pii_safe_schema 1.3.0 → 1.3.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.github/workflows/default.yml +66 -0
- data/.github/workflows/licenses.yml +46 -0
- data/.github/workflows/security-check.yml +30 -0
- data/.rubocop.yml +4 -0
- data/.ruby-version +1 -1
- data/CHANGELOG.md +16 -0
- data/README.md +3 -2
- data/lib/pii_safe_schema/configuration.rb +4 -5
- data/lib/pii_safe_schema/migration_generator.rb +3 -5
- data/lib/pii_safe_schema/pii_column.rb +4 -2
- data/lib/pii_safe_schema/version.rb +1 -1
- data/lib/pii_safe_schema.rb +1 -1
- data/lib/tasks/pii_safe_schema.rake +4 -3
- data/pii_safe_schema.gemspec +2 -1
- metadata +15 -26
- data/.circleci/config.yml +0 -118
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 7e1a5ae623714b4211bac604819cf2c5f04c3a7b2354678414b12432c216fcec
|
|
4
|
+
data.tar.gz: 751ad4aa17a3137e05c604edd3b0db961aadbb12f3d6e3d0d58141ab4e899246
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 03e97b60df41a59c8ef8e90575c2d9d68c67b400e7c0eaec7aca093943d68493bfa465fe20666ec926ad830884070b7417027da5cfb886072d506649be616741
|
|
7
|
+
data.tar.gz: bbcb8be4a11c7f2ae750cc3d967d2cc67ec968bf3dbc1058a487624d733cd7fe0a9ede3f153aeaf296d87d55d55ef8fbad8fe7195de0ff6062ea95b3b94f8d20
|
|
@@ -0,0 +1,66 @@
|
|
|
1
|
+
name: Default
|
|
2
|
+
|
|
3
|
+
# This workflow runs on all pushes to the repo so we can test changes and provide
|
|
4
|
+
# fast feedback. It also gets run when a pull request is created so that we can
|
|
5
|
+
# run the Sonarqube quality gate (which needs information from the PR). Subsequent
|
|
6
|
+
# pushes to the branch will provide PR information of any open PRs.
|
|
7
|
+
on:
|
|
8
|
+
push:
|
|
9
|
+
pull_request:
|
|
10
|
+
types: [opened, reopened]
|
|
11
|
+
|
|
12
|
+
concurrency:
|
|
13
|
+
group: default-${{ github.ref }}
|
|
14
|
+
cancel-in-progress: true
|
|
15
|
+
|
|
16
|
+
jobs:
|
|
17
|
+
preflight_check:
|
|
18
|
+
name: Preflight Check
|
|
19
|
+
runs-on: ubuntu-latest
|
|
20
|
+
steps:
|
|
21
|
+
# Need to fetch all refs, so we can check if the version has been bumped
|
|
22
|
+
- uses: actions/checkout@v2
|
|
23
|
+
with:
|
|
24
|
+
fetch-depth: 0
|
|
25
|
+
|
|
26
|
+
- uses: ruby/setup-ruby@v1
|
|
27
|
+
with:
|
|
28
|
+
bundler-cache: true
|
|
29
|
+
|
|
30
|
+
- name: Lint
|
|
31
|
+
uses: wealthsimple/toolbox-script@v1
|
|
32
|
+
with:
|
|
33
|
+
script: toolbox.ruby.lint.run();
|
|
34
|
+
|
|
35
|
+
- name: Test
|
|
36
|
+
uses: wealthsimple/toolbox-script@v1
|
|
37
|
+
with:
|
|
38
|
+
script: toolbox.ruby.test.run();
|
|
39
|
+
|
|
40
|
+
publish:
|
|
41
|
+
name: Publish package
|
|
42
|
+
runs-on: ubuntu-latest
|
|
43
|
+
if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master'
|
|
44
|
+
needs:
|
|
45
|
+
- preflight_check
|
|
46
|
+
steps:
|
|
47
|
+
- uses: actions/checkout@v2
|
|
48
|
+
|
|
49
|
+
- uses: ruby/setup-ruby@v1
|
|
50
|
+
with:
|
|
51
|
+
bundler-cache: true
|
|
52
|
+
|
|
53
|
+
- name: Release the gem
|
|
54
|
+
run: |
|
|
55
|
+
mkdir -p ~/.gem
|
|
56
|
+
cat << EOF > ~/.gem/credentials
|
|
57
|
+
