diff --git a/.github/workflows/integration_testing.yml b/.github/workflows/integration_testing.yml index 14e808a2..27d9f203 100644 --- a/.github/workflows/integration_testing.yml +++ b/.github/workflows/integration_testing.yml @@ -1,6 +1,8 @@ -# This workflow will install Python dependencies, run tests and lint with a single version of Python +# This workflow pulls the published seCureLI packages from Pypi & Homebrew & executes them against a test repo # For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python +# TODO we should rename these to smoke tests but I'd rather hold off on doing that for now +# since renaming the workflow/action might cause us to lose history for executions under the old name name: Integration Testing on: @@ -17,16 +19,23 @@ jobs: python-version: '3.10' - name: Install seCureLI + # Note that this is a powershell script run: | - pip3 --version #any pip havers? + pip3 --version pip3 install secureli git clone https://github.com/pypa/pip pip cd pip secureli init --yes - secureli scan --mode all-files --yes + + - name: seCureLI Scan + run: | + cd pip + $ErrorActionPreference = 'SilentlyContinue' + secureli scan --mode all-files --yes + $LastExitCode = 0 # Force exit code to 0 to avoid failing the build since scan returns nonzero exit status - test-homebrew-osx: + test-homebrew-macos: runs-on: macos-latest steps: - name: Test with Homebrew @@ -60,14 +69,25 @@ jobs: run: cd pip && secureli init --yes && secureli scan - test-pypi-osx: + test-pypi-macos: runs-on: macos-latest steps: - - name: Test with Pypi + # This step is needed to keep us on python 3.11 for now, since dependency-injector doesn't yet support python 3.12. + # It can be removed once this PR is merged: https://github.com/ets-labs/python-dependency-injector/pull/765 + - name: Install Python 3.11 + id: setup-python + uses: actions/setup-python@v4 + with: + python-version: "3.11" + - name: Install seCureLI from Pypi run: | - pip3 --version #what do we have on the macos image + pip3 --version # Validate python/pip version pip3 install secureli + - name: Scan repo with Pypi seCureLI package + run: | git clone https://github.com/pypa/pip pip cd pip secureli init --yes - secureli scan --mode all-files --yes + # In the future, we should use specific exit codes to differentiate between exit reasons + # For now, we can just check if the command exits with a non-zero status + ! secureli scan --mode all-files --yes diff --git a/pyproject.toml b/pyproject.toml index eab4c937..54632dc7 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -29,6 +29,9 @@ e2e = "bats tests/end-to-end/test.bats" python = "^3.9" typer = {version = ">=0.6.1,<0.10.0", extras = ["all"]} pygments = "^2.13.0" +# Uncomment the following line to enable python 3.12 support prior to dependency-injector officially supporting it +# Remove once this PR is merged: https://github.com/ets-labs/python-dependency-injector/pull/765 +# dependency-injector = { git = "https://github.com/ets-labs/python-dependency-injector.git", branch = "feature/python-3.12" , extras = ["yaml"]} dependency-injector = {version = "^4.40.0", extras = ["yaml"]} pydantic = "^1.10.2" jinja2 = "^3.1.2" diff --git a/secureli/actions/scan.py b/secureli/actions/scan.py index 2553c9c9..1e4561ed 100644 --- a/secureli/actions/scan.py +++ b/secureli/actions/scan.py @@ -11,6 +11,7 @@ ActionDependencies, VerifyResult, ) +from secureli.models.exit_codes import ExitCode from secureli.models.publish_results import PublishResultsOption from secureli.models.result import Result from secureli.services.logging import LoggingService, LogAction @@ -159,4 +160,4 @@ def scan_repo( if scan_result.successful: self.echo.print("Scan executed successfully and detected no issues!") else: - sys.exit(1) + sys.exit(ExitCode.SCAN_ISSUES_DETECTED.value) diff --git a/secureli/actions/update.py b/secureli/actions/update.py index ea2d99ca..b1227e82 100644 --- a/secureli/actions/update.py +++ b/secureli/actions/update.py @@ -21,7 +21,7 @@ def __init__( def update_hooks(self, folder_path: Path, latest: Optional[bool] = False): """ - Installs the hooks defined in pre-commit-config.yml. + Installs the hooks defined in .pre-commit-config.yml. :param latest: Indicates whether you want to update to the latest versions of the installed hooks. :param folder_path: Indicates the git folder against which you run secureli diff --git a/secureli/models/exit_codes.py b/secureli/models/exit_codes.py new file mode 100644 index 00000000..ea797bc3 --- /dev/null +++ b/secureli/models/exit_codes.py @@ -0,0 +1,5 @@ +from enum import Enum + + +class ExitCode(Enum): + SCAN_ISSUES_DETECTED = 3