Skip to content

Commit 6d622f7

Browse files
helmut-hoffer-von-ankershoffenhelmut-hoffer-von-ankershoffen
committed
chore: codeql, attributions, oe
1 parent d7e7d2e commit 6d622f7

16 files changed

+2793
-2537
lines changed

‎.copier-answers.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ attestations_enabled: false
44
author_email: helmut@aignostics.com
55
author_github_username: helmut-hoffer-von-ankershoffen
66
author_name: Helmut Hoffer von Ankershoffen
7-
codeql_enabled: false
7+
codeql_enabled: true
88
docker_io_enabled: true
99
docker_io_image_name: aignostics-python-sdk
1010
docker_io_owner: helmuthva

‎.github/workflows/_codeql.yml

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
name: "CodeQL Analysis"
2+
3+
on:
4+
workflow_call:
5+
# No inputs needed at this time
6+
7+
jobs:
8+
analyze:
9+
name: Analyze (${{ matrix.language }})
10+
# Runner size impacts CodeQL analysis time. To learn more, please see:
11+
# - https://gh.io/recommended-hardware-resources-for-running-codeql
12+
# - https://gh.io/supported-runners-and-hardware-resources
13+
# - https://gh.io/using-larger-runners (GitHub.com only)
14+
runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
15+
permissions:
16+
# only required for workflows in private repositories
17+
actions: read
18+
# Obvious
19+
contents: read
20+
# required to fetch internal or private CodeQL packs
21+
packages: read
22+
# required for all workflows
23+
security-events: write
24+
25+
strategy:
26+
fail-fast: false
27+
matrix:
28+
include:
29+
- language: actions
30+
build-mode: none
31+
- language: python
32+
build-mode: none
33+
# CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift'
34+
# Use `c-cpp` to analyze code written in C, C++ or both
35+
# Use 'java-kotlin' to analyze code written in Java, Kotlin or both
36+
# Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
37+
# To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
38+
# see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
39+
# If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
40+
# your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
41+
steps:
42+
- name: Checkout repository
43+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
44+
45+
# Add any setup steps before running the `github/codeql-action/init` action.
46+
# This includes steps like installing compilers or runtimes (`actions/setup-node`
47+
# or others). This is typically only required for manual builds.
48+
# - name: Setup runtime (example)
49+
# uses: actions/setup-example@v1
50+
51+
# Initializes the CodeQL tools for scanning.
52+
- name: Initialize CodeQL
53+
uses: github/codeql-action/init@v3
54+
with:
55+
languages: ${{ matrix.language }}
56+
# If you wish to specify custom queries, you can do so here or in a config file.
57+
# By default, queries listed here will override any specified in a config file.
58+
# Prefix the list here with "+" to use these queries and those in the config file.
59+
60+
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
61+
# queries: security-extended,security-and-quality
62+
63+
# For languages that support build scanning, you can specify any build command you
64+
# want to run before the scan, and can configure the location of your project with
65+
# the location.
66+
# See
67+
# https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
68+
# for more details on the languages that support build scanning.
69+
# build-mode: ${{ matrix.build-mode }}
70+
# location: ${{ matrix.location }}
71+
72+
# You can manually run scan-python for more control.
73+
# - name: Manual Build (example)
74+
# run: |
75+
# pip install -e .
76+
77+
# Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
78+
# If this step fails, then you should remove it and run the build manually
79+
- name: Autobuild
80+
uses: github/codeql-action/autobuild@v3
81+
82+
- name: Perform CodeQL Analysis
83+
uses: github/codeql-action/analyze@v3
84+
with:
85+
category: "/language:${{ matrix.language }}"

‎.github/workflows/ci-cd.yml

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -43,12 +43,20 @@ jobs:
4343
secrets: inherit
4444

