github-actions.yml

name: GitHub Actions

on:
  push:
    branches:
      - master
  pull_request:

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest

    steps:
      - name: Checkout 🛎️
        uses: actions/checkout@v3

      - name: Setup Python 🐍
        id: setup-python
        uses: actions/setup-python@v4
        with:
          python-version-file: ".python-version"

      - name: Install Poetry 📦
        uses: snok/install-poetry@v1.3.3
        with:
          virtualenvs-create: true
          virtualenvs-in-project: true

      - name: Cache virtual environment 💾
        uses: actions/cache@v3
        with:
          path: .venv
          key: ${{ runner.os }}-venv-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('**/poetry.lock') }}
          restore-keys: |
            ${{ runner.os }}-venv-${{ steps.setup-python.outputs.python-version }}-

      - name: Install dependencies ⚙️
        run: poetry install --no-interaction

      - name: Run Tests 🧪
        run: |
          source .venv/bin/activate
          pybabel compile -D pdf_bot -d locale
          pytest --cov --cov-report=xml

      - name: Run SonarCloud scan ☁️
        uses: sonarsource/sonarcloud-github-action@v1.8
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  lint:
    name: Lint
    runs-on: ubuntu-latest

    steps:
      - name: Checkout 🛎️
        uses: actions/checkout@v3

      - name: Setup Python 🐍
        id: setup-python
        uses: actions/setup-python@v4
        with:
          python-version-file: ".python-version"

      - name: Install Poetry 📦
        uses: snok/install-poetry@v1.3.3
        with:
          virtualenvs-create: true
          virtualenvs-in-project: true

      - name: Cache virtual environment 💾
        uses: actions/cache@v3
        with:
          path: .venv
          key: ${{ runner.os }}-venv-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('**/poetry.lock') }}
          restore-keys: |
            ${{ runner.os }}-venv-${{ steps.setup-python.outputs.python-version }}-

      - name: Install dependencies ⚙️
        run: poetry install --no-interaction --no-root

      - name: Run linting 🧪
        run: |
          source .venv/bin/activate
          pre-commit run --all-files

  snyk-scan:
    name: Snyk scan
    runs-on: ubuntu-latest

    steps:
      - name: Checkout 🛎️
        uses: actions/checkout@v3

      - name: Setup Snyk 🐕
        uses: snyk/actions/setup@master

      - name: Setup Python 🐍
        id: setup-python
        uses: actions/setup-python@v4
        with:
          python-version-file: ".python-version"

      - name: Install Poetry 📦
        uses: snok/install-poetry@v1.3.3
        with:
          virtualenvs-create: true
          virtualenvs-in-project: true

      - name: Cache virtual environment 💾
        uses: actions/cache@v3
        with:
          path: .venv
          key: ${{ runner.os }}-venv-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('**/poetry.lock') }}
          restore-keys: |
            ${{ runner.os }}-venv-${{ steps.setup-python.outputs.python-version }}-

      - name: Install dependencies ⚙️
        run: poetry install --no-root --no-interaction

      - name: Run Snyk scan 🛡️
        continue-on-error: true # To make sure that SARIF upload gets called
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run: snyk test --sarif-file-output=snyk.sarif

      - name: Upload Snyk results 📡
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: snyk.sarif

      - name: Run Snyk monitor 🖥️
        if: ${{ github.ref == 'refs/heads/master' }}
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run: snyk monitor

  git-guardian-scan:
    name: GitGuardian scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout 🛎️
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Run GitGuardian scan 🤐
        uses: GitGuardian/ggshield-action@master
        env:
          GITHUB_PUSH_BEFORE_SHA: ${{ github.event.before }}
          GITHUB_PUSH_BASE_SHA: ${{ github.event.base }}
          GITHUB_PULL_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          GITHUB_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}

  build-deploy:
    name: Build and deploy
    runs-on: ubuntu-latest
    needs: [test, lint, snyk-scan, git-guardian-scan]
    if: ${{ github.ref == 'refs/heads/master' }}
    concurrency: production
    environment:
      name: Production
    env:
      DOCKER_IMAGE: registry.digitalocean.com/${{ secrets.DIGITALOCEAN_REGISTRY }}/${{ secrets.DIGITALOCEAN_APP_NAME }}:${{ github.sha }}

    steps:
      - name: Checkout 🛎️
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
          ref: master
          token: ${{ secrets.PAT }}

      - name: Setup Python 🐍
        id: setup-python
        uses: actions/setup-python@v4
        with:
          python-version-file: ".python-version"

      - name: Install Poetry 📦
        uses: snok/install-poetry@v1.3.3
        with:
          virtualenvs-create: true
          virtualenvs-in-project: true

      - name: Cache virtual environment 💾
        uses: actions/cache@v3
        with:
          path: .venv
          key: ${{ runner.os }}-venv-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('**/poetry.lock') }}
          restore-keys: |
            ${{ runner.os }}-venv-${{ steps.setup-python.outputs.python-version }}-

      - name: Install dependencies ⚙️
        run: poetry install --no-interaction --no-root

      - name: Update localization source file 📄
        run: |
          source .venv/bin/activate
          pybabel extract pdf_bot/ -o locale/pdf_bot.pot
          pybabel update -l locale -i locale/pdf_bot.pot -o locale/en_GB/LC_MESSAGES/pdf_bot.po
          echo NUM_DIFFS=$(git diff --shortstat | egrep -o '[0-9]+ i' | egrep -o '[0-9]+') >> $GITHUB_ENV

      - name: Commit changes 🆕
        if: env.NUM_DIFFS > 1
        uses: stefanzweifel/git-auto-commit-action@v4.16.0
        with:
          commit_message: "ci: update localization source file [skip ci]"
          file_pattern: locale/en_GB/LC_MESSAGES/pdf_bot.po
          push_options: --force

      - name: Upload sources and download translations 🌐
        if: env.NUM_DIFFS > 1
        uses: crowdin/github-action@v1.6.0
        with:
          upload_sources: true
          upload_translations: false
          download_translations: true
          commit_message: "feat: update translations with latest changes [skip ci]"
          create_pull_request: false
          localization_branch_name: master
          config: ./crowdin.yml
          source: locale/en_GB/LC_MESSAGES/pdf_bot.po
          translation: /locale/%locale_with_underscore%/LC_MESSAGES/pdf_bot.po
        env:
          GITHUB_TOKEN: ${{ secrets.PAT }}
          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}

      - name: Install doctl 🌊
        uses: digitalocean/action-doctl@v2.3.0
        with:
          token: ${{ secrets.DIGITALOCEAN_TOKEN }}

      - name: Authenticate to DigitalOcean 🔐
        run: doctl registry login --expiry-seconds 600

      - name: Build and push image 🏗
        run: |-
          docker build -t ${{ env.DOCKER_IMAGE }} --build-arg COMMIT_HASH=${{ github.sha }} .
          docker push ${{ env.DOCKER_IMAGE }}

      - name: Deploy 🚀
        uses: digitalocean/app_action@v1.1.4
        with:
          app_name: ${{ secrets.DIGITALOCEAN_APP_NAME }}
          token: ${{ secrets.DIGITALOCEAN_TOKEN }}
          images: '[
            {
            "name": "${{ secrets.DIGITALOCEAN_APP_NAME }}",
            "image": {
            "registry_type": "DOCR",
            "repository": "${{ secrets.DIGITALOCEAN_APP_NAME }}",
            "tag": "${{ github.sha }}"
            }
            }
            ]'