feat(ci): add container security scanning workflow #40
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | ||
|
Check failure on line 1 in .github/workflows/prepare-poetry.yml
|
||
| # Front-Matter for GitHub Workflow | ||
| title: "Prepare Poetry Environment" | ||
| name: "prepare-poetry.yml" | ||
| description: "Sets up a Poetry environment with Google Artifact Registry authentication" | ||
| category: workflow | ||
| usage: "Called by other workflows that need a Poetry environment" | ||
| behavior: "Sets up Python, installs Poetry, configures for Assured OSS, and installs dependencies" | ||
| inputs: "GCP_SA_JSON secret for Google Artifact Registry authentication" | ||
| outputs: "python-version output variable and dev-requirements.txt file" | ||
| dependencies: "actions/setup-python, google-github-actions/auth, actions/cache" | ||
| author: "LedgerBase Team" | ||
| last_modified: "2023-11-15" | ||
| changelog: "Initial addition of front-matter metadata" | ||
| tags: [poetry, workflow, python] | ||
| --- | ||
| name: Prepare Poetry Environment | ||
| on: | ||
| workflow_call: | ||
| secrets: | ||
| GCP_SA_JSON: | ||
| description: "Service account JSON for Google Artifact Registry" | ||
| required: true | ||
| jobs: | ||
| setup: | ||
| runs-on: ubuntu-latest | ||
| outputs: | ||
| python-version: ${{ steps.setup-python.outputs.python-version }} | ||
| # Route pip/Poetry installs through Assured OSS | ||
| env: | ||
| PIP_INDEX_URL: https://_json_key_base64:${{ secrets.GCP_SA_JSON }}@us-python.pkg.dev/cloud-aoss/cloud-aoss-python/simple | ||
| PIP_EXTRA_INDEX_URL: https://pypi.org/simple | ||
| steps: | ||
| - name: Harden the runner (Audit all outbound calls) | ||
| uses: step-security/harden-runner@v2.12 | ||
| with: | ||
| egress-policy: audit | ||
| - name: Set up Python | ||
| id: setup-python | ||
| uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: "3.11" | ||
| - name: Authenticate to Google Artifact Registry | ||
| uses: google-github-actions/auth@v1 | ||
| with: | ||
| credentials_json: ${{ secrets.GCP_SA_JSON }} | ||
| - name: Install pip tooling & Poetry | ||
| shell: bash | ||
| run: | | ||
| python -m pip install --upgrade pip | ||
| pip install keyring keyrings.google-artifactregistry-auth | ||
| pip install poetry | ||
| - name: Cache Poetry Dependencies | ||
| uses: actions/cache@v4 | ||
| with: | ||
| path: | | ||
| ~/.cache/pypoetry | ||
| ~/.virtualenvs | ||
| key: ${{ runner.os }}-poetry-${{ hashFiles('**/poetry.lock') }} | ||
| restore-keys: | | ||
| ${{ runner.os }}-poetry- | ||
| - name: Configure Poetry for Assured OSS | ||
| shell: bash | ||
| run: | | ||
| poetry config repositories.assured-oss https://us-python.pkg.dev/cloud-aoss/cloud-aoss-python/simple | ||
| poetry config http-basic.assured-oss _json_key_base64 "${{ secrets.GCP_SA_JSON }}" | ||
| - name: Install Dependencies | ||
| run: | | ||
| poetry install --no-interaction | ||
| - name: Export Dev Requirements | ||
| run: | | ||
| poetry export --only dev --without-hashes --format=requirements.txt > dev-requirements.txt | ||
