[Snyk] Security upgrade tornado from 6.2 to 6.3.3 #8
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Helm | |
| on: | |
| push: | |
| branches: | |
| - 'master' | |
| - 'develop' | |
| pull_request: | |
| types: [edited, ready_for_review, opened, synchronize, reopened] | |
| paths-ignore: | |
| - 'site/**' | |
| - '**/*.md' | |
| workflow_dispatch: | |
| jobs: | |
| testing: | |
| if: | | |
| github.event.pull_request.draft == false && | |
| !startsWith(github.event.pull_request.title, '[WIP]') && | |
| !startsWith(github.event.pull_request.title, '[Dependent]') | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - name: Start minikube | |
| uses: medyagh/setup-minikube@master | |
| with: | |
| cpus: max | |
| memory: max | |
| - name: Try the cluster! | |
| run: kubectl get pods -A | |
| - name: Build images | |
| run: | | |
| export SHELL=/bin/bash | |
| eval $(minikube -p minikube docker-env) | |
| docker compose -f docker-compose.yml -f docker-compose.dev.yml build | |
| echo -n "verifying images:" | |
| docker images | |
| - uses: azure/setup-helm@v3 | |
| with: | |
| version: 'v3.9.4' | |
| - name: Deploy to minikube | |
| run: | | |
| printf "traefik:\n service:\n externalIPs:\n - $(minikube ip)\n" >> tests/values.test.yaml | |
| cd helm-chart | |
| helm dependency update | |
| cd .. | |
| helm upgrade -n default release-${{ github.run_id }}-${{ github.run_attempt }} -i --create-namespace helm-chart -f helm-chart/values.yaml -f tests/values.test.yaml | |
| - name: Update test config | |
| run: | | |
| sed -i -e 's$http://localhost:8080$http://cvat.local:80$g' tests/python/shared/utils/config.py | |
| find tests/python/shared/assets/ -type f -name '*.json' | xargs sed -i -e 's$http://localhost:8080$http://cvat.local$g' | |
| echo "$(minikube ip) cvat.local" | sudo tee -a /etc/hosts | |
| - name: Wait for CVAT to be ready | |
| run: | | |
| max_tries=60 | |
| while [[ $(kubectl get pods -l component=server -o 'jsonpath={..status.conditions[?(@.type=="Ready")].status}') != "True" && max_tries -gt 0 ]]; do echo "waiting for CVAT pod" && (( max_tries-- )) && sleep 5; done | |
| while [[ $(kubectl get pods -l app.kubernetes.io/name=postgresql -o 'jsonpath={..status.conditions[?(@.type=="Ready")].status}') != "True" && max_tries -gt 0 ]]; do echo "waiting for DB pod" && (( max_tries-- )) && sleep 5; done | |
| while [[ $(curl -s -o /tmp/server_response -w "%{http_code}" cvat.local/api/server/about) != "200" && max_tries -gt 0 ]]; do echo "waiting for CVAT" && (( max_tries-- )) && sleep 5; done | |
| kubectl get pods | |
| kubectl logs $(kubectl get pods -l component=server -o jsonpath='{.items[0].metadata.name}') | |
| - name: Generate schema | |
| run: | | |
| mkdir cvat-sdk/schema | |
| kubectl exec $(kubectl get pods -l component=server -o jsonpath='{.items[0].metadata.name}') -- /bin/bash -c "python manage.py spectacular --file /tmp/schema.yml" | |
| kubectl cp $(kubectl get pods -l component=server -o jsonpath='{.items[0].metadata.name}'):/tmp/schema.yml cvat-sdk/schema/schema.yml | |
| pip3 install --user -r cvat-sdk/gen/requirements.txt | |
| cd cvat-sdk/ | |
| gen/generate.sh | |
| cd .. | |
| - name: Install test requrements | |
| run: | | |
| pip3 install --user cvat-sdk/ | |
| pip3 install --user cvat-cli/ | |
| pip3 install --user -r tests/python/requirements.txt | |
| - name: REST API and SDK tests | |
| # We don't have external services in Helm tests, so we ignore corresponding cases | |
| # They are still tested without Helm | |
| run: | | |
| kubectl cp tests/mounted_file_share/images $(kubectl get pods -l component=server -o jsonpath='{.items[0].metadata.name}'):/home/django/share | |
| pytest --platform=kube -m "not with_external_services" tests/python |