITLINT: true
          VALIDATE_GIT_MERGE_CONFLICT_MARKERS: true

name: Code Testing

on: [push, pull_request]

jobs:
  ut:
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        python-version: [3.11, 3.12] # Specify the Python versions you want to test against
        poetry-version: ["1.8.5"]
    steps:
      # 1. Checkout the repository
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      # 2. Set up Python environment
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
      # 3. Run poetry image
      - name: Install poetry
        uses: abatilo/actions-poetry@v2
        with:
          poetry-version: ${{ matrix.poetry-version }}
      # 4. Setup a local virtual environment (if no poetry.toml file)
      - name: Setup a local virtual environment (if no poetry.toml file)
        run: |
          poetry config virtualenvs.create true --local
          poetry config virtualenvs.in-project true --local
      # 5. Cache the virtual environment based on the dependencies lock file
      - uses: actions/cache@v3
        name: Define a cache for the virtual environment based on the dependencies lock file
        with:
          path: ./.venv
          key: venv-${{ hashFiles('poetry.lock') }}
      # 6. Install dependencies
      - name: Install the project dependencies
        run: poetry install --with test
      # 7. Run the tests
      - name: Run the tests
        run: poetry run pytest -v

name: Release
on: workflow_dispatch
permissions:
  contents: read # for checkout
jobs:
  release:
    permissions:
      contents: write # to be able to publish a GitHub release
      issues: write # to be able to comment on released issues
      pull-requests: write # to be able to comment on released pull requests
    name: release
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
      - uses: actions/setup-node@v4
        with:
          node-version: 18
      - name: Configure 1Password Service Account
        uses: 1password/load-secrets-action/configure@v2
        with:
      - name: Load GitHub credentials
        id: load-credentials
        uses: 1password/load-secrets-action@v2
        with:
          export-env: false
        env:
          GITHUB_TOKEN: "op://DevOps/Git PAT - StoneHome - Action/credential"
      - run: npx semantic-release@21.0.2
        env:
          GITHUB_TOKEN: ${{ steps.load-credentials.outputs.GITHUB_TOKEN }}

name: Release Blog

on:
  release:
    types: [published, edited]

jobs:
  post-release:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Fetch release information
        id: release
        run: |
          echo "RELEASE_SUBJECT=${{ github.event.release.name }}" >> $GITHUB_ENV
          echo "RELEASE_BODY<<EOF" >> $GITHUB_ENV
          echo "${{ github.event.release.body }}" >> $GITHUB_ENV
          echo "EOF" >> $GITHUB_ENV
          echo "RELEASE_URL=${{ github.event.release.html_url }}" >> $GITHUB_ENV

      - name: Configure 1Password Service Account
        uses: 1password/load-secrets-action/configure@v2
        with:
          service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}

      - name: Load Docker credentials
        id: load-credentials
        uses: 1password/load-secrets-action@v2
        with:
          export-env: true
        env:
          GITHUB_TOKEN: "op://DevOps/Git PAT - Personal - GitHub Action/credential"

      - name: Checkout target repository
        uses: actions/checkout@v4
        with:
          repository: stonebo/stone-journey.github.io
          token: ${{ env.GITHUB_TOKEN }}
          path: hugo_blog
          ref: trunk

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: "3.12"

      - name: Install poetry
        uses: abatilo/actions-poetry@v2
        with:
          poetry-version: "1.8.5"

      - name: Setup a local virtual environment (if no poetry.toml file)
        run: |
          poetry config virtualenvs.create true --local
          poetry config virtualenvs.in-project true --local

      - name: Install dependency and generate new file
        run: |
          export PYTHONPATH="${PYTHONPATH}:${{ github.workspace }}"
          python -m pip install --upgrade pip
          poetry install
          poetry run python .github/scripts/release_blog.py -p "URes" -v "${{ env.RELEASE_SUBJECT }}" -n "${{ env.RELEASE_BODY }}" -u "${{ env.RELEASE_URL }}" -o "hugo_blog"

      - name: Commit changes
        run: |
          cd hugo_blog
          git config --global user.email "github@stone-bo.com"
          git config --global user.name "Post Release Bot"
          git add ./content/posts/project
          git commit -m "docs(project): add new blog for ${{ env.RELEASE_SUBJECT }} of ures"
          git push
        env:
          GITHUB_TOKEN: ${{ env.GITHUB_TOKEN }}

name: Poetry Publish

on:
  release:
    types: [published]

jobs:
  publish:
    runs-on: ubuntu-24.04
    steps:
      # 1. Checkout the repository
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      # 2. Set up Python environment
      - name: Set up Python ${{ inputs.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ inputs.python-version }}
      # 3. Run poetry image
      - name: Install poetry
        uses: abatilo/actions-poetry@v2
        with:
          poetry-version: ${{ inputs.poetry-version }}
      # 4. Setup a local virtual environment (if no poetry.toml file)
      - name: Setup a local virtual environment (if no poetry.toml file)
        run: |
          poetry config virtualenvs.create true --local
          poetry config virtualenvs.in-project true --local
      # 5. Cache the virtual environment based on the dependencies lock file
      - uses: actions/cache@v3
        name: Define a cache for the virtual environment based on the dependencies lock file
        with:
          path: ./.venv
          key: venv-${{ hashFiles('poetry.lock') }}
      # 6. load Secrets from 1password
      - name: Configure 1Password Service Account
        uses: 1password/load-secrets-action/configure@v2
        with:
          service-account-token: ${{ secrets.onepass_token }}
      - name: Load Docker credentials
        id: load-docker-credentials
        uses: 1password/load-secrets-action@v2
        with:
          export-env: true
        env:
          GITHUB_TOKEN: "op://DevOps/Git PAT - StoneHome - Action/credential"
          PYPI_TOKEN: "op://DevOps/PyPi Token/credential"

	  # 7. create a branch
	  - name: Create Release Branch
        shell: bash
        run: |
          BRANCH_NAME="versions/${{ inputs.version-id }}"
          git config user.name "Publish Action"
          git config user.email "github@stone-bo.com"
          git checkout -b "$BRANCH_NAME"
          git push --set-upstream origin "$BRANCH_NAME"
          echo "Created branch: $BRANCH_NAME"
      # 8. Update version in pyproject.toml to match the tag version
      - name: Update version in pyproject.toml
        shell: bash
        run: |
          NEW_VERSION=$(echo ${{ inputs.version-id }} | sed 's/^v//') # Remove 'v' prefix if it exists
          poetry version "$NEW_VERSION"
          git add pyproject.toml
          git commit -m "chore(poetry): bumping the version to ${{ inputs.version-id }}"
          git push
      # 9. Build package
      - name: Build package
        run: poetry build
      # 10. Publish the package
      - name: Publish package to PyPI
        run: poetry publish -u __token__ -p ${{ env.PYPI_TOKEN }}