python_app.yml

# This workflow will install Python dependencies, run tests and lint with a single version of Python
# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python

name: Automatic plugin testing

on:
  # schedule:
    # runs once a week
    # - cron: '0 6 * * 0'
    # runs every day
    # - cron: '0 6 * * *'
  push:
    branches: [ "main", "test_ci"]
  pull_request:
    branches: [ "main"]

permissions:
  contents: read

jobs:
  build:

    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v3
    - name: Pull qgis image
      run: docker pull qgis/qgis:stable

    - name: Pip install
      run: |
        docker run --name qgis_container \
          --volume $(pwd):/app \
          -w=/app \
          qgis/qgis:stable sh -c "
            python3 -m pip install --ignore-installed -r requirements_dev.txt --break-system-packages
          "
        docker commit qgis_container qgis_with_deps

    - name: Debug - List directory
      run: docker run --volume $(pwd):/app -w=/app qgis_with_deps sh -c "ls -la /app"

    - name: Debug - Print PYTHONPATH
      run: docker run --volume $(pwd):/app -w=/app qgis_with_deps sh -c "echo \$PYTHONPATH"

    - name: Run tests
      run: |
        docker run --volume $(pwd):/app -w=/app qgis_with_deps sh -c "
          export PYTHONPATH=\$PYTHONPATH:/app:/usr/share/qgis/python/plugins && \
          xvfb-run -s '+extension GLX -screen 0 1024x768x24' python3 -m pytest tests -s
        "

  bandit:
    # Security check on the files that ship to plugins.qgis.org.
    # Fails on any medium- or high-severity finding.  See
    # ``tools/run_bandit.py`` for the targets list (mirrors pb_tool.cfg)
    # and the rationale behind the scoping.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install bandit
        run: python -m pip install --upgrade pip "bandit>=1.7"
      - name: Run bandit (gate on medium+ findings)
        run: python tools/run_bandit.py