[#13] reuse open-api-workflows workflows

.github/workflows/ci.yml

@@ -15,7 +15,6 @@ env:
   DJANGO_SETTINGS_MODULE: openklant.conf.ci
   DB_PASSWORD: ''
   DB_USER: postgres
-  # ALLOWED_HOSTS: openklant.nl
 
 jobs:
   # determine changed files to decide if certain jobs can be skipped or not
@@ -34,12 +33,6 @@ jobs:
         with:
           files: |
             ^src/.+\.py
-      - name: Get changed JS files
-        id: changed-js-files
-        uses: tj-actions/changed-files@v41
-        with:
-          files: |
-            ^src/.+\.js
       - name: Get changed requirements files
         id: changed-requirements
         uses: tj-actions/changed-files@v41
@@ -48,7 +41,6 @@ jobs:
 
     outputs:
       changed-py-files: ${{ steps.changed-py-files.outputs.any_changed }}
-      changed-js-files: ${{ steps.changed-js-files.outputs.any_changed }}
       changed-requirements: ${{ steps.changed-requirements.outputs.any_changed }}
 
   tests:
@@ -94,10 +86,7 @@ jobs:
           python src/manage.py collectstatic --noinput --link
           coverage run src/manage.py test src
         env:
-          DJANGO_SETTINGS_MODULE: openklant.conf.ci
           SECRET_KEY: dummy
-          DB_USER: postgres
-          DB_PASSWORD: ''
 
       - name: Publish coverage report
         uses: codecov/codecov-action@v3
@@ -124,101 +113,26 @@ jobs:
               echo "Please update the environment documentation by running \`bin/generate_envvar_docs.sh\`"
               exit 1
           fi
-        env:
-          DJANGO_SETTINGS_MODULE: openklant.conf.ci
-
-  docker:
-    needs: tests
-    name: Build Docker image
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-      - name: Determine tag/commit hash
-        id: vars
-        run: |
-          # Strip git ref prefix from version
-          VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
-          # Strip "v" prefix from tag name (if present at all)
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
-          # Use Docker `latest` tag convention
-          [ "$VERSION" == "master" ] && VERSION=latest
-          echo "tag=${VERSION}" >> $GITHUB_OUTPUT
-          echo "git_hash=${GITHUB_SHA}" >> $GITHUB_OUTPUT
-      - name: Build the Docker image
-        run: |
-          docker build \
-            --tag $IMAGE_NAME:${{ steps.vars.outputs.tag }} \
-            --build-arg COMMIT_HASH=${{ steps.vars.outputs.git_hash }} \
-            --build-arg RELEASE=${{ steps.vars.outputs.tag }} \
-            .
-      - run: docker image save -o image.tar $IMAGE_NAME:${{ steps.vars.outputs.tag }}
-      - name: Store image artifact
-        uses: actions/upload-artifact@v3
-        with:
-          name: docker-image
-          path: image.tar
-          retention-days: 1
 
-  image_scan:
+  store-reusable-workflow-vars:
+    name: create values which can be passed through a reusable workflow
     runs-on: ubuntu-latest
-    name: Scan docker image
-    needs:
-      - docker
+    outputs:
+      image-name: ${{ steps.image-name.outputs.image-name }}
+      sphinx-ssl-conf: ${{ steps.sphinx-ssl-conf.outputs.sphinx-ssl-conf }}
 
     steps:
-      - name: Download built image
-        uses: actions/download-artifact@v3
-        with:
-          name: docker-image
-      - name: Scan image with Trivy
-        uses: aquasecurity/trivy-action@master
-        with:
-          input: /github/workspace/image.tar  # from download-artifact
-          format: 'sarif'
-          output: 'trivy-results-docker.sarif'
-          ignore-unfixed: true
-      - name: Upload results to GH Security tab
-        uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: 'trivy-results-docker.sarif'
+      - run: echo "image-name=$IMAGE_NAME" >> $GITHUB_OUTPUT
+        name: 'Store the docker image name'
+        id: image-name
 
-  publish:
+  open-api-ci:
+    uses: maykinmedia/open-api-workflows/.github/workflows/ci.yml@initial-setup
     needs:
+      - store-reusable-workflow-vars
       - tests
-      - docker
-
-    name: Push Docker image
-    runs-on: ubuntu-latest
-    if: github.event_name == 'push'  # exclude PRs
-
-    steps:
-      - uses: actions/checkout@v4
-      - name: Download built image
-        uses: actions/download-artifact@v3
-        with:
-          name: docker-image
-
-      - name: Determine tag/commit hash
-        id: vars
-        run: |
-          # Strip git ref prefix from version
-          VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
-
-          # Strip "v" prefix from tag name (if present at all)
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
-
-          # Use Docker `latest` tag convention
-          [ "$VERSION" == "master" ] && VERSION=latest
-
-          echo "tag=${VERSION}" >> $GITHUB_OUTPUT
-
-      - name: Load image
-        run: |
-          docker image load -i image.tar
-
-      - name: Log into registry
-        run: echo "${{ secrets.DOCKER_TOKEN }}" | docker login -u ${{ secrets.DOCKER_USERNAME }} --password-stdin
-
-      - name: Push the Docker image
-        run: docker push $IMAGE_NAME:${{ steps.vars.outputs.tag }}
+    with:
+      main-branch: 'master'
+      python-version: '3.11'
+      docker-image-name: ${{ needs.store-reusable-workflow-vars.outputs.image-name }}
+      repository-owner: 'maykinmedia'

