python.yaml

---
name: 'Python'


on:
  workflow_call:
    inputs:
      LINT:
        default: true
        description: Should pylint run
        required: false
        type: boolean
      LINT_ERROR_ON_WARNING:
        default: false
        description: Should pylint return error on Warning
        required: false
        type: boolean
    secrets:
      WORKFLOW_TOKEN:
        description: "token to clone with"
        required: true


env:
  TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2


jobs:

  init:
    name: Meta
    runs-on: ubuntu-latest
    outputs:
      changed-files: ${{ steps.changed-files.outputs.project_all_changed_files }}
      doc-changed-files: ${{ steps.changed-files.outputs.docs_changed_files }}
      py-changed-files: ${{ steps.changed-files.outputs.all_changed_and_modified_files }}
      py-any-changed: ${{ steps.changed-files.outputs.any_changed}}
      tesy-changed-files: ${{ steps.changed-files.outputs.test_changed_files }}
      requirements_set: ${{ steps.requirements_set.outputs.requirements }}
    steps:


      - uses: actions/checkout@v4
        with:
          # fetch-depth: 100
          fetch-depth: 0


      - name: Get base branch name
        id: base-branch-name
        shell: bash
        run: |
          export CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD);

          if [ "${CURRENT_BRANCH}" == "development" ]; then

            BASE_BRANCH=master

          elif [ "${CURRENT_BRANCH}" == "feature-next-release" ]; then

            BASE_BRANCH=development

          elif [ "${CURRENT_BRANCH}" == "feat-next-release" ]; then

            BASE_BRANCH=development

          else

            if [ $(git rev-parse --verify feat-next-release) ]; then

              BASE_BRANCH=feat-next-release

            elif [ $(git rev-parse --verify feature-next-release) ]; then

              BASE_BRANCH=feature-next-release

            fi

            echo $BASE_BRANCH

          fi;

          echo "Base branch is ${BASE_BRANCH}";

          echo BASE_BRANCH=${BASE_BRANCH} > $GITHUB_OUTPUT


      - name: Trace
        shell: bash
        run: |
          git log -5;
          git branch;


      - uses: nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1    #v4.4.0
        id: setSHAs
        with:
          main-branch-name: ${{ steps.base-branch-name.outputs.BASE_BRANCH }}


      # - uses: matheusraz/ref-sha@v1
      #   id: get-sha
      #   with:
      #     ref: ${{ steps.base-branch-name.outputs.BASE_BRANCH }}
      #     length: 41


      - name: Get all files that have changed
        id: changed-files
        if: ${{ github.ref_name != 'master' && github.ref_name != 'development' && github.ref_type != 'tag' }}
        uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v46.0.5
        with:
          files: |
            **.py
            !app/*/tests/
            !app/*/migrations/
          # base_sha: ${{ steps.setSHAs.outputs.base }}
          # base_sha: ${{ steps.get-sha.outputs.sha }}
          # base_sha: ${{ env.NX_BASE }}
          base_sha: ${{ steps.base-branch-name.outputs.BASE_BRANCH }}


      - name: List all changed files
        # if: steps.changed-files.outputs.any_changed == 'true'
        env:
          ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_and_modified_files }}
        run: |
          echo "changed: ${ALL_CHANGED_FILES}":
          for file in ${ALL_CHANGED_FILES}; do
            echo "$file was changed"
          done



      - name: Find requirements files
        id: requirements_set
        run: |
          files=$(ls requirements*.txt | jq -R . | jq -s .)
          echo "requirements<<EOF" >> "$GITHUB_OUTPUT"
          echo "$files" >> "$GITHUB_OUTPUT"
          echo "EOF" >> "$GITHUB_OUTPUT"



  lint:
    name: Lint
    needs:
      - init
    if: github.event_name != 'schedule'
    runs-on: ubuntu-latest
    strategy:
      max-parallel: 4
      matrix:
        python-version: ['3.11', '3.12', '3.13']
    steps:


      - uses: actions/checkout@v4
        if: ${{ github.ref_name != 'master' && github.ref_name != 'development' && github.ref_type != 'tag' }}


      - name: Set up Python ${{ matrix.python-version }}
        if: ${{ github.ref_name != 'master' && github.ref_name != 'development' && github.ref_type != 'tag' }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}


      - name: Install Dependencies ${{ matrix.python-version }}
        if: ${{ github.ref_name != 'master' && github.ref_name != 'development' && github.ref_type != 'tag' }}
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
          pip install -r requirements_dev.txt


      - name: Lint ${{ matrix.python-version }}
        id: lint
        if: inputs.LINT && needs.init.outputs.py-any-changed
        shell: bash
        env:
          PY_CHANGED_FILES: ${{ needs.init.outputs.py-changed-files }}
        run: |
          pylint --py-version ${{ matrix.python-version }} --msg-template "::notice file={path},line={line},endLine={end_line},title={msg_id}::{msg} see https://pylint.pycqa.org/en/latest/user_guide/messages/{category}/{symbol}.html" ${PY_CHANGED_FILES} || EXITCODE=$?

          echo "Exit code was $EXITCODE";

          if [ "${EXITCODE}" ]; then

            echo "exit_code=${EXITCODE}" >> $GITHUB_OUTPUT

          else

            echo "exit_code=0" >> $GITHUB_OUTPUT

          fi

          echo "Exit code was ${EXITCODE}";


      - name: Fail on Error
        if: steps.lint.outputs.exit_code == 1
        shell: bash
        run: |
          echo "Lint exit code was ${{ steps.lint.outputs.exit_code }}"


      - name: Fail on Fatal
        if: steps.lint.outputs.exit_code == 2
        shell: bash
        run: |
          echo "Lint exit code was ${{ steps.lint.outputs.exit_code }}"


      - name: Fail on Warning
        if: inputs.LINT_ERROR_ON_WARNING && steps.lint.outputs.exit_code == 4
        shell: bash
        run: |
          echo "Lint exit code was ${{ steps.lint.outputs.exit_code }}"


      - name: Fail on Usage Error
        if: steps.lint.outputs.exit_code == 32
        shell: bash
        run: |
          echo "Lint exit code was ${{ steps.lint.outputs.exit_code }}"




  unit-test:
    name: Unit Test
    runs-on: ubuntu-latest
    needs:
      - lint
    if: github.event_name != 'schedule'
    strategy:
      max-parallel: 4
      matrix:
        python-version: ['3.10', '3.11', '3.12', '3.13']
    outputs:
      unit-test-coverage: ${{ steps.run-unit-test.outputs.coverage }}
      unit-test-branch_coverage: ${{ steps.run-unit-test.outputs.branch_coverage }}
    continue-on-error: true
    steps:


      - uses: actions/checkout@v4


      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}


      - name: Install Dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
          pip install -r requirements_dev.txt


      - run: |
          echo "::remove-matcher owner=python::"


      - name: Run Tests
        id: run-unit-test
        continue-on-error: true
        shell: bash
        run: |
          pytest  --cov-report xml:${PWD}/coverage.xml --cov-report html:${PWD}/coverage/ --cov-report json:${PWD}/coverage_unit.json --junit-xml=${PWD}/unit.JUnit.xml app/**/tests/unit;
          echo coverage=$(echo "$(jq -r '.totals.percent_covered' coverage_unit.json) " | awk '{printf "%.4f%%", $1"%"}') > $GITHUB_OUTPUT
          echo branch_coverage=$(echo "$(jq -r '.totals.covered_branches' coverage_unit.json) $(jq -r '.totals.num_branches' coverage_unit.json)" | awk '{covered=$1; total=$2; printf "%.4f%%", (covered/total*100)"%"}') >> $GITHUB_OUTPUT


      - name: Trace
        run: |
          echo "PWD is [${PWD}]";
          ls -laR


      - name: Upload Test Report
        uses: actions/upload-artifact@v4
        if: success() || failure()
        with:
          name: unit-test-results-${{ matrix.python-version }}
          path: unit.JUnit.xml


      - name: Upload Coverage Report
        uses: actions/upload-artifact@v4
        if: success() || failure()
        with:
          name: coverage-report-${{ matrix.python-version }}
          path: coverage.xml


      - name: Upload Coverage Report (json)
        uses: actions/upload-artifact@v4
        if: success() || failure()
        with:
          name: coverage-report-json-${{ matrix.python-version }}
          path: coverage_unit.json


      - name: Upload Coverage
        uses: actions/upload-artifact@v4
        if: success() || failure()
        with:
          name: coverage-${{ matrix.python-version }}
          path: coverage/*

      - name: Upload Unit Coverage (rc)
        uses: actions/upload-artifact@v4
        if: success() || failure()
        with:
          name: coverage-rc-unit-${{ matrix.python-version }}
          path: .coverage
          include-hidden-files: true

      - name: Upload any logs
        uses: actions/upload-artifact@v4
        if: success() || failure()
        with:
          name: unit-test-centurion-logs-${{ matrix.python-version }}
          path: log/*
          include-hidden-files: true

      - name: log file check
        run: |
          ls -la log/ || true;
          ls -la app/log/ || true;


  functional-test:
    name: Functional Test
    runs-on: ubuntu-latest
    needs:
      - lint
    if: github.event_name != 'schedule'
    strategy:
      max-parallel: 4
      matrix:
        python-version: ['3.10', '3.11', '3.12', '3.13']
    outputs:
      functional-test-coverage: ${{ steps.run-functional-test.outputs.coverage }}
      functional-test-branch_coverage: ${{ steps.run-functional-test.outputs.branch_coverage }}
    continue-on-error: true
    steps:


      - uses: actions/checkout@v4


      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}


      - name: Install Dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
          pip install -r requirements_dev.txt


      - run: |
          echo "::remove-matcher owner=python::"

      - name: Run Tests
        id: run-functional-test
        continue-on-error: true
        shell: bash
        run: |
          pytest --cov-report xml:${PWD}/functional-coverage.xml --cov-report html:${PWD}/coverage/functional/ --cov-report json:${PWD}/coverage_functional.json --junit-xml=${PWD}/functional.JUnit.xml app/**/tests/functional;
          echo coverage=$(echo "$(jq -r '.totals.percent_covered' coverage_functional.json) " | awk '{printf "%.4f%%", $1"%"}') > $GITHUB_OUTPUT
          echo branch_coverage=$(echo "$(jq -r '.totals.covered_branches' coverage_functional.json) $(jq -r '.totals.num_branches' coverage_functional.json)" | awk '{covered=$1; total=$2; printf "%.4f%%", (covered/total*100)"%"}') >> $GITHUB_OUTPUT


      - name: Trace
        run: |
          echo "PWD is [${PWD}]";
          ls -laR


      - name: Upload Test Report
        uses: actions/upload-artifact@v4
        if: success() || failure()
        with:
          name: functional-test-results-${{ matrix.python-version }}
          path: functional.JUnit.xml


      - name: Upload Coverage Report
        uses: actions/upload-artifact@v4
        if: success() || failure()
        with:
          name: functional-coverage-report-${{ matrix.python-version }}
          path: functional-coverage.xml


      - name: Upload Coverage Report (json)
        uses: actions/upload-artifact@v4
        if: success() || failure()
        with:
          name: functional-coverage-report-json-${{ matrix.python-version }}
          path: coverage_functional.json


      - name: Upload Coverage
        uses: actions/upload-artifact@v4
        if: success() || failure()
        with:
          name: functional-coverage-${{ matrix.python-version }}
          path: coverage/functional/*

      - name: Upload Functional Coverage (rc)
        uses: actions/upload-artifact@v4
        if: success() || failure()
        with:
          name: coverage-rc-functional-${{ matrix.python-version }}
          path: .coverage
          include-hidden-files: true

      - name: Upload any logs
        uses: actions/upload-artifact@v4
        if: success() || failure()
        with:
          name: functional-test-centurion-logs-${{ matrix.python-version }}
          path: log/*
          include-hidden-files: true

      - name: log file check
        run: |
          ls -la log/ || true;
          ls -la app/log/ || true;


  combines_report:
    name: Create Combined Test Reports
    needs:
      - unit-test
      - functional-test
    if: github.event_name != 'schedule'
    runs-on: ubuntu-latest
    strategy:
      max-parallel: 4
      matrix:
        python-version: ['3.10', '3.11', '3.12', '3.13']
    steps:


      - uses: actions/checkout@v4


      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}


      - name: Install Dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
          pip install -r requirements_dev.txt


      - name: Trace 'ls -la'
        shell: bash
        run: |
          ls -la;


      - name: Download Unit Test Report
        uses: actions/download-artifact@v4
        if: success() || failure()
        with:
          name: coverage-rc-unit-${{ matrix.python-version }}


      - name: Rename Unit Test Report
        shell: bash
        run: |
          ls -la;
          mv .coverage .coverage.unit;


      - name: Download Functional Test Report
        uses: actions/download-artifact@v4
        if: success() || failure()
        with:
          name: coverage-rc-functional-${{ matrix.python-version }}


      - name: Rename Functional Test Report
        shell: bash
        run: |
          ls -la;
          mv .coverage .coverage.functional;


      - name: Trace 'ls -la'
        shell: bash
        run: |
          ls -la;


      - name: Combine Reports
        shell: bash
        run: |
          coverage combine;


