code-quality.yml

name: code-quality

on:
  push:
    branches:
      - main
      - develop
    tags:
      - '*'
  pull_request:
  workflow_dispatch:

jobs:
  isort:
    name: Check import sorting
    runs-on: ubuntu-latest

    steps:
      - name: Install libxml
        run: |
          sudo apt-get update
          sudo apt-get install -y libxml2-dev libxmlsec1-dev libxmlsec1-openssl
      - uses: actions/checkout@v2
        with:
          submodules: 'true'
      - uses: actions/setup-python@v2
        with:
          python-version: '3.11'
      - uses: isort/isort-action@v0.1.0
        with:
          requirementsFiles: requirements/dev.txt
          sortPaths: 'src'
          configuration: '--check-only --diff'

  black:
    name: Check code formatting with black
    runs-on: ubuntu-latest

    steps:
      - name: Install libxml
        run: |
          sudo apt-get update
          sudo apt-get install -y libxml2-dev libxmlsec1-dev libxmlsec1-openssl
      - uses: actions/checkout@v2
        with:
          submodules: 'true'
      - uses: actions/setup-python@v2
        with:
          python-version: '3.11'
      - name: Install dependencies
        run: |
          pip install -r requirements/dev.txt
      - name: Run black
        run: |
          black --check --diff src

  flake8:
    name: Code style (flake8)
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v3
      - name: Set up backend environment
        uses: maykinmedia/setup-django-backend@v1
        with:
          apt-packages: 'libxml2-dev libxmlsec1-dev libxmlsec1-openssl gdal-bin'
          python-version: '3.11'
          setup-node: 'no'
      - name: Run flake8
        id: flake8
        run: |
          flake8 src 2>&1 | tee flake8_output.txt
          result_code=${PIPESTATUS[0]}
          report="$(cat flake8_output.txt)"
          report="${report//$'\n'/'%0A'}"  # escape newlines
          echo "flake8_output=${report}" >> $GITHUB_OUTPUT
          exit $result_code
      - name: Emit flake8 flake8 output
        if: ${{ failure() }}
        run: |
          echo "${{ steps.flake8.outputs.flake8_output }}"

          echo 'flake8 found some issues' >> $GITHUB_STEP_SUMMARY
          echo '' >> $GITHUB_STEP_SUMMARY
          echo '| File | Line | Column | Issue |' >> $GITHUB_STEP_SUMMARY
          echo '| :--- | ---- | ------ | :---- |' >> $GITHUB_STEP_SUMMARY
          python ./bin/flake8_summary.py "${{ steps.flake8.outputs.flake8_output }}" >> $GITHUB_STEP_SUMMARY

  migrations:
    name: Check for model changes not present in the migrations
    runs-on: ubuntu-latest

    services:
      postgres:
        image: postgres:12
        env:
          POSTGRES_HOST_AUTH_METHOD: trust
        ports:
          - 5432:5432
        # Needed because the postgres container does not provide a healthcheck
        options:
          --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5

    steps:
      - uses: actions/checkout@v3
        with:
          submodules: 'true'
      - uses: actions/setup-python@v4
        with:
          python-version: '3.11'
      - name: Install system packages
        run: |
          sudo apt-get update \
          && sudo apt-get install -y --no-install-recommends \
            libgdal-dev \
            gdal-bin
      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libxml2-dev libxmlsec1-dev libxmlsec1-openssl
          pip install -r requirements/dev.txt
      - name: Run manage.py makemigrations --check --dry-run
        run: |
          src/manage.py makemigrations --check --dry-run
        env:
          DJANGO_SETTINGS_MODULE: open_inwoner.conf.dev
          SECRET_KEY: dummy
          DB_USER: postgres
          DB_PASSWORD: ''

  prettier:
    name: Check code formatting with prettier
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v2
        with:
          submodules: 'true'
      - name: Install dependencies
        run: |
          npm install --legacy-peer-deps
      - name: Run Prettier
        run: |
          npm run check-linting
  bandit:
    name: Python security check using Bandit
    runs-on: ubuntu-latest

    steps:
      - name: Install libxml
        run: |
          sudo apt-get update
          sudo apt-get install -y libxml2-dev libxmlsec1-dev libxmlsec1-openssl
      - uses: actions/checkout@v2
        with:
          submodules: 'true'
      - uses: actions/setup-python@v2
        with:
          python-version: '3.11'
      - name: Install dependencies
        run: |
          pip install -r requirements/dev.txt
      - name: Run Bandit
        run: |
          bandit -r ./src/ -x tests,conf/utils.py -s B101