Skip to content

Commit 83add4e

Browse files
Evan Simsstevehobbsdev
Evan Sims
and
stevehobbsdev
authored
test: Migrate CI to GitHub (#523)
Co-authored-by: Steve Hobbs <[email protected]>
1 parent 8be3420 commit 83add4e

File tree

11 files changed

+284
-20
lines changed

11 files changed

+284
-20
lines changed

‎.gemrelease

-2
This file was deleted.

‎.github/actions/setup/action.yml

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: Build package
2+
description: Build the SDK package
3+
4+
inputs:
5+
ruby:
6+
description: The Ruby version to use
7+
required: false
8+
default: 3.2
9+
bundle-path:
10+
description: The path to the bundle cache
11+
required: false
12+
default: vendor/bundle
13+
bundler-cache:
14+
description: Whether to use the bundler cache
15+
required: false
16+
default: true
17+
18+
runs:
19+
using: composite
20+
21+
steps:
22+
- name: Configure Ruby
23+
uses: ruby/setup-ruby@v1
24+
with:
25+
ruby-version: ${{ inputs.ruby }}
26+
bundler-cache: ${{ inputs.bundle-cache }}
27+
28+
- name: Install dependencies
29+
run: bundle check || bundle install
30+
shell: bash
31+
env:
32+
BUNDLE_PATH: ${{ inputs.bundle-path }}

‎.github/dependabot.yml

+6-3
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,13 @@
11
version: 2
22
updates:
3-
4-
- package-ecosystem: "bundler"
5-
directory: "/"
3+
- package-ecosystem: "bundler"
4+
directory: "/"
65
schedule:
76
interval: "daily"
87
ignore:
98
- dependency-name: "*"
109
update-types: ["version-update:semver-major"]
10+
- package-ecosystem: 'github-actions'
11+
directory: '/'
12+
schedule:
13+
interval: 'daily'

‎.github/workflows/codeql.yml

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
name: CodeQL
2+
3+
on:
4+
merge_group:
5+
pull_request:
6+
types:
7+
- opened
8+
- synchronize
9+
push:
10+
branches:
11+
- master
12+
schedule:
13+
- cron: "37 10 * * 2"
14+
15+
permissions:
16+
actions: read
17+
contents: read
18+
security-events: write
19+
20+
concurrency:
21+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
22+
cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
23+
24+
jobs:
25+
analyze:
26+
name: Check for Vulnerabilities
27+
runs-on: ubuntu-latest
28+
29+
strategy:
30+
fail-fast: false
31+
matrix:
32+
language: [ruby]
33+
34+
steps:
35+
- if: github.actor == 'dependabot[bot]' || github.event_name == 'merge_group'
36+
run: exit 0 # Skip unnecessary test runs for dependabot and merge queues. Artifically flag as successful, as this is a required check for branch protection.
37+
38+
- name: Checkout
39+
uses: actions/checkout@v4
40+
41+
- name: Initialize CodeQL
42+
uses: github/codeql-action/init@v2
43+
with:
44+
languages: ${{ matrix.language }}
45+
queries: +security-and-quality
46+
47+
- name: Autobuild
48+
uses: github/codeql-action/autobuild@v2
49+
50+
- name: Perform CodeQL Analysis
51+
uses: github/codeql-action/analyze@v2
52+
with:
53+
category: "/language:${{ matrix.language }}"

‎.github/workflows/matrix.json

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
{
2+
"include": [
3+
{ "ruby": "3.0" },
4+
{ "ruby": "3.1" },
5+
{ "ruby": "3.2" }
6+
]
7+
}

‎.github/workflows/publish.yml

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
name: Publish Release
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
branch:
7+
description: The branch to release from.
8+
required: true
9+
default: master
10+
11+
permissions:
12+
contents: read
13+
14+
jobs:
15+
publish:
16+
name: Publish to RubyGems
17+
runs-on: ubuntu-latest
18+
environment: release
19+
20+
steps:
21+
- name: Checkout code
22+
uses: actions/checkout@v4
23+
with:
24+
fetch-depth: 0
25+
ref: ${{ github.event.inputs.branch }}
26+
27+
- name: Configure Ruby
28+
uses: ./.github/actions/setup
29+
with:
30+
ruby: 3.2
31+
32+
- name: Publish to RubyGems
33+
run: |
34+
gem build *.gemspec
35+
gem push *.gem
36+
env:
37+
GEM_HOST_API_KEY: ${{secrets.RUBYGEMS_AUTH_TOKEN}}

‎.github/workflows/semgrep.yml

+33-12
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,49 @@
11
name: Semgrep
22

33
on:
4-
pull_request: {}
5-
4+
merge_group:
5+
pull_request_target:
6+
types:
7+
- opened
8+
- synchronize
69
push:
710
branches:
811
- master
9-
- main
10-
1112
schedule:
12-
- cron: '0 * * * *'
13+
- cron: '30 0 1,15 * *'
14+
15+
permissions:
16+
contents: read
17+
18+
concurrency:
19+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
20+
cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
1321