      - name: Create Combined Report
        shell: bash
        run: |
          mkdir -p artifacts;
          coverage html -d artifacts;
          mv .coverage artifacts/;


      - name: Upload Combined Report
        uses: actions/upload-artifact@v4
        if: success() || failure()
        with:
          name: coverage-combined-unit-function-html-${{ matrix.python-version }}
          path: artifacts/*
          include-hidden-files: true





    ################################################################################################################################
    #
    # Future Plan:
    #
    # with command: `git diff --name-only $(git rev-parse feature-next-release) HEAD`
    # to get a list of files to create a coverage html report with just the changed files.
    #
    ################################################################################################################################

















  # should only run on dev/master and tag
  report:
    name: Create Test Reports
    needs:
      - unit-test
    if: github.event_name != 'schedule'
    runs-on: ubuntu-latest
    strategy:
      max-parallel: 4
      matrix:
        python-version: ['3.10', '3.11', '3.12', '3.13']
    steps:


      - uses: actions/checkout@v4


      - name: Trace 'ls -la'
        shell: bash
        run: |
          ls -la;


      - name: Download Test Report
        uses: actions/download-artifact@v4
        if: success() || failure()
        with:
          name: unit-test-results-${{ matrix.python-version }}


      - name: Trace 'ls -la'
        shell: bash
        run: |
          ls -la;


      - name: Test Report
        if: success() || failure()
        uses: dorny/test-reporter@dc3a92680fcc15842eef52e8c4606ea7ce6bd3f3
        id: test-report
        with:
          # artifact: unit-test-results-${{ matrix.python-version }}
          name: Unit Test Report [Python ${{ matrix.python-version }}]
          path: '*.xml'
          reporter: java-junit
          use-actions-summary: false


      - name: Trace 'ls -la'
        if: success() || failure()
        shell: bash
        run: |
          ls -la;


      - name: Create Shields.io Endpoint.json
        if: success() || failure()
        shell: bash
        run: |
          echo '
          {
            "schemaVersion": 1,
            "label": "Unit Test",
            "message": "${{ steps.test-report.outputs.passed }} passed | ${{ steps.test-report.outputs.skipped }} skipped | ${{ steps.test-report.outputs.failed }} failed",
            "logoSvg": "<svg xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" viewBox=\"0 0 162.53 196.9\"><defs><linearGradient id=\"a\" x1=\"319.46\" y1=\"219.79\" x2=\"478.86\" y2=\"82.65\" gradientTransform=\"matrix(0.56, 0, 0, -0.57, -8.96, 287.06)\" gradientUnits=\"userSpaceOnUse\"><stop offset=\"0\" stop-color=\"#5a9fd4\"/><stop offset=\"1\" stop-color=\"#306998\"/></linearGradient><linearGradient id=\"b\" x1=\"540.48\" y1=\"-0.35\" x2=\"483.56\" y2=\"80.18\" gradientTransform=\"matrix(0.56, 0, 0, -0.57, -8.96, 287.06)\" gradientUnits=\"userSpaceOnUse\"><stop offset=\"0\" stop-color=\"#ffd43b\"/><stop offset=\"1\" stop-color=\"#ffe873\"/></linearGradient><radialGradient id=\"c\" cx=\"-809.2\" cy=\"196.83\" r=\"42.46\" gradientTransform=\"matrix(0, -0.24, -1.05, 0, 463.94, 150.1)\" gradientUnits=\"userSpaceOnUse\"><stop offset=\"0\" stop-color=\"#b8b8b8\" stop-opacity=\"0.5\"/><stop offset=\"1\" stop-color=\"#7f7f7f\" stop-opacity=\"0\"/></radialGradient></defs><title>python-logo</title><path d=\"M255,157.55a111.94,111.94,0,0,0-18.73,1.6c-16.59,2.93-19.6,9.07-19.6,20.38v14.94h39.2v5H202c-11.39,0-21.37,6.85-24.49,19.88-3.6,14.93-3.76,24.25,0,39.84,2.79,11.61,9.44,19.88,20.84,19.88h13.48V261.13c0-12.94,11.2-24.35,24.49-24.35h39.16a19.75,19.75,0,0,0,19.6-19.92V179.53c0-10.62-9-18.61-19.6-20.38A122.28,122.28,0,0,0,255,157.55Zm-21.2,12a7.47,7.47,0,1,1-7.36,7.49A7.44,7.44,0,0,1,233.83,169.57Z\" transform=\"translate(-174.73 -157.55)\" style=\"fill:url(#a)\"/><path d=\"M299.95,199.45v17.41c0,13.5-11.44,24.86-24.49,24.86H236.3c-10.73,0-19.6,9.18-19.6,19.92V299c0,10.62,9.24,16.87,19.6,19.92,12.41,3.65,24.31,4.31,39.16,0,9.87-2.86,19.6-8.61,19.6-19.92V284H255.9v-5h58.76c11.39,0,15.64-7.95,19.6-19.88,4.09-12.28,3.92-24.09,0-39.84-2.82-11.34-8.19-19.88-19.6-19.88Zm-22,94.54a7.47,7.47,0,1,1-7.36,7.45A7.4,7.4,0,0,1,277.92,294Z\" transform=\"translate(-174.73 -157.55)\" style=\"fill:url(#b)\"/><path d=\"M308.88,344.26c0,5.63-23.52,10.19-52.54,10.19s-52.54-4.56-52.54-10.19,23.52-10.19,52.54-10.19S308.88,338.64,308.88,344.26Z\" transform=\"translate(-174.73 -157.55)\" style=\"opacity:0.44382017850875854;isolation:isolate;fill:url(#c)\"/></svg>",
            "color": "#4584b6",
            "style": "plastic"
          }' > endpoint_${{ matrix.python-version }}.json


      - name: Upload Badge Endpoint json
        uses: actions/upload-artifact@v4
        if: success() || failure()
        with:
          name: unit-test-shield-endpoint-${{ matrix.python-version }}
          path: endpoint_${{ matrix.python-version }}.json


  # should only run on dev/master and tag
  functional-report:
    name: Create Test Reports (Functional)
    needs:
      - functional-test
    if: github.event_name != 'schedule'
    runs-on: ubuntu-latest
    strategy:
      max-parallel: 4
      matrix:
        python-version: ['3.10', '3.11', '3.12', '3.13']
    steps:


      - uses: actions/checkout@v4


      - name: Trace 'ls -la'
        shell: bash
        run: |
          ls -la;


      - name: Download Test Report
        uses: actions/download-artifact@v4
        if: success() || failure()
        with:
          name: functional-test-results-${{ matrix.python-version }}


      - name: Trace 'ls -la'
        shell: bash
        run: |
          ls -la;


