fix(zap): Update runs-on to ubuntu-22.04, Add retry mechanism, Modify run-ci command, Remove --wait flag

manoelhc commented 1 month ago

Description

Updated the runs-on value to ubuntu-22.04 in the .github/workflows/zap-scanner.yaml file
Added a retry mechanism to wait for the web application to start before running ZAP scan in the .github/workflows/zap-scanner.yaml file
Modified the run-ci command in the ZAP Scan job to remove the --wait flag in the .github/workflows/zap-scanner.yaml file
Removed the --wait flag from the run-ci command in the justfile

Changes walkthrough 📝

Relevant files

Enhancement

zap-scanner.yaml `Updated runs-on to ubuntu-22.04, Added retry mechanism, Modified` `run-ci command` .github/workflows/zap-scanner.yaml ['Updated the `runs-on` value to `ubuntu-22.04`', 'Added a retry mechanism to wait for the web application to start before running ZAP scan', 'Modified the `run-ci` command in the `ZAP Scan` job to remove the `--wait` flag']	+11/-3
justfile `Removed --wait flag from run-ci command` justfile ['Removed the `--wait` flag from the `run-ci` command']	+2/-2

Summary by Sourcery

This pull request updates the ZAP Scan GitHub Action workflow to run on a specific feature branch, changes the runner to 'ubuntu-22.04', and adds a step to ensure the web application is running before starting the ZAP scan. Additionally, it modifies the 'justfile' to remove the '--wait' flag from the 'docker-compose up' command in the 'run-ci' task.

CI:
- Updated the ZAP Scan GitHub Action workflow to run on the 'feat/fix-zap-tests' branch instead of 'main'.
- Changed the runner for the ZAP Scan job from 'ubuntu-latest' to 'ubuntu-22.04'.
- Added a step to wait for the web application to start before proceeding with the ZAP scan, including retry logic.

Summary by CodeRabbit

Chores
- Updated CI workflow to use ubuntu-22.04 for better compatibility.
- Improved ZAP scan workflow by adding a script to ensure the web application starts before scanning.

codecov[bot] commented 1 month ago

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 97.81%. Comparing base (cb8fa08) to head (cfa2159).