---
|
|
58
|
+
:github: Bearer ${GITHUB_TOKEN}
|
|
59
|
+
:rubygems_api_key: ${RUBYGEMS_API_KEY}
|
|
60
|
+
EOF
|
|
61
|
+
chmod 0600 ~/.gem/credentials
|
|
62
|
+
git config user.email "noreply@wealthsimple.com"
|
|
63
|
+
git config user.name "Wolfbot"
|
|
64
|
+
bundle exec rake release
|
|
65
|
+
env:
|
|
66
|
+
RUBYGEMS_API_KEY: ${{ secrets.RUBYGEMS_API_KEY }}
|
|
@@ -0,0 +1,46 @@
|
|
|
1
|
+
name: Save licenses report
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
push:
|
|
5
|
+
branches:
|
|
6
|
+
- main
|
|
7
|
+
- master
|
|
8
|
+
workflow_dispatch:
|
|
9
|
+
|
|
10
|
+
concurrency:
|
|
11
|
+
group: licenses-${{ github.ref }}
|
|
12
|
+
cancel-in-progress: true
|
|
13
|
+
|
|
14
|
+
jobs:
|
|
15
|
+
license_report:
|
|
16
|
+
name: Push license report to S3
|
|
17
|
+
runs-on: ubuntu-latest
|
|
18
|
+
steps:
|
|
19
|
+
- uses: actions/checkout@v2
|
|
20
|
+
|
|
21
|
+
- name: Configure AWS Credentials
|
|
22
|
+
uses: aws-actions/configure-aws-credentials@v1
|
|
23
|
+
with:
|
|
24
|
+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
|
|
25
|
+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
|
26
|
+
aws-region: us-east-1
|
|
27
|
+
role-to-assume: ${{ secrets.ACTIONS_GITHUB_INTSVC_ROLE_TO_ASSUME }}
|
|
28
|
+
role-skip-session-tagging: true
|
|
29
|
+
role-duration-seconds: 900
|
|
30
|
+
|
|
31
|
+
- uses: ruby/setup-ruby@v1
|
|
32
|
+
with:
|
|
33
|
+
bundler-cache: true
|
|
34
|
+
env:
|
|
35
|
+
BUNDLE_GEMS__CONTRIBSYS__COM:
|
|
36
|
+
${{ secrets.BUNDLE_GEMS__CONTRIBSYS__COM }}
|
|
37
|
+
BUNDLE_NEXUS__IAD__W10EXTERNAL__COM:
|
|
38
|
+
${{ secrets.BUNDLE_NEXUS__IAD__W10EXTERNAL__COM }}
|
|
39
|
+
BUNDLE_GITHUB__COM:
|
|
40
|
+
${{ secrets.WOLFBOT_GITHUB_ACTIONS_TOKEN }}:x-oauth-basic
|
|
41
|
+
|
|
42
|
+
- name: Build and Push Report
|
|
43
|
+
uses: wealthsimple/toolbox-script@v1
|
|
44
|
+
with:
|
|
45
|
+
script: toolbox.licensed.run()
|
|
46
|
+
|
|
@@ -0,0 +1,30 @@
|
|
|
1
|
+
name: Security Check
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
schedule:
|
|
5
|
+
- cron: '15 11 * * *' # 11:15 am UTC: 6:15 am EST / 7:15 am EDT
|
|
6
|
+
|
|
7
|
+
concurrency:
|
|
8
|
+
group: security-${{ github.ref }}
|
|
9
|
+
cancel-in-progress: true
|
|
10
|
+
|
|
11
|
+
jobs:
|
|
12
|
+
security_check:
|
|
13
|
+
name: Security Check
|
|
14
|
+
runs-on: ubuntu-latest
|
|
15
|
+
steps:
|
|
16
|
+
- uses: actions/checkout@v2
|
|
17
|
+
- uses: ruby/setup-ruby@v1
|
|
18
|
+
with:
|
|
19
|
+
bundler-cache: true
|
|
20
|
+
env:
|
|
21
|
+
BUNDLE_GEMS__CONTRIBSYS__COM:
|
|
22
|
+
${{ secrets.BUNDLE_GEMS__CONTRIBSYS__COM }}
|
|
23
|
+
BUNDLE_NEXUS__IAD__W10EXTERNAL__COM:
|
|
24
|
+
${{ secrets.BUNDLE_NEXUS__IAD__W10EXTERNAL__COM }}
|
|
25
|
+
BUNDLE_GITHUB__COM:
|
|
26
|
+
${{ secrets.WOLFBOT_GITHUB_ACTIONS_TOKEN }}:x-oauth-basic
|
|
27
|
+
- name: Security Check
|
|
28
|
+
uses: wealthsimple/toolbox-script@v1
|
|
29
|
+
with:
|
|
30
|
+
script: toolbox.ruby.security.run();
|
data/.rubocop.yml
CHANGED
data/.ruby-version
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
2.