      - name: Test Report
        uses: dorny/test-reporter@dc3a92680fcc15842eef52e8c4606ea7ce6bd3f3
        id: test-report
        with:
          # artifact: functional-test-results-${{ matrix.python-version }}
          name: Functional Test Report [Python ${{ matrix.python-version }}]
          path: '*.xml'
          reporter: java-junit
          # fail-on-error: false
          use-actions-summary: false


      - name: Trace 'ls -la'
        if: success() || failure()
        shell: bash
        run: |
          ls -la;


      - name: Create Shields.io Endpoint.json
        if: success() || failure()
        shell: bash
        run: |
          echo '
          {
            "schemaVersion": 1,
            "label": "Functional Test",
            "message": "${{ steps.test-report.outputs.passed }} passed | ${{ steps.test-report.outputs.skipped }} skipped | ${{ steps.test-report.outputs.failed }} failed",
            "logoSvg": "<svg xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" viewBox=\"0 0 162.53 196.9\"><defs><linearGradient id=\"a\" x1=\"319.46\" y1=\"219.79\" x2=\"478.86\" y2=\"82.65\" gradientTransform=\"matrix(0.56, 0, 0, -0.57, -8.96, 287.06)\" gradientUnits=\"userSpaceOnUse\"><stop offset=\"0\" stop-color=\"#5a9fd4\"/><stop offset=\"1\" stop-color=\"#306998\"/></linearGradient><linearGradient id=\"b\" x1=\"540.48\" y1=\"-0.35\" x2=\"483.56\" y2=\"80.18\" gradientTransform=\"matrix(0.56, 0, 0, -0.57, -8.96, 287.06)\" gradientUnits=\"userSpaceOnUse\"><stop offset=\"0\" stop-color=\"#ffd43b\"/><stop offset=\"1\" stop-color=\"#ffe873\"/></linearGradient><radialGradient id=\"c\" cx=\"-809.2\" cy=\"196.83\" r=\"42.46\" gradientTransform=\"matrix(0, -0.24, -1.05, 0, 463.94, 150.1)\" gradientUnits=\"userSpaceOnUse\"><stop offset=\"0\" stop-color=\"#b8b8b8\" stop-opacity=\"0.5\"/><stop offset=\"1\" stop-color=\"#7f7f7f\" stop-opacity=\"0\"/></radialGradient></defs><title>python-logo</title><path d=\"M255,157.55a111.94,111.94,0,0,0-18.73,1.6c-16.59,2.93-19.6,9.07-19.6,20.38v14.94h39.2v5H202c-11.39,0-21.37,6.85-24.49,19.88-3.6,14.93-3.76,24.25,0,39.84,2.79,11.61,9.44,19.88,20.84,19.88h13.48V261.13c0-12.94,11.2-24.35,24.49-24.35h39.16a19.75,19.75,0,0,0,19.6-19.92V179.53c0-10.62-9-18.61-19.6-20.38A122.28,122.28,0,0,0,255,157.55Zm-21.2,12a7.47,7.47,0,1,1-7.36,7.49A7.44,7.44,0,0,1,233.83,169.57Z\" transform=\"translate(-174.73 -157.55)\" style=\"fill:url(#a)\"/><path d=\"M299.95,199.45v17.41c0,13.5-11.44,24.86-24.49,24.86H236.3c-10.73,0-19.6,9.18-19.6,19.92V299c0,10.62,9.24,16.87,19.6,19.92,12.41,3.65,24.31,4.31,39.16,0,9.87-2.86,19.6-8.61,19.6-19.92V284H255.9v-5h58.76c11.39,0,15.64-7.95,19.6-19.88,4.09-12.28,3.92-24.09,0-39.84-2.82-11.34-8.19-19.88-19.6-19.88Zm-22,94.54a7.47,7.47,0,1,1-7.36,7.45A7.4,7.4,0,0,1,277.92,294Z\" transform=\"translate(-174.73 -157.55)\" style=\"fill:url(#b)\"/><path d=\"M308.88,344.26c0,5.63-23.52,10.19-52.54,10.19s-52.54-4.56-52.54-10.19,23.52-10.19,52.54-10.19S308.88,338.64,308.88,344.26Z\" transform=\"translate(-174.73 -157.55)\" style=\"opacity:0.44382017850875854;isolation:isolate;fill:url(#c)\"/></svg>",
            "color": "#4584b6",
            "style": "plastic"
          }' > endpoint_functional_${{ matrix.python-version }}.json


      - name: Upload Badge Endpoint json
        uses: actions/upload-artifact@v4
        if: success() || failure()
        with:
          name: functional-test-shield-endpoint-${{ matrix.python-version }}
          path: endpoint_functional_${{ matrix.python-version }}.json



  coverage-report:
    name: Create Coverage report
    needs:
      - unit-test
    if: github.event_name != 'schedule'
    runs-on: ubuntu-latest
    strategy:
      max-parallel: 4
      matrix:
        python-version: ['3.12']
    steps:
    
      - name: Run Tests
        shell: bash
        run: |
          ls -l;

      - name: Download Coverage Artifact
        uses: actions/download-artifact@v4
        with:
          name: coverage-report-${{ matrix.python-version }}
          github-token: ${{ github.token }}

      - name: ls
        shell: bash
        if: success() || failure()
        run: |
          ls -l;

      - name: Code Coverage Report
        uses: irongut/CodeCoverageSummary@v1.3.0
        with:
          filename: coverage.xml
          badge: true
          fail_below_min: true
          format: markdown
          hide_branch_rate: false
          hide_complexity: false
          indicators: true
          output: both
          thresholds: '60 85'


      - name: ls
        shell: bash
        if: success() || failure()
        run: |
          ls -l;


      - name: create status check/comment for code coverage results
        id: jest_coverage_check
        uses: im-open/process-code-coverage-summary@v2.3.0
        if: success() || failure()
        with:
          github-token: ${{ github.token }}
          summary-file: code-coverage-results.md
          create-pr-comment: true
          update-comment-if-one-exists: true
          update-comment-key: "${{ env.GITHUB-JOB }}_${{ env.GITHUB-ACTION }}"

      - name: Upload Coverage Summary
        uses: actions/upload-artifact@v4
        if: success() || failure()
        with:
          name: code-coverage-results-${{ matrix.python-version }}
          path: code-coverage-results.md



  coverage-report-functional:
    name: Create Coverage report (Functional)
    needs:
      - functional-test
    if: github.event_name != 'schedule'
    runs-on: ubuntu-latest
    strategy:
      max-parallel: 4
      matrix:
        python-version: ['3.12']
    steps:
    
      - name: Run Tests
        shell: bash
        run: |
          ls -l;

      - name: Download Coverage Artifact
        uses: actions/download-artifact@v4
        if: success() || failure()
        with:
          name: functional-coverage-report-${{ matrix.python-version }}
          github-token: ${{ github.token }}