.github/workflows/code-analysis.yml

@@ -0,0 +1,21 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+name: "CodeQL"
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches:
+      - main
+  schedule:
+    - cron: '0 23 * * 6'
+
+jobs:
+  open-api-workflow-code-analysis:
+    uses: maykinmedia/open-api-workflows/.github/workflows/code-analysis.yml@initial-setup

.github/workflows/codeql.yml

@@ -7,107 +7,28 @@ name: Code quality checks
 
 on:
   push:
-    branches: [ "master" ]
+    branches:
+      - master
+    paths:
+      - '**.py'
+      - '**.yml'
   pull_request:
-    # The branches below must be a subset of the branches above
-    branches: [ "master" ]
-  schedule:
-    - cron: '32 10 * * 4'
+    paths:
+      - '**.py'
+      - '**.yml'
+  workflow_dispatch:
 
 jobs:
-  analyze:
-    name: Analyze
-    # Runner size impacts CodeQL analysis time. To learn more, please see:
-    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
-    #   - https://gh.io/supported-runners-and-hardware-resources
-    #   - https://gh.io/using-larger-runners
-    # Consider using larger runners for possible analysis time improvements.
-    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
-    timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [ 'javascript-typescript', 'python' ]
-        # CodeQL supports [ 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' ]
-        # Use only 'java-kotlin' to analyze code written in Java, Kotlin or both
-        # Use only 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
-        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
-      with:
-        languages: ${{ matrix.language }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.
-
-        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
-        # queries: security-extended,security-and-quality
-
-
-    # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
-
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
-
-    #   If the Autobuild fails above, remove it and uncomment the following three lines.
-    #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
-
-    # - run: |
-    #     echo "Run, Build Application using script"
-    #     ./location_of_script_within_repo/buildscript.sh
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
-      with:
-        category: "/language:${{matrix.language}}"
-
-  oas-up-to-date:
-    name: Check for unexepected OAS changes
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        component: ['contactgegevens', 'klantinteracties']
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
-        with:
-          python-version: '3.11'
-          cache: 'pip'
-          cache-dependency-path: 'requirements/*.txt'
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '18'
-
-      - name: Install dependencies
-        run: pip install -r requirements/ci.txt
-
-      - name: Generate OAS files
-        run: ./bin/generate_schema_for_component.sh ${{ matrix.component }} openapi-${{ matrix.component }}.yaml
-        env:
-          DJANGO_SETTINGS_MODULE: openklant.conf.ci
-
-      - name: Check for OAS changes
-        run: |
-          diff openapi-${{ matrix.component }}.yaml src/openklant/components/${{ matrix.component }}/openapi.yaml
-      - name: Write failure markdown
-        if: ${{ failure() }}
-        run: |
-          echo 'Run the following command locally and commit the changes' >> $GITHUB_STEP_SUMMARY
-          echo '' >> $GITHUB_STEP_SUMMARY
-          echo '```bash' >> $GITHUB_STEP_SUMMARY
-          echo './bin/generate_schema_for_component.sh ${{ matrix.component }}' >> $GITHUB_STEP_SUMMARY
-          echo '```' >> $GITHUB_STEP_SUMMARY
+  open-api-workflow-code-quality:
+    uses: maykinmedia/open-api-workflows/.github/workflows/code-quality.yml@initial-setup
+    with:
+      python-version: '3.11'
+      node-version: '18'
+      postgres-version: 'latest'
+
+      isort-src-pattern: 'src'
+      black-src-pattern: 'src docs'
+      flake8-src-pattern: 'src'
+
+      django-settings-module: 'openklant.conf.ci'
+      django-secret-key: dummy

.github/workflows/generate-postman-collection.yml

@@ -10,23 +10,5 @@ on:
   workflow_dispatch:
 
 jobs:
-  run:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        component: ['contactgegevens', 'klantinteracties']
-
-    name: Run with component ${{ matrix.component }}
-
-    steps:
-      - uses: actions/checkout@v4
-      - name: Use Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '18'
-      - name: Install dependencies
-        run: npm install -g openapi-to-postmanv2
-      - name: Create tests folder
-        run: mkdir -p ./tests/postman
-      - name: Generate Postman collection
-        run: openapi2postmanv2 -s ./src/openklant/components/${{ matrix.component }}/openapi.yaml -o ./tests/postman/collection.json --pretty
+  open-api-workflow-generate-postman-collection:
+    uses: maykinmedia/open-api-workflows/.github/workflows/generate-postman-collection.yml@initial-setup