|
|
1
|
+
2.7.2
|
data/CHANGELOG.md
CHANGED
|
@@ -4,6 +4,22 @@ All notable changes to this project will be documented in this file.
|
|
|
4
4
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
5
5
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
6
6
|
|
|
7
|
+
## 1.3.4 - 2021-10-21
|
|
8
|
+
### Changed
|
|
9
|
+
- Switched to Github Actions
|
|
10
|
+
|
|
11
|
+
## 1.3.3 - 2021-03-15
|
|
12
|
+
### Changed
|
|
13
|
+
- Pull CI images from ECR repository
|
|
14
|
+
|
|
15
|
+
## 1.3.2 - 2021-03-15
|
|
16
|
+
### Changed
|
|
17
|
+
- Update development to Ruby 2.7.2
|
|
18
|
+
|
|
19
|
+
## 1.3.1 - 2019-11-06
|
|
20
|
+
### Fixed
|
|
21
|
+
- Passing arguments to `rake pii_safe_schema:generate_migrations` actually works
|
|
22
|
+
|
|
7
23
|
## 1.3.0 - 2019-11-04
|
|
8
24
|
### Added
|
|
9
25
|
- Can pass explicitly annotate PII columns from the command line as arguments when using `rake pii_safe_schema:generate_migrations`.
|
data/README.md
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
|
-
# PII Safe Schema
|
|
1
|
+
# PII Safe Schema
|
|
2
|
+
|
|
2
3
|
|
|
3
4
|
Schema migration tool for checking and adding comments on *Personally Identifiable Information* (PII) columns in Rails.
|
|
4
5
|
|
|
@@ -96,4 +97,4 @@ git clone https://github.com/wealthsimple/pii_safe_schema.git
|
|
|
96
97
|
cd pii_safe_schema
|
|
97
98
|
bundle install
|
|
98
99
|
bundle exec rspec
|
|
99
|
-
```
|
|
100
|
+
```
|
|
@@ -27,11 +27,10 @@ module PiiSafeSchema
|
|
|
27
27
|
end
|
|
28
28
|
|
|
29
29
|
def datadog_client
|
|
30
|
-
@datadog_client ||=
|
|
31
|
-
KNOWN_DD_CLIENTS.
|
|
32
|
-
|
|
30
|
+
@datadog_client ||=
|
|
31
|
+
KNOWN_DD_CLIENTS.find do |client|
|
|
32
|
+
client.safe_constantize if defined?(client)
|
|
33
33
|
end
|
|
34
|
-
end
|
|
35
34
|
end
|
|
36
35
|
|
|
37
36
|
def ignore_tables
|
|
@@ -47,7 +46,7 @@ module PiiSafeSchema
|
|
|
47
46
|
def validate_ignore(ignore_params)
|
|
48
47
|
raise_config_error(:ignore) unless ignore_params.is_a?(Hash)
|
|
49
48
|
|
|
50
|
-
ignore_params.