      - name: ls
        shell: bash
        if: success() || failure()
        run: |
          ls -l;

      - name: Code Coverage Report
        uses: irongut/CodeCoverageSummary@v1.3.0
        with:
          filename: functional-coverage.xml
          badge: true
          fail_below_min: true
          format: markdown
          hide_branch_rate: false
          hide_complexity: false
          indicators: true
          output: both
          thresholds: '60 85'


      - name: ls
        shell: bash
        if: success() || failure()
        run: |
          ls -l;


      - name: create status check/comment for code coverage results
        id: jest_coverage_check
        uses: im-open/process-code-coverage-summary@v2.3.0
        if: success() || failure()
        with:
          github-token: ${{ github.token }}
          summary-file: code-coverage-results.md
          check-name: 'Functional Code Coverage'
          create-pr-comment: true
          update-comment-if-one-exists: true
          update-comment-key: "${{ env.GITHUB-JOB }}_${{ env.GITHUB-ACTION }}"

      - name: Upload Coverage Summary
        uses: actions/upload-artifact@v4
        if: success() || failure()
        with:
          name: functional-code-coverage-results-${{ matrix.python-version }}
          path: code-coverage-results.md



  badge-endpoint:
    name: Publish Badge endpoint files
    if: ${{ (github.ref_name == 'master' || github.ref_name == 'development') && github.event_name != 'schedule' }}
    needs:
      - unit-test
      - report
    strategy:
      max-parallel: 4
      matrix:
        python-version: ['3.12']
    runs-on: ubuntu-latest
    steps:

      - name: Checkout Endpoint Repo
        uses: actions/checkout@v4
        with:
          repository: 'nofusscomputing/.github'
          ref: 'master'
          token: ${{ secrets.WORKFLOW_TOKEN }}
          path: 'endpoint_publish'
          fetch-depth: '1'
          show-progress: true
          submodules: false


      - name: Create Publish Directories
        shell: bash
        run: |
          echo "[Debug] PWD[${PWD}]";
          cd endpoint_publish;
          echo "[Debug] PWD[${PWD}]";
          mkdir -p repositories/${{ github.repository }}/${{ github.ref_name }};
          ls -la;


      - name: Create Publish Directories
        shell: bash
        run: |
          echo "[Debug] PWD[${PWD}]";
          # cd repositories/${{ github.repository }}/${{ github.ref_name }};
          echo "[Debug] PWD[${PWD}]";


      - name: Download Badge Endpoint json
        uses: actions/download-artifact@v4
        with:
          name: unit-test-shield-endpoint-${{ matrix.python-version }}


      - name: Add endpoint file
        shell: bash
        run: |
          echo "[Debug] PWD[${PWD}]";

          echo "[Debug] **************************** - cd endpoint_publish";

          cd endpoint_publish;

          echo "[Debug] **************************** - ls -la";

          ls -la

          echo "[Debug] ****************************";

          echo "[Debug] PWD[${PWD}]";

          echo "[Debug] **************************** - ls -la ../";

          ls -la ../

          echo "[Debug] **************************** - cp ../endpoint_${{ matrix.python-version }}.json repositories/${{ github.repository }}/${{ github.ref_name }}/badge_endpoint_unit_test.json";

          cp ../endpoint_${{ matrix.python-version }}.json repositories/${{ github.repository }}/${{ github.ref_name }}/badge_endpoint_unit_test.json;

          echo "[Debug] **************************** - ls -la repositories/${{ github.repository }}/${{ github.ref_name }}/";

          ls -la repositories/${{ github.repository }}/${{ github.ref_name }}/;



      - name: Create Shields.io Endpoint.json for coverage
        if: success() || failure()
        shell: bash
        run: |
          echo "[Debug] PWD[${PWD}]";
          cd endpoint_publish;
          echo "[Debug] ****************************";

          echo "[Debug] PWD[${PWD}]";

          echo "[Debug] **************************** - create file";

          echo '
          {
            "schemaVersion": 1,
            "label": "Unit Test Coverage",
            "message": "${{ needs.unit-test.outputs.unit-test-coverage }} Line | ${{ needs.unit-test.outputs.unit-test-branch_coverage }} Branch",
            "logoSvg": "<svg xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" viewBox=\"0 0 162.53 196.9\"><defs><linearGradient id=\"a\" x1=\"319.46\" y1=\"219.79\" x2=\"478.86\" y2=\"82.65\" gradientTransform=\"matrix(0.56, 0, 0, -0.57, -8.96, 287.06)\" gradientUnits=\"userSpaceOnUse\"><stop offset=\"0\" stop-color=\"#5a9fd4\"/><stop offset=\"1\" stop-color=\"#306998\"/></linearGradient><linearGradient id=\"b\" x1=\"540.48\" y1=\"-0.35\" x2=\"483.56\" y2=\"80.18\" gradientTransform=\"matrix(0.56, 0, 0, -0.57, -8.96, 287.06)\" gradientUnits=\"userSpaceOnUse\"><stop offset=\"0\" stop-color=\"#ffd43b\"/><stop offset=\"1\" stop-color=\"#ffe873\"/></linearGradient><radialGradient id=\"c\" cx=\"-809.2\" cy=\"196.83\" r=\"42.46\" gradientTransform=\"matrix(0, -0.24, -1.05, 0, 463.94, 150.1)\" gradientUnits=\"userSpaceOnUse\"><stop offset=\"0\" stop-color=\"#b8b8b8\" stop-opacity=\"0.5\"/><stop offset=\"1\" stop-color=\"#7f7f7f\" stop-opacity=\"0\"/></radialGradient></defs><title>python-logo</title><path d=\"M255,157.55a111.94,111.94,0,0,0-18.73,1.6c-16.59,2.93-19.6,9.07-19.6,20.38v14.94h39.2v5H202c-11.39,0-21.37,6.85-24.49,19.88-3.6,14.93-3.76,24.25,0,39.84,2.79,11.61,9.44,19.88,20.84,19.88h13.48V261.13c0-12.94,11.2-24.35,24.49-24.35h39.16a19.75,19.75,0,0,0,19.6-19.92V179.53c0-10.62-9-18.61-19.6-20.38A122.28,122.28,0,0,0,255,157.55Zm-21.2,12a7.47,7.47,0,1,1-7.36,7.49A7.44,7.44,0,0,1,233.83,169.57Z\" transform=\"translate(-174.73 -157.55)\" style=\"fill:url(#a)\"/><path d=\"M299.95,199.45v17.41c0,13.5-11.44,24.86-24.49,24.86H236.3c-10.73,0-19.6,9.18-19.6,19.92V299c0,10.62,9.24,16.87,19.6,19.92,12.41,3.65,24.31,4.31,39.16,0,9.87-2.86,19.6-8.61,19.6-19.92V284H255.9v-5h58.76c11.39,0,15.64-7.95,19.6-19.88,4.09-12.28,3.92-24.09,0-39.84-2.82-11.34-8.19-19.88-19.6-19.88Zm-22,94.54a7.47,7.47,0,1,1-7.36,7.45A7.4,7.4,0,0,1,277.92,294Z\" transform=\"translate(-174.73 -157.55)\" style=\"fill:url(#b)\"/><path d=\"M308.88,344.26c0,5.63-23.52,10.19-52.54,10.19s-52.54-4.56-52.54-10.19,23.52-10.19,52.54-10.19S308.88,338.64,308.88,344.26Z\" transform=\"translate(-174.73 -157.55)\" style=\"opacity:0.44382017850875854;isolation:isolate;fill:url(#c)\"/></svg>",
            "color": "#4584b6",
            "style": "plastic"
          }' > repositories/${{ github.repository }}/${{ github.ref_name }}/badge_endpoint_coverage.json;

