blob: 2ed8a433e4aa7ec879ed0e7f84fcd17643b0894f (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
|
name: Release and deploy new version
on:
push:
branches:
- main
jobs:
Build-docker-and-push:
name: Build the production docker container image and push it to dockerhub
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
submodules: recursive
- uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- uses: docker/build-push-action@v5
with:
push: true
context: .
file: ./docker/prod/Dockerfile
tags: ${{ secrets.DOCKERHUB_USERNAME }}/pico-web-server:latest
Test-Trivy:
name: Scan development docker container with trivy
runs-on: ubuntu-latest
needs: Build-docker-and-push
steps:
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: ${{ secrets.DOCKERHUB_USERNAME }}/pico-web-server:latest
format: 'sarif'
output: 'trivy-results.sarif'
exit-code: 0
ignore-unfixed: true
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: 'trivy-results.sarif'
Release:
name: Make github release
runs-on: ubuntu-latest
needs: Test-Trivy
steps:
- uses: actions/checkout@v4
- uses: rymndhng/release-on-push-action@master
env:
GITHUB_TOKEN: ${{ secrets.TOKEN_GITHUB }}
with:
bump_version_scheme: norelease # PR must have one of these labels: release:major, release:minor, release:patch
# This emulates deploying to an actual (remote) cluster by first setting up the cluster on older commit and then rolling out current one
Deploy-kubernetes:
name: Deploy kubernetes cluster locally to an action
runs-on: ubuntu-latest
needs: Test-Trivy
steps:
# Setup dependencies
- name: Install socat
run: sudo apt-get install -y socat
- uses: medyagh/setup-minikube@master
- uses: actions/checkout@v2
with:
fetch-depth: 2
- name: Pull (release) docker image
run: |
docker pull ${{ secrets.DOCKERHUB_USERNAME }}/pico-web-server:latest
- name: Configure demo data
run: |
minikube cp ./demo/index.md /usr/share/demo/
# Setup old deployment
- name: Checkout previous commit
run: |
git checkout HEAD^
# Deploy previous version
- name: Minikube deploy
run: |
kubectl apply -f kubernetes/
kubectl rollout status deployment/pico-web-server-deployment
- name: Using cluster
run: |
kubectl get all
echo -ne 'demo@/' | socat STDIO TCP:$(minikube service pico-web-server-service --url | cut -d/ -f3-)
# Setup current deployment
- name: Checkout current
run: |
git checkout main
# Deploy current version
- name: Minikube deploy
run: |
kubectl apply -f kubernetes/
kubectl rollout status deployment/pico-web-server-deployment
- name: Using cluster
run: |
kubectl get all
echo -ne 'demo@/' | socat STDIO TCP:$(minikube service pico-web-server-service --url | cut -d/ -f3-)
# End
- name: Minikube stop
run: |
minikube stop
|
