pull_request.yml

name: corsair_scan Pull Request handler
on: pull_request
jobs:
    build:
        runs-on: ubuntu-latest
        strategy:
            max-parallel: 4
            matrix:
                python-version: [3.8]
        steps:
            - name: Checkout Code
              uses: actions/checkout@v1

            - name: Set up Python
              uses: actions/setup-python@v1
              with:
                 python-version: ${{ matrix.python-version }}

            - name: Install PIP Dependencies
              run: pip install -r requirements_dev.txt

            - name: Test with Pytest
              run: python -m pytest --cov=corsair_scan --cov-report=html:coverage/${{ matrix.python-version }} --cov-fail-under=85 -o junit_family=xunit2 --junitxml=${{ matrix.python-version }}.results.xml

            - name: Upload Test results
              uses: actions/upload-artifact@master
              with:
                name: Test Results - ${{ matrix.python-version }}
                path: ${{ matrix.python-version }}.results.xml

            - name: Upload Code Coverage
              uses: actions/upload-artifact@master
              with:
                 name: Test Coverage - ${{ matrix.python-version }}
                 path: coverage/${{ matrix.python-version }}

            - name: Flake8 styles
              run: python -m flake8 ./corsair_scan

            - name: Bandit security scan
              run: python -m bandit -r ./corsair_scan

            - name: Safety dependency scan
              run: python -m safety check

            - name: Semgrep
              id: semgrep
              uses: returntocorp/semgrep-action@v1
              with:
                 config: p/r2c-ci

            - name: Checkout origin branch if PR 'to-branch' is main
              if: github.base_ref == 'main'
              uses: actions/checkout@v2
              with:
                ref: ${{ github.head_ref }}

            - name: BumpVersion if PR 'to-branch' is main
              if: github.base_ref == 'main'
              run: |
                grep -i 'current_version = ' setup.cfg | head -1 | tr -d 'current_version = '
                git config --local user.email "action@github.com"
                git config --local user.name "GitHub Action"
                bump2version minor
                grep -i 'current_version = ' setup.cfg | head -1 | tr -d 'current_version = '
            - name: Push changes if PR 'to-branch' is main
              if: github.base_ref == 'main'
              uses: ad-m/github-push-action@v0.6.0
              with:
                github_token: ${{ secrets.GITHUB_TOKEN }}
                branch: ${{ github.head_ref }}