Skip to content

SPSH-1001: Fixed lint issues #5399

SPSH-1001: Fixed lint issues

SPSH-1001: Fixed lint issues #5399

# Scan & Publish image and helm chart on push, deployment on push, delete deployment on branch deletion, scheduled trivy scanner
name: "Dev Pipeline"
# All triggers have to be in one file, so that the trivy results can be compared to identify introduced vulnerabilities
# See DBP-340
on:
push:
branches:
- "**"
schedule:
- cron: '0 2 * * *'
delete:
concurrency:
group: dbildungs-iam-server-${{ github.event.ref }}
cancel-in-progress: true
jobs:
codeql_analyze:
name: "CodeQL"
if: ${{ github.event_name == 'push' }}
uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-codeql.yaml@5
permissions:
actions: read
contents: read
security-events: write
nest_lint:
name: "Linting"
if: ${{ github.event_name == 'push' }}
uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-nest-lint.yaml@5
with:
node_version: '18'
permissions:
contents: read
tests_and_sonarcloud:
name: "Tests and Sonarcloud"
if: ${{ github.event_name == 'push' }}
uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-nest-test-sonarcloud.yaml@5
with:
node_version: '18'
deploy_stage: 'dev'
timeout_minutes: 15
permissions:
contents: read
secrets: inherit
build_image_on_push:
name: "Publish image and scan with trivy"
if: ${{ github.event_name == 'push' }}
needs:
- codeql_analyze
- nest_lint
- tests_and_sonarcloud
permissions:
packages: write
security-events: write
contents: read
uses: dBildungsplattform/dbp-github-workflows/.github/workflows/image-publish-trivy.yaml@7
with:
image_name: "dbildungs-iam-server"
run_trivy_scan: true
image_tag_generation: ${{ ( github.ref_name == 'main' || startsWith(github.ref_name,'dependabot/') ) && 'commit_hash' || 'ticket_from_branch' }}
add_latest_tag: ${{ github.ref_name == 'main' }}
container_registry: "ghcr.io"
fail_on_vulnerabilites: false
report_location: "Dockerfile"
scheduled_trivy_scan:
name: "Scheduled trivy scan of latest image"
if: ${{ github.event_name == 'schedule' }}
permissions:
packages: read
security-events: write
uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-trivy.yaml@5
with:
image_ref: 'ghcr.io/${{ github.repository_owner }}/dbildungs-iam-server:latest'
fail_on_vulnerabilites: false
report_location: "Dockerfile"
scan_helm:
if: ${{ github.event_name == 'push' && !startsWith(github.ref_name,'dependabot/') }}
uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-helm-kics.yaml@5
permissions:
contents: read
select_helm_version_generation_and_image_tag_generation:
if: ${{ github.event_name == 'push' && !startsWith(github.ref_name,'dependabot/') }}
needs:
- scan_helm
runs-on: ubuntu-latest
outputs:
SELECT_HELM_VERION_GENERATION: ${{ steps.select_generation.outputs.SELECT_HELM_VERION_GENERATION }}
SELECT_IMAGE_TAG_GENERATION: ${{ steps.select_generation.outputs.SELECT_IMAGE_TAG_GENERATION }}
steps:
- id: select_generation
shell: bash
run: |
if ${{ github.ref_name == 'main' }}; then
echo "SELECT_HELM_VERION_GENERATION=timestamp" >> "$GITHUB_OUTPUT"
echo "SELECT_IMAGE_TAG_GENERATION=commit_hash" >> "$GITHUB_OUTPUT"
else
echo "SELECT_HELM_VERION_GENERATION=ticket_from_branch_timestamp" >> "$GITHUB_OUTPUT"
echo "SELECT_IMAGE_TAG_GENERATION=ticket_from_branch" >> "$GITHUB_OUTPUT"
fi
release_helm:
if: ${{ github.event_name == 'push' && !startsWith(github.ref_name,'dependabot/') }}
needs:
- select_helm_version_generation_and_image_tag_generation
uses: dBildungsplattform/dbp-github-workflows/.github/workflows/chart-release.yaml@5
secrets: inherit
with:
chart_name: dbildungs-iam-server
helm_chart_version_generation: ${{ needs. select_helm_version_generation_and_image_tag_generation.outputs.SELECT_HELM_VERION_GENERATION }}
image_tag_generation: ${{ needs. select_helm_version_generation_and_image_tag_generation.outputs.SELECT_IMAGE_TAG_GENERATION }}
branch_meta:
if: ${{ github.event_name == 'push' && !startsWith(github.ref_name,'dependabot/') }}
uses: dBildungsplattform/spsh-app-deploy/.github/workflows/get-branch-meta.yml@3
create_branch_identifier:
if: ${{ github.event_name == 'push' && !startsWith(github.ref_name,'dependabot/') }}
needs:
- branch_meta
uses: dBildungsplattform/spsh-app-deploy/.github/workflows/deploy-branch-to-namespace.yml@3
with:
branch: ${{ needs.branch_meta.outputs.branch }}
deploy:
if: ${{ github.event_name == 'push' && !startsWith(github.ref_name,'dependabot/') }}
needs:
- branch_meta
- create_branch_identifier
- release_helm
- build_image_on_push
uses: dBildungsplattform/spsh-app-deploy/.github/workflows/deploy.yml@5
with:
dbildungs_iam_server_branch: ${{ needs.branch_meta.outputs.ticket }}
schulportal_client_branch: ${{ needs.branch_meta.outputs.ticket }}
dbildungs_iam_keycloak_branch: ${{ needs.branch_meta.outputs.ticket }}
dbildungs_iam_ldap_branch: ${{ needs.branch_meta.outputs.ticket }}
namespace: ${{ needs.create_branch_identifier.outputs.namespace_from_branch }}
secrets: inherit
create_branch_identifier_for_deletion:
if: ${{ github.event_name == 'delete' && github.event.ref_type == 'branch' }}
uses: dBildungsplattform/spsh-app-deploy/.github/workflows/deploy-branch-to-namespace.yml@3
with:
branch: ${{ github.event.ref }}
delete_namespace:
if: ${{ github.event_name == 'delete' && github.event.ref_type == 'branch'}}
needs:
- create_branch_identifier_for_deletion
uses: dBildungsplattform/spsh-app-deploy/.github/workflows/delete-namespace.yml@3
with:
namespace: ${{ needs.create_branch_identifier_for_deletion.outputs.namespace_from_branch }}
secrets:
SPSH_DEV_KUBECONFIG: ${{ secrets.SPSH_DEV_KUBECONFIG }}
delete_successful:
if: ${{ github.event_name == 'delete' && github.event.ref_type == 'branch' }}
needs:
- delete_namespace
- create_branch_identifier_for_deletion
runs-on: ubuntu-latest
steps:
- run: echo "Deletion workflow of namespace" ${{ needs.create_branch_identifier_for_deletion.outputs.namespace_from_branch }} "done"