GCP rule hardening - Part 1 #265
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PR Checks | |
| on: | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| id-token: write | |
| contents: read | |
| jobs: | |
| # ========================= | |
| # CODE QUALITY CHECKS (REQUIRED) | |
| # ========================= | |
| lint: | |
| name: Lint & Format Check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install ruff black | |
| - name: Run Ruff | |
| run: ruff check cleancloud/ | |
| - name: Check formatting with Black | |
| run: black --check cleancloud/ | |
| # ========================= | |
| # UNIT TESTS (REQUIRED) | |
| # ========================= | |
| test: | |
| name: Test Python ${{ matrix.python-version }} | |
| runs-on: ubuntu-latest | |
| environment: cleancloud-test | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.10", "3.11", "3.12", "3.13"] # 3.9 dropped — EOL Oct 2025 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e ".[all,dev]" | |
| # AWS via OIDC (no static secrets) | |
| - name: Configure AWS credentials (OIDC) | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| role-to-assume: arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/CleanCloudCIReadOnly | |
| aws-region: us-east-1 | |
| - name: Azure Login via OIDC | |
| uses: azure/login@v2 | |
| with: | |
| client-id: ${{ secrets.AZURE_CLIENT_ID }} # App registration ID | |
| tenant-id: ${{ secrets.AZURE_TENANT_ID }} # Azure AD tenant | |
| subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} | |
| enable-AzPSSession: false | |
| allow-no-subscriptions: false | |
| - name: Authenticate to GCP (Workload Identity Federation) | |
| uses: google-github-actions/auth@v2 | |
| with: | |
| workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }} | |
| service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }} | |
| - name: Run tests | |
| env: | |
| CLEANCLOUD_GCP_TEST_PROJECT: ${{ vars.GCP_PROJECT_ID }} | |
| run: | | |
| pytest tests/ -v --cov=cleancloud --cov-report=xml | |
| - name: Upload coverage | |
| if: matrix.python-version == '3.11' | |
| uses: codecov/codecov-action@v4 | |
| with: | |
| file: ./coverage.xml | |
| fail_ci_if_error: false | |
| # ========================= | |
| # BUILD PACKAGE (REQUIRED) | |
| # ========================= | |
| build: | |
| name: Build Distribution | |
| runs-on: ubuntu-latest | |
| needs: [lint, test] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install build tools | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install build twine | |
| - name: Build package | |
| run: python -m build | |
| - name: Check package | |
| run: twine check dist/* | |
| - name: Upload distributions | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: distributions | |
| path: dist/ | |
| # ========================= | |
| # INTEGRATION TESTS | |
| # ========================= | |
| integration-test-aws: | |
| name: Integration Test - AWS | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| environment: cleancloud-test | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install CleanCloud | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e ".[aws,dev]" | |
| # AWS via OIDC (matches client CI usage) | |
| - name: Configure AWS credentials (OIDC) | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| role-to-assume: arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/CleanCloudCIReadOnly | |
| aws-region: us-east-1 | |
| - name: Test AWS doctor command | |
| run: | | |
| cleancloud doctor --provider aws --region us-east-1 | |
| - name: Test AWS scan | |
| run: | | |
| cleancloud scan \ | |
| --provider aws \ | |
| --region us-east-1 \ | |
| --output json \ | |
| --output-file test-results.json | |
| - name: Upload test results | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: aws-integration-test-results | |
| path: test-results.json | |
| integration-test-aws-multi-account: | |
| name: Integration Test - AWS Multi-Account | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| environment: cleancloud-test | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install CleanCloud | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e ".[aws,dev]" | |
| - name: Configure AWS credentials (OIDC) | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| role-to-assume: arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/CleanCloudCIReadOnly | |
| aws-region: us-east-1 | |
| - name: Test multi-account scan | |
| run: | | |
| cleancloud scan \ | |
| --provider aws \ | |
| --accounts ${{ vars.AWS_ACCOUNT_ID }},${{ vars.AWS_SPOKE_ACCOUNT_ID }} \ | |
| --all-regions \ | |
| --output json \ | |
| --output-file multi-account-results.json | |
| - name: Upload test results | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: aws-multi-account-pr-results | |
| path: multi-account-results.json | |
| integration-test-azure: | |
| name: Integration Test - Azure | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| environment: cleancloud-test | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install CleanCloud | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e ".[azure,dev]" | |
| - name: Azure Login via OIDC | |
| uses: azure/login@v2 | |
| with: | |
| client-id: ${{ secrets.AZURE_CLIENT_ID }} # App registration ID | |
| tenant-id: ${{ secrets.AZURE_TENANT_ID }} # Azure AD tenant | |
| subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} | |
| enable-AzPSSession: false | |
| allow-no-subscriptions: false | |
| - name: Test Azure doctor command | |
| run: | | |
| cleancloud doctor --provider azure | |
| - name: Test Azure scan | |
| run: | | |
| cleancloud scan \ | |
| --provider azure \ | |
| --output json \ | |
| --output-file test-results.json | |
| - name: Upload test results | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: azure-integration-test-results | |
| path: test-results.json | |
| integration-test-azure-multi-subscription: | |
| name: Integration Test - Azure Multi-Subscription | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| environment: cleancloud-test | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install CleanCloud | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e ".[azure,dev]" | |
| - name: Azure Login via OIDC (no subscription pin — scans all) | |
| uses: azure/login@v2 | |
| with: | |
| client-id: ${{ secrets.AZURE_CLIENT_ID }} | |
| tenant-id: ${{ secrets.AZURE_TENANT_ID }} | |
| enable-AzPSSession: false | |
| allow-no-subscriptions: true | |
| - name: Test Azure multi-subscription scan | |
| run: | | |
| cleancloud scan \ | |
| --provider azure \ | |
| --output json \ | |
| --output-file multi-subscription-results.json | |
| - name: Upload test results | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: azure-multi-subscription-pr-results | |
| path: multi-subscription-results.json | |
| integration-test-gcp: | |
| name: Integration Test - GCP | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| environment: cleancloud-test | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install CleanCloud | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e ".[gcp,dev]" | |
| - name: Authenticate to GCP (Workload Identity Federation) | |
| uses: google-github-actions/auth@v2 | |
| with: | |
| workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }} | |
| service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }} | |
| - name: Test GCP doctor command | |
| run: | | |
| cleancloud doctor --provider gcp --project ${{ vars.GCP_PROJECT_ID }} | |
| - name: Test GCP scan | |
| run: | | |
| cleancloud scan \ | |
| --provider gcp \ | |
| --project ${{ vars.GCP_PROJECT_ID }} \ | |
| --output json \ | |
| --output-file test-results.json | |
| - name: Upload test results | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: gcp-integration-test-results | |
| path: test-results.json |