Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

BC-6589 update gh-actions #250

Merged
merged 4 commits into from
Feb 21, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 32 additions & 17 deletions .github/workflows/push.yml
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,8 @@ on:
push:
branches-ignore:
- dependabot/**
pull_request:
types: [ labeled ]

permissions:
contents: read
Expand All @@ -18,15 +20,15 @@ jobs:
- uses: actions/checkout@v4
- name: Docker meta Service Name
id: docker_meta_img
uses: crazy-max/ghaction-docker-meta@v4
uses: docker/metadata-action@v5
with:
images: ghcr.io/${{ github.repository }}
tags: |
type=ref,event=branch,enable=false,priority=600
type=sha,enable=true,priority=600,prefix=

- name: Log into registry
uses: docker/login-action@v2
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
Expand All @@ -38,7 +40,7 @@ jobs:

- name: Set up Docker Buildx
if: ${{ env.IMAGE_EXISTS == 0 }}
uses: docker/setup-buildx-action@v2
uses: docker/setup-buildx-action@v3

- name: Build and push ${{ github.repository }}
if: ${{ env.IMAGE_EXISTS == 0 }}
Expand All @@ -52,23 +54,36 @@ jobs:
tags: ghcr.io/${{ github.repository }}:${{ github.sha }}
labels: ${{ steps.docker_meta_img.outputs.labels }}

branch_name:
runs-on: ubuntu-latest
outputs:
branch: ${{ steps.extract_branch.outputs.branch }}
steps:
- name: Extract branch name
shell: bash
run: echo "branch=${GITHUB_REF#refs/heads/}" >> $GITHUB_OUTPUT
id: extract_branch
branch_meta:
runs-on: ubuntu-latest
outputs:
branch: ${{ steps.extract_branch_meta.outputs.branch }}
sha: ${{ steps.extract_branch_meta.outputs.sha }}
steps:
- name: Extract branch meta
shell: bash
id: extract_branch_meta
env:
PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
BRANCH_REF_NAME: ${{ github.ref_name}}
BRANCH_SHA: ${{ github.sha }}
run: |
if [ "${{ github.event_name }}" == 'pull_request' ]; then
echo "branch=$PR_HEAD_REF" >> $GITHUB_OUTPUT
echo "sha=$PR_HEAD_SHA" >> $GITHUB_OUTPUT
else
echo "branch=$BRANCH_REF_NAME" >> $GITHUB_OUTPUT
echo "sha=$BRANCH_SHA" >> $GITHUB_OUTPUT
fi

deploy:
needs:
- build_and_push
- branch_name
- branch_meta
uses: hpi-schul-cloud/dof_app_deploy/.github/workflows/deploy.yml@main
with:
branch: ${{ needs.branch_name.outputs.branch }}
branch: ${{ needs.branch_meta.outputs.branch }}
secrets:
token: ${{ secrets.GITHUB_TOKEN }}
DEV_VAULT_BRB: ${{ secrets.DEV_VAULT_BRB }}
Expand All @@ -90,15 +105,15 @@ jobs:
trivy-vulnerability-scanning:
needs:
- build_and_push
- branch_name
- branch_meta
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
steps:
- name: run trivy vulnerability scanner
uses: aquasecurity/trivy-action@9ab158e8597f3b310480b9a69402b419bc03dbd5
uses: aquasecurity/trivy-action@1f6384b6ceecbbc6673526f865b818a2a06b07c9
with:
image-ref: 'ghcr.io/${{ github.repository }}:${{ github.sha }}'
format: 'sarif'
Expand All @@ -107,6 +122,6 @@ jobs:
ignore-unfixed: true
- name: upload trivy results
if: ${{ always() }}
uses: github/codeql-action/upload-sarif@v2
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: 'trivy-results.sarif'
4 changes: 2 additions & 2 deletions .github/workflows/tag.yml
Original file line number Diff line number Diff line change
Expand Up @@ -33,13 +33,13 @@ jobs:
type=semver,pattern={{major}}.{{minor}}

- name: Log into docker registry
uses: docker/login-action@v2
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_TOKEN }}

- name: Log into quay registry
uses: docker/login-action@v2
uses: docker/login-action@v3
with:
registry: quay.io
username: ${{ secrets.QUAY_USERNAME }}
Expand Down
4 changes: 2 additions & 2 deletions ansible/roles/superhero-dashboard/templates/ingress.yml.j2
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ metadata:
name: {{ NAMESPACE }}-shd-ingress
namespace: {{ NAMESPACE }}
annotations:
nginx.ingress.kubernetes.io/ssl-redirect: "{{ TLS_ENABELD|default("false") }}"
nginx.ingress.kubernetes.io/ssl-redirect: "{{ TLS_ENABLED|default("false") }}"
# type of authentication
nginx.ingress.kubernetes.io/auth-type: basic
# name of the secret that contains the user/password definitions
Expand All @@ -18,7 +18,7 @@ metadata:

spec:
ingressClassName: {{ INGRESS_CLASS }}
{% if CLUSTER_ISSUER is defined or (TLS_ENABELD is defined and TLS_ENABELD|bool) %}
{% if CLUSTER_ISSUER is defined or (TLS_ENABLED is defined and TLS_ENABLED|bool) %}
tls:
- hosts:
- {{ SHD_PREFIX }}{{ DOMAIN }}
Expand Down