django.yml

name: Django CI

on:
  pull_request_target:

jobs:
  authorize:
    environment: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}
    runs-on: ubuntu-latest
    steps:
      - run: true

  start-runner:
    needs: authorize
    name: Start self-hosted EC2 runner
    runs-on: ubuntu-latest
    outputs:
      label: ${{ steps.start-ec2-runner.outputs.label }}
      ec2-instance-id: ${{ steps.start-ec2-runner.outputs.ec2-instance-id }}
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ secrets.AWS_REGION }}
      - name: Start EC2 runner
        id: start-ec2-runner
        uses: machulav/ec2-github-runner@v2
        with:
          mode: start
          github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
          ec2-image-id: ${{ secrets.AWS_EC2_IMAGE_ID }}
          ec2-instance-type: t3.micro
          subnet-id: ${{ secrets.AWS_SUBNET_ID }}
          security-group-id: ${{ secrets.AWS_SECURITY_GROUP_ID }}

  build:
    name: Django build
    needs:
      - start-runner # required to start the main job when the runner is ready
    runs-on: ${{ needs.start-runner.outputs.label }} # run the job on the newly created runner
    timeout-minutes: 10
    strategy:
      max-parallel: 4

    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.ref }}

      - name: Set up python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          architecture: "x64"

      - name: Linting code with ruff
        run: |
          python -m pip install ruff
          ruff . --config .github/pyproject.toml

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install pip-tools
          pip-compile ./requirements/development.txt --output-file ./full-requirements.txt --resolver=backtracking
          pip install -r ./full-requirements.txt

      - name: Tests and coverage
        run: |
          export PYTHONPATH="$PYTHONPATH:./django-napse/"
          export NAPSE_IS_IN_PIPELINE=True
          cd tests/test_app
          bash setup_secrets.sh
          cd ../..
          python3 tests/test_app/manage.py makemigrations && python3 tests/test_app/manage.py migrate 
          coverage run ./tests/test_app/manage.py test -v2 --keepdb && coverage html

      - name: Coverage value
        run: |
          cvg_result=$(coverage report --skip-covered | head -n -2 | tail -n 1 | awk '{print $NF}' | sed 's/%//')
          echo "COVERAGE=$cvg_result" >> $GITHUB_ENV

      - name: Coverage badge
        if: ${{ github.base_ref == 'main' }}
        uses: Schneegans/dynamic-badges-action@v1.7.0
        env:
          COVERAGE: ${{ env.COVERAGE }}
        with:
          auth: ${{ secrets.NAPSE_SECRET_GIST }}
          gistID: 40fac957532fe3b731c99067467de842
          filename: django-napse-coverage.json
          label: Coverage
          message: ${{ env.COVERAGE }} %
          valColorRange: ${{ env.COVERAGE }}
          minColorRange: 60
          maxColorRange: 100

  stop-runner:
    name: Stop self-hosted EC2 runner
    needs:
      - start-runner # required to get output from the start-runner job
      - build # required to wait when the main job is done
    runs-on: ubuntu-latest
    if: ${{ always() }} # required to stop the runner even if the error happened in the previous jobs
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ secrets.AWS_REGION }}
      - name: Stop EC2 runner
        uses: machulav/ec2-github-runner@v2
        with:
          mode: stop
          github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
          label: ${{ needs.start-runner.outputs.label }}
          ec2-instance-id: ${{ needs.start-runner.outputs.ec2-instance-id }}