Skip to content

Merge branch 'main' into BC-4453-submission-item-file #15176

Merge branch 'main' into BC-4453-submission-item-file

Merge branch 'main' into BC-4453-submission-item-file #15176

Workflow file for this run

---
name: push workflow
on:
push:
branches-ignore:
- dependabot/**
pull_request:
types: [labeled]
permissions:
contents: read
jobs:
build_and_push:
# this basically means do not execute it as dependabot unless it is labeled as ready-for-ci
# because automated processes and pr from forks are dangerous, therefore those prs won't have access to secrets, labeling them acts like allow-listing them
# more details here https://docs.github.com/en/rest/dependabot/secrets?apiVersion=2022-11-28
# even when re-running an action manually the actor stays the same as of mid 2022, details here https://github.blog/changelog/2022-07-19-differentiating-triggering-actor-from-executing-actor/
#https://github.com/actions/runner/issues/1173#issuecomment-1354501147 when false equals true, you have to come up with something ...
if: |
(github.actor == 'dependabot[bot]' &&
contains(github.event.issue.labels.*.name, 'ready-for-ci') == 'true') ||
github.actor != 'dependabot[bot]'
runs-on: ubuntu-latest
needs:
- branch_meta
permissions:
packages: write
steps:
- uses: actions/checkout@v3
with:
fetch-depth: 0
- name: Login to registry
uses: docker/login-action@v2
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Docker meta Service Name
id: docker_meta_img
uses: docker/metadata-action@v4
with:
images: ghcr.io/${{ github.repository }}
tags: |
type=ref,event=branch,enable=false,priority=600
type=sha,enable=true,priority=600,prefix=
- name: test image exists
run: |
echo "IMAGE_EXISTS=$(docker manifest inspect ghcr.io/${{ github.repository }}:${{ needs.branch_meta.outputs.sha }} > /dev/null && echo 1 || echo 0)" >> $GITHUB_ENV
- name: Set up Docker Buildx
if: ${{ env.IMAGE_EXISTS == 0 }}
uses: docker/setup-buildx-action@v2
- name: Build and push ${{ github.repository }}
if: ${{ env.IMAGE_EXISTS == 0 }}
uses: docker/build-push-action@v4
with:
context: .
file: ./Dockerfile
platforms: linux/amd64
push: true
tags: ghcr.io/${{ github.repository }}:${{ needs.branch_meta.outputs.sha }}
labels: ${{ steps.docker_meta_img.outputs.labels }}
- name: Docker meta Service Name (file preview)
id: docker_meta_img_file_storage
uses: docker/metadata-action@v4
with:
images: ghcr.io/${{ github.repository }}
tags: |
type=ref,event=branch,enable=false,priority=600,prefix=file-preview-
type=sha,enable=true,priority=600,prefix=file-preview-
labels: |
org.opencontainers.image.title=schulcloud-file-storage
- name: test image exists (file preview)
run: |
echo "IMAGE_EXISTS=$(docker manifest inspect ghcr.io/${{ github.repository }}:file-preview-${{ needs.branch_meta.outputs.sha }} > /dev/null && echo 1 || echo 0)" >> $GITHUB_ENV
- name: Set up Docker Buildx (file preview)
if: ${{ env.IMAGE_EXISTS == 0 }}
uses: docker/setup-buildx-action@v2
- name: Build and push ${{ github.repository }} (file preview)
if: ${{ env.IMAGE_EXISTS == 0 }}
uses: docker/build-push-action@v4
with:
build-args: |
BASE_IMAGE=ghcr.io/${{ github.repository }}:${{ needs.branch_meta.outputs.sha }}
context: .
file: ./Dockerfile.filepreview
platforms: linux/amd64
push: true
tags: ghcr.io/${{ github.repository }}:file-preview-${{ needs.branch_meta.outputs.sha }}
labels: |
${{ steps.docker_meta_img_file_storage.outputs.labels }}
- name: Send Notification to Rocket Chat if docker image build failed
if: ${{ failure() && github.ref == 'refs/heads/main' }}
uses: RocketChat/[email protected]
with:
type: ${{ job.status }}
job_name: 'docker image build from ${{ github.repository }} triggered from branch ${{ github.ref_name }}:'
url: ${{ secrets.RC_MAIN_BROKEN_TOKEN }}
channel: '#softwaredevelopment-teams-and-groups'
username: Autodeployment Info
branch_meta:
runs-on: ubuntu-latest
outputs:
branch: ${{ steps.extract_branch_meta.outputs.branch }}
sha: ${{ steps.extract_branch_meta.outputs.sha }}
steps:
- name: Extract branch meta
shell: bash
id: extract_branch_meta
run: |
if [ "${{ github.event_name }}" == 'pull_request' ]; then
echo "branch=${{ github.event.pull_request.head.ref }}" >> $GITHUB_OUTPUT
echo "sha=${{ github.event.pull_request.head.sha }}" >> $GITHUB_OUTPUT
else
echo "branch=${GITHUB_REF#refs/heads/}" >> $GITHUB_OUTPUT
echo "sha=${{ github.sha }}" >> $GITHUB_OUTPUT
fi
deploy:
needs:
- build_and_push
- branch_meta
uses: hpi-schul-cloud/dof_app_deploy/.github/workflows/deploy.yml@main
with:
branch: ${{ needs.branch_meta.outputs.branch }}
secrets:
token: ${{ secrets.GITHUB_TOKEN }}
DEV_VAULT: ${{ secrets.DEV_VAULT }}
DEV_KUBE_CONFIG: ${{ secrets.DEV_KUBE_CONFIG }}
BINGO_REPO_TOKEN: ${{ secrets.BINGO_REPO_TOKEN }}
deploy-successful:
needs:
- deploy
runs-on: ubuntu-latest
steps:
- run: echo "deploy was successful"
trivy-vulnerability-scanning:
needs:
- build_and_push
- branch_meta
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
steps:
- name: run trivy vulnerability scanner
uses: aquasecurity/trivy-action@9ab158e8597f3b310480b9a69402b419bc03dbd5
with:
image-ref: 'ghcr.io/${{ github.repository }}:${{ needs.branch_meta.outputs.sha }}'
format: 'sarif'
output: 'trivy-results.sarif'
severity: 'CRITICAL,HIGH'
ignore-unfixed: true
- name: upload trivy results
if: ${{ always() }}
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: 'trivy-results.sarif'
end-to-end-tests:
needs:
- build_and_push
- branch_meta
uses: hpi-schul-cloud/end-to-end-tests/.github/workflows/e2e_call.yml@main
with:
ref: ${{ needs.branch_meta.outputs.branch }}
cy-e2e-tests:
needs:
- branch_meta
- deploy
uses: hpi-schul-cloud/e2e-system-tests/.github/workflows/remote-trigger.yml@main
with:
ref: ${{ needs.branch_meta.outputs.branch }}
secrets:
service-account-token: ${{ secrets.CYPRESS_ONEPWD_SERVICE_ACCOUNT_TOKEN }}
test-successful:
runs-on: ubuntu-latest
needs:
- end-to-end-tests
steps:
- run: echo "Test was successful"