|
|
49
|
+
ignore_params.each_value do |ip|
|
|
51
50
|
raise_config_error(:ignore) unless valid_column_list?(ip) || ip == :*
|
|
52
51
|
end
|
|
53
52
|
true
|
|
@@ -18,9 +18,7 @@ module PiiSafeSchema
|
|
|
18
18
|
migration_file = generator.create_migration_file
|
|
19
19
|
file_lines = File.open(migration_file, 'r').read.split("\n")
|
|
20
20
|
change_line = file_lines.find_index { |i| /def change/.match(i) }
|
|
21
|
-
new_contents = file_lines[0..change_line] +
|
|
22
|
-
generated_lines +
|
|
23
|
-
file_lines[change_line + 1..-1]
|
|
21
|
+
new_contents = file_lines[0..change_line] + generated_lines + file_lines[change_line + 1..]
|
|
24
22
|
|
|
25
23
|
File.open(migration_file, 'w') do |f|
|
|
26
24
|
f.write(new_contents.join("\n"))
|
|
@@ -33,8 +31,8 @@ module PiiSafeSchema
|
|
|
33
31
|
def generate_migration_lines(table, columns)
|
|
34
32
|
migration_lines = columns.map do |c|
|
|
35
33
|
"#{' ' * (safety_assured? ? 6 : 4)}"\
|
|
36
|
-
|
|
37
|
-
|
|
34
|
+
"change_column :#{table}, :#{c.column.name}, :#{c.column.type}, "\
|
|
35
|
+
"comment: \'#{c.suggestion.to_json}\'"\
|
|
38
36
|
end
|
|
39
37
|
wrap_in_safety_assured(migration_lines)
|
|
40
38
|
end
|
|
@@ -15,11 +15,13 @@ module PiiSafeSchema
|
|
|
15
15
|
end
|
|
16
16
|
|
|
17
17
|
def from_column_name(table:, column:, suggestion:)
|
|
18
|
-
|
|
18
|
+
activerecord_column = connection.columns(table.to_s).find { |c| c.name == column.to_s }
|
|
19
|
+
|
|
20
|
+
unless activerecord_column
|
|
19
21
|
raise InvalidColumnError, "column \"#{column}\" does not exist for table \"#{table}\""
|
|
20
22
|
end
|
|
21
23
|
|
|
22
|
-
new(table: table, column:
|
|
24
|
+
new(table: table, column: activerecord_column, suggestion: suggestion)
|
|
23
25
|
end
|
|
24
26
|
|
|
25
27
|
private
|
data/lib/pii_safe_schema.rb
CHANGED
|
@@ -55,7 +55,7 @@ module PiiSafeSchema
|
|
|
55
55
|
end
|
|
56
56
|
end
|
|
57
57
|
|
|
58
|
-
def self.print_help!(do_exit: true)
|
|
58
|
+
def self.print_help!(do_exit: true)
|
|
59
59
|
puts <<~HELPMSG # rubocop:disable Rails/Output
|
|
60
60
|
Usage:
|
|
61
61
|
rake pii_safe_schema:generate_migrations [table:column:annotation_type] ...
|
|
@@ -9,8 +9,9 @@ namespace :pii_safe_schema do
|
|
|
9
9
|
PiiSafeSchema.generate_migrations(additional_columns)
|
|
10
10
|
end
|
|
11
11
|
|
|
12
|
+
exit(0) # forces rake to stop after this and not assume args are tasks
|
|
12
13
|
rescue ActiveRecord::StatementInvalid, PiiSafeSchema::InvalidColumnError => e
|
|
13
|
-
raise e if e.
|
|
14
|
+
raise e if e.instance_of?(ActiveRecord::StatementInvalid) && e.cause.class != PG::UndefinedTable
|
|
14
15
|
|
|
15
16
|
puts <<~HEREDOC
|
|
16
17
|
Unable to generate PII annotation migration. Either the underlying table or column does not exist:
|
|
@@ -19,7 +20,7 @@ namespace :pii_safe_schema do
|
|
|
19
20
|
|
|
20
21
|
Please create the table & columns first, running their migrations, before attempting to use the pii_safe_schema generator.