4545

46-
46+
codeql:
47+
if: (!contains(github.event.head_commit.message, '[skip ci]'))
48+
uses: ./.github/workflows/_codeql.yml
49+
permissions:
50+
actions: read
51+
contents: read
52+
packages: read
53+
security-events: write
54+
secrets: inherit
4755

4856

4957
package_publish:
5058

51-
needs: [lint, audit, test]
59+
needs: [lint, audit, test, codeql]
5260

5361
uses: ./.github/workflows/_package-publish.yml
5462
if: (startsWith(github.ref, 'refs/tags/v') && (!contains(github.event.head_commit.message, '[skip ci]')))
@@ -59,7 +67,7 @@ jobs:
5967

6068
docker_publish:
6169

62-
needs: [lint, audit, test]
70+
needs: [lint, audit, test, codeql]
6371

6472
if: (startsWith(github.ref, 'refs/tags/v') && (!contains(github.event.head_commit.message, '[skip ci]')))
6573
uses: ./.github/workflows/_docker-publish.yml

‎.github/workflows/codeql-scheduled.yml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
name: "Scheduled CodeQL"
2+
3+
on:
4+
schedule:
5+
- cron: "22 3 * * 2" # Every Tuesday at 3:22 AM
6+
7+
jobs:
8+
codeql:
9+
uses: ./.github/workflows/_codeql.yml
10+
permissions:
11+
actions: read
12+
contents: read
13+
packages: read
14+
security-events: write
15+
secrets: inherit

‎ATTRIBUTIONS.md

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,73 @@
44

55
This project includes code from the following third-party open source projects:
66

7+
8+
9+
## oe-python-template (0.17.10) - MIT License
10+
11+
🧠 Copier template to scaffold Python projects compliant with best practices and modern tooling.
12+
13+
* URL: https://github.com/helmut-hoffer-von-ankershoffen/oe-python-template
14+
* Author(s): Helmut Hoffer von Ankershoffen <helmuthva@gmail.com>
15+
16+
### License Text
17+
18+
```
19+
MIT License
20+
21+
Copyright (c) 2023 Imaging Data Commons
22+
23+
Permission is hereby granted, free of charge, to any person obtaining a copy of
24+
this software and associated documentation files (the "Software"), to deal in
25+
the Software without restriction, including without limitation the rights to
26+
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
27+
of the Software, and to permit persons to whom the Software is furnished to do
28+
so, subject to the following conditions:
29+
30+
The above copyright notice and this permission notice shall be included in all
31+
copies or substantial portions of the Software.
32+
33+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
34+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
35+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
36+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
37+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
38+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
39+
SOFTWARE.
40+
```
41+
42+
## idc-index (0.9.0) - MIT License
43+
44+
Package to query and download data from an index of ImagingDataCommons.
45+
46+
* URL: https://github.com/ImagingDataCommons/idc-index
47+
* Author(s): Andrey Fedorov <andrey.fedorov@gmail.com>, Vamsi Thiriveedhi<vthiriveedhi@mgh.harvard.edu>
48+
49+
### License Text
50+
51+
```
52+
MIT License
53+
54+
Copyright (c) 2023 Imaging Data Commons
55+
56+
Permission is hereby granted, free of charge, to any person obtaining a copy of
57+
this software and associated documentation files (the "Software"), to deal in
58+
the Software without restriction, including without limitation the rights to
59+
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
60+
of the Software, and to permit persons to whom the Software is furnished to do
61+
so, subject to the following conditions:
62+
63+
The above copyright notice and this permission notice shall be included in all
64+
copies or substantial portions of the Software.
65+
66+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
67+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
68+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
69+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
70+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
71+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
72+
SOFTWARE.
73+
```
774
## CacheControl (0.14.2) - Apache Software License
875

976
httplib2 caching for requests

‎CLI_REFERENCE.md

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ $ aignostics [OPTIONS] COMMAND [ARGS]...
1414
* `--show-completion`: Show completion for the current shell, to copy it or customize the installation.
1515
* `--help`: Show this message and exit.
1616

