updates CI

unicef · Dec 7, 2024 · fafe05c · fafe05c
1 parent 961a004
commit fafe05c
Show file tree

Hide file tree

Showing 2 changed files with 50 additions and 4 deletions.
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -166,6 +166,32 @@ jobs:
   release:
     needs: [ test ]
     runs-on: ubuntu-latest
+    services:
+      redis:
+        image: redis:7.4.0
+        ports:
+          - 26379:6379
+      db:
+        image: postgres:14
+        env:
+          POSTGRES_DATABASE: country_workspace
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_USERNAME: postgres
+        ports:
+          - 25432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    env:
+      DOCKER_DEFAULT_PLATFORM: linux/amd64
+      DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
+      DATABASE_URL: postgres://postgres:postgres@localhost:25432/country_workspace
+      CELERY_BROKER_URL: redis://localhost:26379/1
+      CACHE_URL: redis://localhost:26379/2
+      DOCKER_BUILDKIT: 1
+      IMAGE: ${{needs.test.outputs.image}}
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -186,6 +212,24 @@ jobs:
                 --build-arg "BRANCH=${{needs.test.outputs.branch}}" \
                 -t ${{needs.test.outputs.image}} \
                 -f docker/Dockerfile .
+
+      - name: Docker Integrity Check
+        run: |
+            docker run --rm \
+              --network host \
+              -e DATABASE_URL=${DATABASE_URL} \
+              -e CELERY_BROKER_URL=${CELERY_BROKER_URL} \
+              -e CACHE_URL=${CACHE_URL} \
+              -e SECRET_KEY=super-secret-key-just-for-testing \
+              -e HOPE_API_URL="https://dev-hope.unitst.org/api/rest/" \
+              -e HOPE_API_TOKEN=${{ secrets.HOPE_API_TOKEN }} \
+              -e AURORA_API_URL="https://uni-hope-ukr-sr-dev.unitst.org/api/" \
+              -e AURORA_API_TOKEN=${{ secrets.AURORA_API_TOKEN }} \
+              -t ${{needs.test.outputs.image}} \
+              django-admin upgrade
+
+      - name: Publish images
+        run: |          
             docker push ${{needs.test.outputs.image}}
             docker inspect ${{needs.test.outputs.image}} | jq -r '.[0].Config.Labels'
             echo "::notice::✅ Image ${{needs.test.outputs.image}} built and pushed"
diff --git a/docker/Dockerfile b/docker/Dockerfile
@@ -79,13 +79,15 @@ COPY uv.lock README.md MANIFEST.in pyproject.toml /app/
 COPY src /app/src/
 
 RUN --mount=type=cache,target=/root/.uv-cache \
-    uv sync --cache-dir=/root/.uv-cache \
+    find ../src -name 'node_modules' -prune \
+        -o -name *.py -o -name *.html -o -name *.js -o -name *.css \
+        -type f \
+        -exec ls -l "{}" \;  | sha1sum | awk '{print $1}' > CODE_CHECKSUM \
+    && uv sync --cache-dir=/root/.uv-cache \
         --python=/usr/local/bin/python \
         --python-preference=system \
         --frozen
 
-
-
 # ------- production only deps-------
 FROM builder AS production
 ENV PATH=/app/.venv/bin:/usr/local/bin/:/usr/bin:/bin \
@@ -102,7 +104,7 @@ RUN --mount=type=cache,target=/root/.uv-cache \
     uv sync --cache-dir=/root/.uv-cache \
         --python=/usr/local/bin/python \
         --python-preference=system \
-        --no-dev --no-editable --frozen --extra distribution
+        --no-dev --frozen --extra distribution