|
|
21
22
|
HEREDOC
|
|
22
|
-
|
|
23
|
-
exit(
|
|
23
|
+
|
|
24
|
+
exit(1) # forces rake to stop after this and not assume args are tasks
|
|
24
25
|
end
|
|
25
26
|
end
|
data/pii_safe_schema.gemspec
CHANGED
|
@@ -10,6 +10,8 @@ Gem::Specification.new do |s|
|
|
|
10
10
|
|
|
11
11
|
s.summary = 'Schema migration tool for checking and adding comments on PII columns.'
|
|
12
12
|
s.homepage = 'https://github.com/wealthsimple/pii_safe_schema'
|
|
13
|
+
s.license = "MIT"
|
|
14
|
+
s.required_ruby_version = Gem::Requirement.new(">= 2.6")
|
|
13
15
|
|
|
14
16
|
s.files = `git ls-files -z`.split("\x0").reject do |f|
|
|
15
17
|
f.match(%r{^(test|spec|features)/})
|
|
@@ -25,7 +27,6 @@ Gem::Specification.new do |s|
|
|
|
25
27
|
|
|
26
28
|
s.add_development_dependency 'bundler', '>= 1.16'
|
|
27
29
|
s.add_development_dependency 'bundler-audit'
|
|
28
|
-
s.add_development_dependency 'coveralls'
|
|
29
30
|
s.add_development_dependency 'dogstatsd-ruby'
|
|
30
31
|
s.add_development_dependency 'git'
|
|
31
32
|
s.add_development_dependency 'guard-rspec'
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: pii_safe_schema
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 1.3.
|
|
4
|
+
version: 1.3.4
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Alexi Garrow
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: exe
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date:
|
|
11
|
+
date: 2021-12-15 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: activesupport
|
|
@@ -92,20 +92,6 @@ dependencies:
|
|
|
92
92
|
- - ">="
|
|
93
93
|
- !ruby/object:Gem::Version
|
|
94
94
|
version: '0'
|
|
95
|
-
- !ruby/object:Gem::Dependency
|
|
96
|
-
name: coveralls
|
|
97
|
-
requirement: !ruby/object:Gem::Requirement
|
|
98
|
-
requirements:
|
|
99
|
-
- - ">="
|
|
100
|
-
- !ruby/object:Gem::Version
|
|
101
|
-
version: '0'
|
|
102
|
-
type: :development
|
|
103
|
-
prerelease: false
|
|
104
|
-
version_requirements: !ruby/object:Gem::Requirement
|
|
105
|
-
requirements:
|
|
106
|
-
- - ">="
|
|
107
|
-
- !ruby/object:Gem::Version
|
|
108
|
-
version: '0'
|
|
109
95
|
- !ruby/object:Gem::Dependency
|
|
110
96
|
name: dogstatsd-ruby
|
|
111
97
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -200,22 +186,22 @@ dependencies:
|
|
|
200
186
|
name: rspec
|
|
201
187
|
requirement: !ruby/object:Gem::Requirement
|
|
202
188
|
requirements:
|
|
203
|
-
- - ">="
|
|
204
|
-
- !ruby/object:Gem::Version
|
|
205
|
-
version: '3.0'
|
|
206
189
|
- - "<"
|
|
207
190
|
- !ruby/object:Gem::Version
|
|
208
191
|
version: '4'
|
|
192
|
+
- - ">="
|
|
193
|
+
- !ruby/object:Gem::Version
|
|
194
|
+
version: '3.0'
|
|
209
195
|
type: :development
|
|
210
196
|
prerelease: false
|
|
211
197
|
version_requirements: !ruby/object:Gem::Requirement
|
|
212
198
|
requirements:
|
|
213
|
-
- - ">="
|
|
214
|
-
- !ruby/object:Gem::Version
|
|
215
|
-
version: '3.0'
|
|
216
199
|
- - "<"
|