17-
🔬 Aignostics Python SDK v0.0.10 - built with love in Berlin 🐻
17+
🔬 Aignostics Python SDK v0.1.16 - built with love in Berlin 🐻
1818

1919
**Commands**:
2020

@@ -203,7 +203,7 @@ $ aignostics application run upload [OPTIONS] APPLICATION_VERSION_ID METADATA_CS
203203

204204
**Options**:
205205

206-
* `--upload-prefix TEXT`: Prefix for the upload destination. If not given will be set to current milliseconds. [default: 1747911408498.518]
206+
* `--upload-prefix TEXT`: Prefix for the upload destination. If not given will be set to current milliseconds. [default: 1747944906324.826]
207207
* `--help`: Show this message and exit.
208208

209209
#### `aignostics application run submit`
@@ -580,14 +580,14 @@ $ aignostics dataset idc query [OPTIONS] [QUERY]
580580
**Arguments**:
581581

582582
* `[QUERY]`: SQL Query to execute.See https://idc-index.readthedocs.io/en/latest/column_descriptions.html for indices and their attributes [default: SELECT
583-
SOPInstanceUID, SeriesInstanceUID, ImageType[3], instance_size, TotalPixelMatrixColumns, TotalPixelMatrixRows
584-
FROM
585-
sm_instance_index
586-
WHERE
587-
TotalPixelMatrixColumns &gt; 25000
588-
AND TotalPixelMatrixRows &gt; 25000
589-
AND ImageType[3] = &#x27;VOLUME&#x27;
590-
]
583+
SOPInstanceUID, SeriesInstanceUID, ImageType[3], instance_size, TotalPixelMatrixColumns, TotalPixelMatrixRows
584+
FROM
585+
sm_instance_index
586+
WHERE
587+
TotalPixelMatrixColumns &gt; 25000
588+
AND TotalPixelMatrixRows &gt; 25000
589+
AND ImageType[3] = &#x27;VOLUME&#x27;
590+
]
591591