          echo "[Debug] **************************** cat repositories/${{ github.repository }}/${{ github.ref_name }}/badge_endpoint_coverage.json";

          cat repositories/${{ github.repository }}/${{ github.ref_name }}/badge_endpoint_coverage.json;



      - name: Configure git
        shell: bash
        run: |
          git config --global user.email "helpdesk@nofusscomputing.com";
          git config --global user.name "nfc-bot";


      - name: Git add
        id: git-add
        shell: bash
        run: |
          echo "[Debug] PWD[${PWD}]";
          echo "[Debug] ****************************";
          cd endpoint_publish;
          echo "[Debug] ****************************";
          ls -la
          echo "[Debug] ****************************";
          echo "[Debug] PWD[${PWD}]";
          echo "[Debug] ****************************";
          git status;
          echo "[Debug] ****************************";

          if [ "$(git status -s)" ]; then

            echo "changed=true" > $GITHUB_OUTPUT;

            echo "[Info] Changes need to be committed";

          else

            echo "changed=false" > $GITHUB_OUTPUT;

            echo "[Info] NO changes to be committed";

          fi

          echo "[Debug] ****************************";

          git add .


      - name: Git commit
        if: ${{ steps.git-add.outputs.changed == 'true' }}
        shell: bash
        run: |
          echo "[Debug] PWD[${PWD}]";
          echo "[Debug] ****************************";
          cd endpoint_publish;
          echo "[Debug] ****************************";
          ls -la
          echo "[Debug] ****************************";
          echo "[Debug] PWD[${PWD}]";
          echo "[Debug] ****************************";
          git commit -m "chore: add badge endpount file ${{ github.repository }}/${{ github.ref_name }}"


      - name: git push
        if: ${{ steps.git-add.outputs.changed == 'true' }}
        shell: bash
        run: |
          echo "[Debug] PWD[${PWD}]";
          echo "[Debug] ****************************";
          cd endpoint_publish;
          echo "[Debug] ****************************";
          ls -la
          echo "[Debug] ****************************";
          echo "[Debug] PWD[${PWD}]";
          echo "[Debug] ****************************";
          git push



  badge-endpoint-functional:
    name: Publish Badge endpoint files (Functional)
    if: ${{ (github.ref_name == 'master' || github.ref_name == 'development') && github.event_name != 'schedule' }}
    needs:
      - functional-test
      - functional-report
    strategy:
      max-parallel: 4
      matrix:
        python-version: ['3.12']
    runs-on: ubuntu-latest
    steps:

      - name: Checkout Endpoint Repo
        uses: actions/checkout@v4
        with:
          repository: 'nofusscomputing/.github'
          ref: 'master'
          token: ${{ secrets.WORKFLOW_TOKEN }}
          path: 'endpoint_publish'
          fetch-depth: '1'
          show-progress: true
          submodules: false


      - name: Create Publish Directories
        shell: bash
        run: |
          echo "[Debug] PWD[${PWD}]";
          cd endpoint_publish;
          echo "[Debug] PWD[${PWD}]";
          mkdir -p repositories/${{ github.repository }}/${{ github.ref_name }};
          ls -la;


      - name: Create Publish Directories
        shell: bash
        run: |
          echo "[Debug] PWD[${PWD}]";
          # cd repositories/${{ github.repository }}/${{ github.ref_name }};
          echo "[Debug] PWD[${PWD}]";


      - name: Download Badge Endpoint json
        uses: actions/download-artifact@v4
        with:
          name: functional-test-shield-endpoint-${{ matrix.python-version }}


      - name: Add endpoint file
        shell: bash
        run: |
          echo "[Debug] PWD[${PWD}]";

          echo "[Debug] **************************** - cd endpoint_publish";

          cd endpoint_publish;

          echo "[Debug] **************************** - ls -la";

          ls -la

          echo "[Debug] ****************************";

          echo "[Debug] PWD[${PWD}]";

          echo "[Debug] **************************** - ls -la ../";

          ls -la ../

          echo "[Debug] **************************** - cp ../endpoint_functional_${{ matrix.python-version }}.json repositories/${{ github.repository }}/${{ github.ref_name }}/badge_endpoint_functional_test.json";

          cp ../endpoint_functional_${{ matrix.python-version }}.json repositories/${{ github.repository }}/${{ github.ref_name }}/badge_endpoint_functional_test.json;

          echo "[Debug] **************************** - ls -la repositories/${{ github.repository }}/${{ github.ref_name }}/";

          ls -la repositories/${{ github.repository }}/${{ github.ref_name }}/;



      - name: Create Shields.io Endpoint.json for coverage
        if: success() || failure()
        shell: bash
        run: |
          echo "[Debug] PWD[${PWD}]";
          cd endpoint_publish;
          echo "[Debug] ****************************";

          echo "[Debug] PWD[${PWD}]";

          echo "[Debug] **************************** - create file";