|
217
200
|
- !ruby/object:Gem::Version
|
|
218
201
|
version: '4'
|
|
202
|
+
- - ">="
|
|
203
|
+
- !ruby/object:Gem::Version
|
|
204
|
+
version: '3.0'
|
|
219
205
|
- !ruby/object:Gem::Dependency
|
|
220
206
|
name: rspec-collection_matchers
|
|
221
207
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -335,9 +321,11 @@ executables: []
|
|
|
335
321
|
extensions: []
|
|
336
322
|
extra_rdoc_files: []
|
|
337
323
|
files:
|
|
338
|
-
- ".circleci/config.yml"
|
|
339
324
|
- ".github/CODEOWNERS"
|
|
340
325
|
- ".github/PULL_REQUEST_TEMPLATE.md"
|
|
326
|
+
- ".github/workflows/default.yml"
|
|
327
|
+
- ".github/workflows/licenses.yml"
|
|
328
|
+
- ".github/workflows/security-check.yml"
|
|
341
329
|
- ".gitignore"
|
|
342
330
|
- ".rspec"
|
|
343
331
|
- ".rubocop.yml"
|
|
@@ -363,7 +351,8 @@ files:
|
|
|
363
351
|
- lib/tasks/pii_safe_schema.rake
|
|
364
352
|
- pii_safe_schema.gemspec
|
|
365
353
|
homepage: https://github.com/wealthsimple/pii_safe_schema
|
|
366
|
-
licenses:
|
|
354
|
+
licenses:
|
|
355
|
+
- MIT
|
|
367
356
|
metadata: {}
|
|
368
357
|
post_install_message:
|
|
369
358
|
rdoc_options: []
|
|
@@ -373,14 +362,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
|
|
|
373
362
|
requirements:
|
|
374
363
|
- - ">="
|
|
375
364
|
- !ruby/object:Gem::Version
|
|
376
|
-
version: '
|
|
365
|
+
version: '2.6'
|
|
377
366
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
|
378
367
|
requirements:
|
|
379
368
|
- - ">="
|
|
380
369
|
- !ruby/object:Gem::Version
|
|
381
370
|
version: '0'
|
|
382
371
|
requirements: []
|
|
383
|
-
rubygems_version: 3.
|
|
372
|
+
rubygems_version: 3.1.4
|
|
384
373
|
signing_key:
|
|
385
374
|
specification_version: 4
|
|
386
375
|
summary: Schema migration tool for checking and adding comments on PII columns.
|
data/.circleci/config.yml
DELETED
|
@@ -1,118 +0,0 @@
|
|
|
1
|
-
version: 2
|
|
2
|
-
|
|
3
|
-
defaults: &defaults
|
|
4
|
-
working_directory: /home/circleci/wealthsimple
|
|
5
|
-
docker:
|
|
6
|
-
- image: circleci/ruby:2.6.5
|
|
7
|
-
- image: circleci/postgres:9.5.9-alpine
|
|
8
|
-
environment:
|
|
9
|
-
POSTGRES_USER: circleci
|
|
10
|
-
POSTGRES_DB: pii_safe_schema_test
|
|
11
|
-
|
|
12
|
-
# These are common snippets that are referenced in multiple workflows.
|
|
13
|
-
references:
|
|
14
|
-
attach_code_workspace: &attach_code_workspace
|
|
15
|
-
attach_workspace:
|
|
16
|
-
at: /home/circleci/wealthsimple
|
|
17
|
-
|
|
18
|
-
restore_bundle_dependencies: &restore_bundle_dependencies
|
|
19
|
-
run:
|
|
20
|
-
name: Restore bundle dependencies from workspace
|
|
21
|
-
command: bundle --path vendor/bundle
|
|
22
|
-
|
|
23
|
-
jobs:
|
|
24
|
-
checkout_and_bundle:
|
|
25
|
-
<<: *defaults
|
|
26
|
-
steps:
|
|
27
|
-
- checkout
|
|
28
|
-
- run:
|
|
29
|
-
command: bundle install --jobs=4 --retry=3 --path vendor/bundle
|
|
30
|
-
- persist_to_workspace:
|
|
31
|
-
root: .
|
|
32
|
-
paths: .