592592
**Options**:
593593

‎OPERATIONAL_EXCELLENCE.md

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Operational Excellence
2+
3+
> 🧠 This project was scaffolded using the template [oe-python-template](https://github.com/helmut-hoffer-von-ankershoffen/oe-python-template) with [copier](https://copier.readthedocs.io/), thereby applying the following toolchain:
4+
5+
1. Linting with [Ruff](https://github.com/astral-sh/ruff)
6+
2. Static type checking with [mypy](https://mypy.readthedocs.io/en/stable/)
7+
3. Complete set of [pre-commit](https://pre-commit.com/) hooks including [detect-secrets](https://github.com/Yelp/detect-secrets) and [pygrep](https://github.com/pre-commit/pygrep-hooks)
8+
4. Unit and E2E testing with [pytest](https://docs.pytest.org/en/stable/) including parallel test execution
9+
5. Matrix testing in multiple environments with [nox](https://nox.thea.codes/en/stable/)
10+
6. Test coverage reported with [Codecov](https://codecov.io/) and published as release artifact
11+
7. CI/CD pipeline automated with [GitHub Actions](https://github.com/features/actions) with parallel and reusable workflows, including scheduled testing, release automation, and multiple reporting channels and formats
12+
8. CI/CD pipeline can be run locally with [act](https://github.com/nektos/act)
13+
9. Code quality and security checks with [SonarQube](https://www.sonarsource.com/products/sonarcloud) and [GitHub CodeQL](https://codeql.github.com/)
14+
10. Dependency monitoring and vulnerability scanning with [pip-audit](https://pypi.org/project/pip-audit/), [trivy](https://trivy.dev/latest/), [Renovate](https://github.com/renovatebot/renovate), and [GitHub Dependabot](https://docs.github.com/en/code-security/getting-started/dependabot-quickstart-guide)
15+
11. Error monitoring and profiling with [Sentry](https://sentry.io/) (optional)
16+
12. Logging and metrics with [Logfire](https://logfire.dev/) (optional)
17+
13. Prepared for uptime monitoring and scheduled tests with [betterstack](https://betterstack.com/) or alternatives
18+
14. Licenses of dependencies extracted with [pip-licenses](https://pypi.org/project/pip-licenses/), matched with allow list, and published as release artifacts in CSV and JSON format for further compliance checks
19+
15. Generation of attributions from extracted licenses
20+
16. Software Bill of Materials (SBOM) generated in [CycloneDX](https://cyclonedx.org/) and [SPDX](https://spdx.dev/) formats with [cyclonedx-python](https://github.com/CycloneDX/cyclonedx-python) resp. [trivy](https://trivy.dev/latest/), published as release artifacts
21+
17. Version and release management with [bump-my-version](https://callowayproject.github.io/bump-my-version/)
22+
18. Changelog and release notes generated with [git-cliff](https://git-cliff.org/)
23+
19. Documentation generated with [Sphinx](https://www.sphinx-doc.org/en/master/) including reference documentation for the library, CLI, and API
24+
20. Documentation published to [Read The Docs](https://readthedocs.org/) including generation of PDF and single page HTML versions
25+
21. Documentation including dynamic badges, setup instructions, contribution guide and security policy
26+
22. Interactive OpenAPI specification with [Swagger](https://swagger.io/)
27+
23. Python package published to [PyPI](https://pypi.org/)
28+
24. Multi-stage build of fat (all extras) and slim (no extras) multi-arch (arm64 and amd64) Docker images, running non-root within immutable container
29+
25. Docker images published to [Docker.io](https://hub.docker.com/) and [GitHub Container Registry](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry) with [artifact attestations](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds)
30+
26. One-click development environments with [Dev Containers](https://code.visualstudio.com/docs/devcontainers/containers) and [GitHub Codespaces](https://github.com/features/codespaces)
31+
27. Settings for use with [VSCode](https://code.visualstudio.com/)
32+
28. Settings and custom instructions for use with [GitHub Copilot](https://docs.github.com/en/copilot/customizing-copilot/adding-repository-custom-instructions-for-github-copilot)

‎QUALITY.md

Lines changed: 0 additions & 20 deletions
This file was deleted.

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ with
5252
and (4) providing
5353
[extensive documentation](hhttps://aignostics.readthedocs.io/en/latest/). Read
5454
more about how we achieve
55-
[quality](https://aignostics.readthedocs.io/en/latest/quality.html) and
55+
[operational excellence](https://aignostics.readthedocs.io/en/latest/operational_excellence.html) and
5656
[security](https://aignostics.readthedocs.io/en/latest/security.html).
5757

5858
## Aignostics Launchpad: Run your first AI workflow in 10 minutes from your Desktop

‎docs/partials/README_main.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ with
3434
and (4) providing
3535
[extensive documentation](hhttps://aignostics.readthedocs.io/en/latest/). Read
3636
more about how we achieve
37-
[quality](https://aignostics.readthedocs.io/en/latest/quality.html) and
37+
[operational excellence](https://aignostics.readthedocs.io/en/latest/operational_excellence.html) and
3838
[security](https://aignostics.readthedocs.io/en/latest/security.html).
3939

4040
## Aignostics Launchpad: Run your first AI workflow in 10 minutes from your Desktop

‎docs/source/index.rst

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
lib_reference
1616
api_explorer_v1
1717
api_reference_v1
18-
quality
18+
operational_excellence
1919
security
2020
license
2121
attributions

‎docs/source/operational_excellence.rst

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
.. mdinclude:: ../../OPERATIONAL_EXCELLENCE.md

‎docs/source/quality.rst

Lines changed: 0 additions & 1 deletion
This file was deleted.

0 commit comments

Comments
 (0)