          echo '
          {
            "schemaVersion": 1,
            "label": "Functional Test Coverage",
            "message": "${{ needs.functional-test.outputs.functional-test-coverage }} Line | ${{ needs.functional-test.outputs.functional-test-branch_coverage }} Branch",
            "logoSvg": "<svg xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" viewBox=\"0 0 162.53 196.9\"><defs><linearGradient id=\"a\" x1=\"319.46\" y1=\"219.79\" x2=\"478.86\" y2=\"82.65\" gradientTransform=\"matrix(0.56, 0, 0, -0.57, -8.96, 287.06)\" gradientUnits=\"userSpaceOnUse\"><stop offset=\"0\" stop-color=\"#5a9fd4\"/><stop offset=\"1\" stop-color=\"#306998\"/></linearGradient><linearGradient id=\"b\" x1=\"540.48\" y1=\"-0.35\" x2=\"483.56\" y2=\"80.18\" gradientTransform=\"matrix(0.56, 0, 0, -0.57, -8.96, 287.06)\" gradientUnits=\"userSpaceOnUse\"><stop offset=\"0\" stop-color=\"#ffd43b\"/><stop offset=\"1\" stop-color=\"#ffe873\"/></linearGradient><radialGradient id=\"c\" cx=\"-809.2\" cy=\"196.83\" r=\"42.46\" gradientTransform=\"matrix(0, -0.24, -1.05, 0, 463.94, 150.1)\" gradientUnits=\"userSpaceOnUse\"><stop offset=\"0\" stop-color=\"#b8b8b8\" stop-opacity=\"0.5\"/><stop offset=\"1\" stop-color=\"#7f7f7f\" stop-opacity=\"0\"/></radialGradient></defs><title>python-logo</title><path d=\"M255,157.55a111.94,111.94,0,0,0-18.73,1.6c-16.59,2.93-19.6,9.07-19.6,20.38v14.94h39.2v5H202c-11.39,0-21.37,6.85-24.49,19.88-3.6,14.93-3.76,24.25,0,39.84,2.79,11.61,9.44,19.88,20.84,19.88h13.48V261.13c0-12.94,11.2-24.35,24.49-24.35h39.16a19.75,19.75,0,0,0,19.6-19.92V179.53c0-10.62-9-18.61-19.6-20.38A122.28,122.28,0,0,0,255,157.55Zm-21.2,12a7.47,7.47,0,1,1-7.36,7.49A7.44,7.44,0,0,1,233.83,169.57Z\" transform=\"translate(-174.73 -157.55)\" style=\"fill:url(#a)\"/><path d=\"M299.95,199.45v17.41c0,13.5-11.44,24.86-24.49,24.86H236.3c-10.73,0-19.6,9.18-19.6,19.92V299c0,10.62,9.24,16.87,19.6,19.92,12.41,3.65,24.31,4.31,39.16,0,9.87-2.86,19.6-8.61,19.6-19.92V284H255.9v-5h58.76c11.39,0,15.64-7.95,19.6-19.88,4.09-12.28,3.92-24.09,0-39.84-2.82-11.34-8.19-19.88-19.6-19.88Zm-22,94.54a7.47,7.47,0,1,1-7.36,7.45A7.4,7.4,0,0,1,277.92,294Z\" transform=\"translate(-174.73 -157.55)\" style=\"fill:url(#b)\"/><path d=\"M308.88,344.26c0,5.63-23.52,10.19-52.54,10.19s-52.54-4.56-52.54-10.19,23.52-10.19,52.54-10.19S308.88,338.64,308.88,344.26Z\" transform=\"translate(-174.73 -157.55)\" style=\"opacity:0.44382017850875854;isolation:isolate;fill:url(#c)\"/></svg>",
            "color": "#4584b6",
            "style": "plastic"
          }' > repositories/${{ github.repository }}/${{ github.ref_name }}/badge_endpoint_coverage_functional.json;

          echo "[Debug] **************************** cat repositories/${{ github.repository }}/${{ github.ref_name }}/badge_endpoint_coverage_functional.json";

          cat repositories/${{ github.repository }}/${{ github.ref_name }}/badge_endpoint_coverage_functional.json;



      - name: Configure git
        shell: bash
        run: |
          git config --global user.email "helpdesk@nofusscomputing.com";
          git config --global user.name "nfc-bot";


      - name: Git add
        id: git-add
        shell: bash
        run: |
          echo "[Debug] PWD[${PWD}]";
          echo "[Debug] ****************************";
          cd endpoint_publish;
          echo "[Debug] ****************************";
          ls -la
          echo "[Debug] ****************************";
          echo "[Debug] PWD[${PWD}]";
          echo "[Debug] ****************************";
          git status;
          echo "[Debug] ****************************";

          if [ "$(git status -s)" ]; then

            echo "changed=true" > $GITHUB_OUTPUT;

            echo "[Info] Changes need to be committed";

          else

            echo "changed=false" > $GITHUB_OUTPUT;

            echo "[Info] NO changes to be committed";

          fi

          echo "[Debug] ****************************";

          git add .


      - name: Git commit
        if: ${{ steps.git-add.outputs.changed == 'true' }}
        shell: bash
        run: |
          echo "[Debug] PWD[${PWD}]";
          echo "[Debug] ****************************";
          cd endpoint_publish;
          echo "[Debug] ****************************";
          ls -la
          echo "[Debug] ****************************";
          echo "[Debug] PWD[${PWD}]";
          echo "[Debug] ****************************";
          git commit -m "chore: add badge endpount file ${{ github.repository }}/${{ github.ref_name }}"


      - name: git push
        if: ${{ steps.git-add.outputs.changed == 'true' }}
        shell: bash
        run: |
          echo "[Debug] PWD[${PWD}]";
          echo "[Debug] ****************************";
          cd endpoint_publish;
          echo "[Debug] ****************************";
          ls -la
          echo "[Debug] ****************************";
          echo "[Debug] PWD[${PWD}]";
          echo "[Debug] ****************************";
          git push


  vulnerability-scan:
    name: PIP file Scan (requirements.txt)
    runs-on: ubuntu-latest
    needs:
      - init
    permissions:
      contents: read          # Required to checkout and read repo files
      security-events: write  # Required to upload SARIF files to Security tab
    strategy:
      fail-fast: false
      matrix:
        requirements: ${{ fromJSON(needs.init.outputs.requirements_set) }}
    steps:


      - uses: actions/checkout@v4


      - name: Run Trivy vulnerability scanner against ${{ matrix.requirements }}
        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478    # 0.34.2
        with:
          scan-type: 'fs'
          ignore-unfixed: false
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'LOW,MEDIUM,HIGH,CRITICAL'
          scan-ref: ${{ matrix.requirements }}
          exit-code: 0


      - name: Upload ${{ matrix.requirements }} scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'


      - name: Upload scan results ${{ matrix.requirements }} sarif Report
        if: github.event_name != 'schedule'
        uses: actions/upload-artifact@v4
        with:
          name: python-scan-results-${{ matrix.requirements }}-sarif
          path: trivy-results.sarif


      - name: Run Trivy vulnerability scanner against ${{ matrix.requirements }} (json Report)
        if: github.event_name != 'schedule'
        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478    # 0.34.2
        with:
          scan-type: 'fs'
          ignore-unfixed: false
          format: 'json'
          output: 'scan-results.json'
          severity: 'LOW,MEDIUM,HIGH,CRITICAL'
          scan-ref: ${{ matrix.requirements }}
          exit-code: 0