|
|
33
|
-
|
|
34
|
-
rspec:
|
|
35
|
-
<<: *defaults
|
|
36
|
-
steps:
|
|
37
|
-
- *attach_code_workspace
|
|
38
|
-
- *restore_bundle_dependencies
|
|
39
|
-
- run:
|
|
40
|
-
command: sudo apt install -y postgresql-client || true
|
|
41
|
-
- run:
|
|
42
|
-
command: bundle exec bundle-audit update && bundle exec bundle-audit check
|
|
43
|
-
- run:
|
|
44
|
-
command: bundle exec rspec
|
|
45
|
-
|
|
46
|
-
lint_check:
|
|
47
|
-
<<: *defaults
|
|
48
|
-
steps:
|
|
49
|
-
- *attach_code_workspace
|
|
50
|
-
- *restore_bundle_dependencies
|
|
51
|
-
- run:
|
|
52
|
-
command: bundle exec rubocop
|
|
53
|
-
|
|
54
|
-
vulnerability_check:
|
|
55
|
-
<<: *defaults
|
|
56
|
-
steps:
|
|
57
|
-
- *attach_code_workspace
|
|
58
|
-
- *restore_bundle_dependencies
|
|
59
|
-
- run:
|
|
60
|
-
command: bundle exec bundle-audit update && bundle exec bundle-audit check
|
|
61
|
-
|
|
62
|
-
release:
|
|
63
|
-
<<: *defaults
|
|
64
|
-
steps:
|
|
65
|
-
- add_ssh_keys:
|
|
66
|
-
fingerprints:
|
|
67
|
-
- "46:b5:cb:ee:57:dc:14:95:31:be:12:13:4f:11:94:a4"
|
|
68
|
-
- *attach_code_workspace
|
|
69
|
-
- *restore_bundle_dependencies
|
|
70
|
-
- run:
|
|
71
|
-
name: Release to rubygems.org
|
|
72
|
-
command: |
|
|
73
|
-
mkdir ~/.gem
|
|
74
|
-
echo ":rubygems_api_key: ${RUBYGEMS_API_KEY}" >> ~/.gem/credentials
|
|
75
|
-
chmod 600 ~/.gem/credentials
|
|
76
|
-
mkdir -p ~/.ssh
|
|
77
|
-
echo "github.com,192.30.253.112 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==" >> ~/.ssh/known_hosts
|
|
78
|
-
bundle exec rake release
|
|
79
|
-
|
|
80
|
-
workflows:
|
|
81
|
-
version: 2
|
|
82
|
-
build_and_test:
|
|
83
|
-
jobs:
|
|
84
|
-
- checkout_and_bundle:
|
|
85
|
-
context: wealthsimple
|
|
86
|
-
- rspec:
|
|
87
|
-
requires:
|
|
88
|
-
- checkout_and_bundle
|
|
89
|
-
- lint_check:
|
|
90
|
-
requires:
|
|
91
|
-
- checkout_and_bundle
|
|
92
|
-
- vulnerability_check:
|
|
93
|
-
requires:
|
|
94
|
-
- checkout_and_bundle
|
|
95
|
-
- release:
|
|
96
|
-
context: wealthsimple
|
|
97
|
-
filters:
|
|
98
|
-
branches:
|
|
99
|
-
only: master
|
|
100
|
-
requires:
|
|
101
|
-
- rspec
|
|
102
|
-
- lint_check
|
|
103
|
-
- vulnerability_check
|
|
104
|
-
|
|
105
|
-
security-audit:
|
|
106
|
-
triggers:
|
|
107
|
-
- schedule:
|
|
108
|
-
# 11:45 am UTC: 6:45 am EST / 7:45 am EDT
|
|
109
|
-
cron: "45 11 * * *"
|
|
110
|
-
filters:
|
|
111
|
-
branches:
|
|
112
|
-
only: master
|
|
113
|
-
jobs:
|
|
114
|
-
- checkout_and_bundle:
|
|
115
|
-
context: wealthsimple
|
|
116
|
-
- vulnerability_check:
|
|
117
|
-
requires:
|
|
118
|
-
- checkout_and_bundle
|