Additional details and impacted files

```diff @@ Coverage Diff @@ ## main #88 +/- ## ======================================= Coverage 97.81% 97.81% ======================================= Files 10 10 Lines 411 411 Branches 76 76 ======================================= Hits 402 402 Misses 9 9 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

sourcery-ai[bot] commented 1 month ago

Reviewer's Guide by Sourcery

This pull request updates the ZAP scan workflow and the justfile to ensure the web application starts correctly before running the ZAP scan. The changes include modifying the GitHub Actions workflow to wait for the web application to be ready and updating the justfile to remove the --wait flag from the docker-compose command.

File-Level Changes

Files	Changes
`.github/workflows/zap-scanner.yaml` `justfile`	Updated the ZAP scan workflow and justfile to ensure the web application starts correctly before running the ZAP scan.

Tips

- Trigger a new Sourcery review by commenting `@sourcery-ai review` on the pull request. - You can change your review settings at any time by accessing your [dashboard](https://sourcery.ai/dashboard): - Enable or disable the Sourcery-generated pull request summary or reviewer's guide; - Change the review language; - You can always [contact us](mailto:support@sourcery.ai) if you have any questions or feedback.

deepsource-io[bot] commented 1 month ago

Here's the code health analysis summary for commits cb8fa08..cfa2159. View details on DeepSource ↗.

Analysis Summary

Analyzer	Status	Summary	Link
Python	✅ Success		View Check ↗
Test coverage	✅ Success		View Check ↗

Code Coverage Report

Metric	Aggregate	Python
Branch Coverage	87.9%	87.9%
Condition Coverage	87.9%	87.9%
Composite Coverage	96.2%	96.2%
Line Coverage	97.5%	97.5%

💡 If you’re a repository administrator, you can configure the quality gates from the settings.

penify-dev[bot] commented 1 month ago

PR Review 🔍

⏱️ Estimated effort to review [1-5]	2, because the changes are straightforward and well-documented in the description.
🧪 Relevant tests	No
⚡ Possible issues	None
🔒 Security concerns	No

coderabbitai[bot] commented 1 month ago

Walkthrough

The recent updates focus on enhancing the .github/workflows/zap-scanner.yaml file to improve the ZAP scanning process. Key changes include altering the branch trigger, updating the operating system to ubuntu-22.04, and adding a script to ensure the web application starts before running the ZAP scan. Additionally, the justfile has been modified to streamline the run-ci command by removing the --wait option from docker-compose up.

Changes

File	Change Summary
`.github/workflows/zap-scanner.yaml`	Changed branch trigger from `main` to `feat/fix-zap-tests`, updated OS to `ubuntu-22.04`, added script to wait for web app
`.github/workflows/zap-scanner.yaml`	Changed OS to `ubuntu-22.04`, added script to wait for web app using `curl --retry`
`justfile`	Removed `--wait` option from `docker-compose up` in `run-ci` command

Sequence Diagram(s) (Beta)

sequenceDiagram
    participant Developer
    participant GitHub Actions
    participant Web Application
    participant ZAP Scanner

    Developer->>+GitHub Actions: Push to `feat/fix-zap-tests`
    GitHub Actions->>+Web Application: Start application
    loop Retry 5 times
        GitHub Actions->>Web Application: Check if started
        Web Application-->>GitHub Actions: Response
    end
    GitHub Actions->>+ZAP Scanner: Run ZAP scan
    ZAP Scanner-->>GitHub Actions: Scan results
    GitHub Actions-->>Developer: CI/CD pipeline results

Tips

### Chat There are 3 ways to chat with [CodeRabbit](https://coderabbit.ai): - Review comments: Directly reply to a review comment made by CodeRabbit. Example: - `I pushed a fix in commit .` - `Generate unit testing code for this file.` - `Open a follow-up GitHub issue for this discussion.` - Files and specific lines of code (under the "Files changed" tab): Tag `@coderabbitai` in a new review comment at the desired location with your query. Examples: - `@coderabbitai generate unit testing code for this file.` - `@coderabbitai modularize this function.` - PR comments: Tag `@coderabbitai` in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples: - `@coderabbitai generate interesting stats about this repository and render them as a table.` - `@coderabbitai show all the console.log statements in this repository.` - `@coderabbitai read src/utils.ts and generate unit testing code.` - `@coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.` - `@coderabbitai help me debug CodeRabbit configuration file.` Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. ### CodeRabbit Commands (invoked as PR comments) - `@coderabbitai pause` to pause the reviews on a PR. - `@coderabbitai resume` to resume the paused reviews. - `@coderabbitai review` to trigger an incremental review. This is useful when automatic reviews are disabled for the repository. - `@coderabbitai full review` to do a full review from scratch and review all the files again. - `@coderabbitai summary` to regenerate the summary of the PR. - `@coderabbitai resolve` resolve all the CodeRabbit review comments. - `@coderabbitai configuration` to show the current CodeRabbit configuration for the repository. - `@coderabbitai help` to get help. Additionally, you can add `@coderabbitai ignore` anywhere in the PR description to prevent this PR from being reviewed. ### CodeRabbit Configration File (`.coderabbit.yaml`) - You can programmatically configure CodeRabbit by adding a `.coderabbit.yaml` file to the root of your repository. - Please see the [configuration documentation](https://docs.coderabbit.ai/guides/configure-coderabbit) for more information. - If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: `# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json` ### Documentation and Community - Visit our [Documentation](https://coderabbit.ai/docs) for detailed information on how to use CodeRabbit. - Join our [Discord Community](https://discord.com/invite/GsXnASn26c) to get help, request features, and share feedback. - Follow us on [X/Twitter](https://twitter.com/coderabbitai) for updates and announcements.

penify-dev[bot] commented 1 month ago

PR Code Suggestions ✨

Category	Suggestion	Score
Best practice	Improve the run-ci command by adding a timeout and a more descriptive failure message ___ Consider improving the retry mechanism by adding a timeout and a more informative message in the run-ci command. [.github/workflows/zap-scanner.yaml [17-24]](https://github.com/manoelhc/test-actions/pull/88/files#diff-19112397a9c861b0f3d264cfbc9d122ada19a58c894eb11ae0c4a1c770ab9cc7R17-R24) ```diff + for i in {1..5}; do + sleep 5 -+ curl -s -o /dev/null -w "%{http_code}" http://localhost:8443/ && exit 0 ++ response_code=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:8443) ++ if [ $response_code -eq 200 ]; then ++ exit 0 ++ fi + done -+ exit 1 ++ echo "Web application did not start successfully after multiple retries." && exit 1 ``` Suggestion importance[1-10]: 8 Why: The suggestion enhances the reliability of the retry mechanism in the run-ci command by introducing a timeout and a more informative failure message.	8
Maintainability	Remove the --wait flag from the run-ci command to align with the workflow changes ___ Update the run-ci command to remove the --wait flag and align it with the changes made in the workflow file. [justfile [54-55]](https://github.com/manoelhc/test-actions/pull/88/files#diff-deb9bb56fb122db0b605aa5b63f95a4665c905b18dd670e1fa6c877576a94ff1R54-R55) ```diff ++run-ci: ++ docker-compose up -d - ``` Suggestion importance[1-10]: 5 Why: The suggestion aims to maintain consistency between the workflow file and the run-ci command by removing the --wait flag.	5

github-actions[bot] commented 1 month ago

Tag v0.13.1 (branch: main, SHA: a06b5fa) Added.

codacy-production[bot] commented 1 month ago

Coverage summary from Codacy

See diff coverage on Codacy

Coverage variation	Diff coverage
:white_check_mark: +0.00% (target: -1.00%)	:white_check_mark: ∅

Coverage variation details

| | Coverable lines | Covered lines | Coverage | | ------------- | ------------- | ------------- | ------------- | | Common ancestor commit (cb8fa08d55e0aac9dbf3c56a35dd3a286c297bae) | 407 | 397 | 97.54% | | | Head commit (cfa2159f09daa9e243cb95777a296bd8b1f79cb1) | 407 (+0) | 397 (+0) | 97.54% (**+0.00%**) | **Coverage variation** is the difference between the coverage for the head and common ancestor commits of the pull request branch: ` - `

Diff coverage details

| | Coverable lines | Covered lines | Diff coverage | | ------------- | ------------- | ------------- | ------------- | | Pull request (#88) | 0 | 0 | **∅ (not applicable)** | **Diff coverage** is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: `/ * 100%`