      - name: Upload scan results ${{ matrix.requirements }}(json Report)
        if: github.event_name != 'schedule'
        uses: actions/upload-artifact@v4
        with:
          name: python-scan-results-${{ matrix.requirements }}-json
          path: scan-results.json



  vulnerability-report:
    name: Create Reports
    needs:
      - init
      - vulnerability-scan
    if: github.event_name != 'schedule'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        requirements: ${{ fromJSON(needs.init.outputs.requirements_set) }}
    steps:


      - name: Fetch scan results ${{ matrix.requirements }}(json Report)
        uses: actions/download-artifact@v4
        with:
          name: python-scan-results-${{ matrix.requirements }}-json


      - name: Create Vulnerabilities (Critical/High)
        run: |
          echo "[Debug] jq -r '.Results'=$(jq -r '.Results' scan-results.json)";

          if [ "$(jq -r '.Results' scan-results.json)" != 'null' ] && [ "0$(jq -r '.Results' scan-results.json)" != '0' ]; then

            if [ "$(jq -r '.Results[] | .Vulnerabilities' scan-results.json)" != 'null' ] && [ "0$(jq -r '.Results[] | .Vulnerabilities' scan-results.json)" != '0' ]; then

              not_empty="$(jq -r '.Results[] | .Vulnerabilities[]' scan-results.json)";

            else

              not_empty="";

            fi

          else

            not_empty="";

          fi

          echo "[Debug] not_empty=${not_empty}";

          jq -r '
          [
          "# Python Scan Results (${{ matrix.requirements }})",
          "",
          "**Scan Date:** _" + ( .CreatedAt // "" ) + "_",
          "**File:** _" + ( .ArtifactName // "" ) + "_",
          ""
          ] | join("\n")
          ' scan-results.json > vulnerability-report.md

          if [ "$not_empty" ]; then
            jq -r '
            def hr(severity):
            if severity == "HIGH" or severity == "CRITICAL" then true else false end;
            def to_md:
            "| " + (.VulnerabilityID // "") + " | " + (.PkgName // "") + " | " + (.InstalledVersion // "") + " | " + (.Severity // "") + " | " + (.Title // "") + " |";
            [
            "## High and Critical Vulnerabilities - ${{ matrix.requirements }}",
            "",
            "| Vulnerability ID | Package | Version | Severity | Description |",
            "| --------- | ----- | ----- | ----- | -------|",
            (.Results[] | .Vulnerabilities[] | select(hr(.Severity)) | to_md),
            ""
            ] | join("\n")
            ' scan-results.json >> vulnerability-report.md

          else

            echo "**Nothing Found**" >> vulnerability-report.md

          fi;



      - name: Create Full Vulnerabilities
        run: |
          echo "[Debug] jq -r '.Results'=$(jq -r '.Results' scan-results.json)";

          if [ "$(jq -r '.Results' scan-results.json)" != 'null' ] && [ "0$(jq -r '.Results' scan-results.json)" != '0' ]; then

            if [ "$(jq -r '.Results[] | .Vulnerabilities' scan-results.json)" != 'null' ] && [ "0$(jq -r '.Results[] | .Vulnerabilities' scan-results.json)" != '0' ]; then

              not_empty="$(jq -r '.Results[] | .Vulnerabilities[]' scan-results.json)";

            else

              not_empty="";

            fi

          else

            not_empty="";

          fi


          echo "[Debug] not_empty=${not_empty}";


          jq -r '
          [
          "# Full Scan Results - ${{ matrix.requirements }}",
          "",
          "**Scan Date:** _" + ( .CreatedAt // "" ) + "_",
          "**File:** _" + ( .ArtifactName // "" ) + "_",
          ""
          ] | join("\n")
          ' scan-results.json > full-vulnerability-report.md

          if [ "$not_empty" ]; then
            jq -r '
            def hr(severity):
            if severity == "HIGH" or severity == "CRITICAL" then true else true end;
            def to_md:
            "| " + (.VulnerabilityID // "") + " | " + (.PkgName // "") + " | " + (.InstalledVersion // "") + " | " + (.Severity // "") + " | " + (.Title // "") + " |";
            [
            "## Vulnerabilities",
            "",
            "| Vulnerability ID | Package | Version | Severity | Description |",
            "| --------- | ----- | ----- | ----- | -------|",
            (.Results[] | .Vulnerabilities[] | select(.Severity) | to_md),
            ""
            ] | join("\n")
            ' scan-results.json >> full-vulnerability-report.md

          else

            echo "**Nothing Found**" >> full-vulnerability-report.md

          fi;


      - name: Upload scan results
        uses: actions/upload-artifact@v4
        with:
          name: python-vulnerability-report-${{ matrix.requirements }}
          path: vulnerability-report.md


      - name: Upload scan results
        uses: actions/upload-artifact@v4
        with:
          name: python-vulnerability-report-full-${{ matrix.requirements }}
          path: full-vulnerability-report.md


      - uses: dtinth/markdown-report-action@v1
        with:
          name: Python Vulnerability Report - ${{ matrix.requirements }}
          title: Python Vulnerability Report - ${{ matrix.requirements }}
          body-file: full-vulnerability-report.md



  pull-request-report-comment:
    if: ${{ github.ref_type != 'tag' && github.event_name != 'schedule' }}
    needs:
      - init
      - vulnerability-scan
      - vulnerability-report
    runs-on: ubuntu-latest
    name: Comment on Pull Request (Python Scan)
    strategy:
      fail-fast: false
      matrix:
        requirements: ${{ fromJSON(needs.init.outputs.requirements_set) }}
    steps:


      - name: Find Current Pull Request
        uses: jwalton/gh-find-current-pr@89ee5799558265a1e0e31fab792ebb4ee91c016b    #v1.3.3
        id: finder
        # with:
        #   sha: ${{ github.event.pull_request.head.sha }}


      - name: Fetch Vulnerability Report
        if: ${{ steps.finder.outputs.pr != '' }}
        uses: actions/download-artifact@v4
        with:
          name: python-vulnerability-report-${{ matrix.requirements }}


      - name: Capture scan results
        if: ${{ steps.finder.outputs.pr != '' }}
        run: |
          content=$(cat vulnerability-report.md | head -c 65000)
          echo "report<<EOF" >> $GITHUB_ENV
          echo "$content" >> $GITHUB_ENV
          echo "EOF" >> $GITHUB_ENV


      - name: Comment scan results on PR
        if: ${{ steps.finder.outputs.pr != '' }}
        uses: marocchino/sticky-pull-request-comment@v2
        with:
          number: ${{ steps.finder.outputs.pr }}
          header: Python ${{ matrix.requirements }} Scan Results
          message: |
            ${{ env.report }}