1422
jobs:
15-
semgrep:
16-
name: Scan
23+
authorize:
24+
name: Authorize
25+
environment: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}
1726
runs-on: ubuntu-latest
27+
steps:
28+
- run: true
29+
30+
run:
31+
needs: authorize # Require approval before running on forked pull requests
32+
33+
name: Check for Vulnerabilities
34+
runs-on: ubuntu-latest
35+
1836
container:
1937
image: returntocorp/semgrep
20-
if: (github.repository_owner == 'auth0')
21-
38+
2239
steps:
23-
- uses: actions/checkout@v3
40+
- if: github.actor == 'dependabot[bot]' || github.event_name == 'merge_group'
41+
run: exit 0 # Skip unnecessary test runs for dependabot and merge queues. Artifically flag as successful, as this is a required check for branch protection.
42+
43+
- uses: actions/checkout@v4
44+
with:
45+
ref: ${{ github.event.pull_request.head.sha || github.ref }}
2446

25-
- if: github.event.pull_request.draft == false && github.actor != 'dependabot[bot]'
26-
run: semgrep ci
47+
- run: semgrep ci
2748
env:
2849
SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}

‎.github/workflows/snyk.yml

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
name: Snyk
2+
3+
on:
4+
merge_group:
5+
workflow_dispatch:
6+
pull_request_target:
7+
types:
8+
- opened
9+
- synchronize
10+
push:
11+
branches:
12+
- master
13+
schedule:
14+
- cron: '30 0 1,15 * *'
15+
16+
permissions:
17+
contents: read
18+
19+
concurrency:
20+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
21+
cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
22+
23+
jobs:
24+
authorize:
25+
name: Authorize
26+
environment: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}
27+
runs-on: ubuntu-latest
28+
steps:
29+
- run: true
30+
31+
check:
32+
needs: authorize
33+
34+
name: Check for Vulnerabilities
35+
runs-on: ubuntu-latest
36+
37+
steps:
38+
- if: github.actor == 'dependabot[bot]' || github.event_name == 'merge_group'
39+
run: exit 0 # Skip unnecessary test runs for dependabot and merge queues. Artifically flag as successful, as this is a required check for branch protection.
40+
41+
- uses: actions/checkout@v4
42+
with:
43+
ref: ${{ github.event.pull_request.head.sha || github.ref }}
44+
45+
- uses: snyk/actions/php@b98d498629f1c368650224d6d212bf7dfa89e4bf # [email protected]
46+
env:
47+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

‎.github/workflows/test.yml

+69
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
name: Build and Test
2+
3+
on:
4+
merge_group:
5+
workflow_dispatch:
6+
pull_request:
7+
branches:
8+
- master
9+
push:
10+
branches:
11+
- master
12+
13+
permissions:
14+
contents: read
15+
16+
concurrency:
17+
group: ${{ github.workflow }}-${{ github.ref }}
18+
cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
19+
20+
env:
21+
CACHE_KEY: "${{ github.ref }}-${{ github.run_id }}-${{ github.run_attempt }}"
22+
23+
jobs:
24+
configure:
25+
name: Configure Build Matrix
26+
runs-on: ubuntu-latest
27+
28+
outputs:
29+
matrix: ${{ steps.set-matrix.outputs.matrix }}
30+
31+
steps:
32+
- uses: actions/checkout@v4
33+
with:
34+
ref: ${{ github.event.pull_request.head.sha || github.ref }}
35+
36+
- id: set-matrix
37+
run: echo "matrix=$(jq -c . < ./.github/workflows/matrix.json)" >> $GITHUB_OUTPUT
38+
39+
unit:
40+
needs: configure
41+
42+
name: Run Unit Tests
43+
runs-on: ubuntu-latest
44+
45+
strategy:
46+
matrix: ${{ fromJson(needs.configure.outputs.matrix) }}
47+
48+
env:
49+
DOMAIN: example.auth0.dev
50+
CLIENT_ID: example-client
51+
CLIENT_SECRET: example-secret
52+
MASTER_JWT: example-jwt
53+
BUNDLE_PATH: vendor/bundle
54+
55+
steps:
56+
- name: Checkout code
57+
uses: actions/checkout@v4
58+
59+
- name: Configure Ruby
60+
uses: ./.github/actions/setup
61+
with:
62+
ruby: ${{ matrix.ruby }}
63+
64+
- name: Run tests
65+
run: bundle exec rake test
66+
67+
- name: Upload coverage
68+
if: matrix.ruby == '3.2'
69+
uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # [email protected]

‎Gemfile.lock

-2
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,6 @@ GEM
6161
fuubar (2.5.1)
6262
rspec-core (~> 3.0)
6363
ruby-progressbar (~> 1.4)
64-
gem-release (0.7.4)
6564
guard (2.18.0)
6665
formatador (>= 0.2.4)
6766
listen (>= 2.7, < 4.0)
@@ -242,7 +241,6 @@ DEPENDENCIES
242241
dotenv-rails (~> 2.0)
243242
faker (~> 2.0)
244243
fuubar (~> 2.0)
245-
gem-release (~> 0.7)
246244
guard-rspec (~> 4.5)
247245
irb
248246
pp

‎auth0.gemspec

-1
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,5 @@ Gem::Specification.new do |s|
3232
s.add_development_dependency 'rack', '~> 2.1'
3333
s.add_development_dependency 'simplecov', '~> 0.9'
3434
s.add_development_dependency 'faker', '~> 2.0'
35-
s.add_development_dependency 'gem-release', '~> 0.7'
3635
s.license = 'MIT'
3736
end

0 commit comments

Comments
 (0)