change #8
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [ main ] | |
| jobs: | |
| buid: | |
| name: GitOps Workflow | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v2 | |
| - name: Build an image from Dockerfile | |
| run: |- | |
| pwd | |
| DOCKER_BUILDKIT=1 docker image build . -f app/Dockerfile --tag ${{ secrets.DH_USERNAME }}/gitops-go-app:${{ github.run_number }} | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: '${{ secrets.DH_USERNAME }}/gitops-go-app:${{ github.run_number }}' | |
| format: 'table' | |
| exit-code: '1' | |
| ignore-unfixed: true | |
| severity: 'CRITICAL,HIGH' | |
| - name: Push Image to Docker Hub | |
| run: |- | |
| docker login docker.io --username ${{ secrets.DH_USERNAME }} --password-stdin "${{ secrets.DH_PASSWORD }}" | |
| docker image push ${{ secrets.USERNAME }}/gitops-go-app:${{ github.run_number }} | |
| - name: Update values.yaml & Pull Request to Config Repository | |
| run: |- | |
| # clone repo | |
| echo -e "machine github.com\nlogin ${{ secrets.GH_USERNAME }}\npassword ${{ secrets.GH_PASSWORD }}" > ~/.netrc | |
| git clone https://github.com/${{ secrets.GH_USERNAME }}/config-for-helm-sample.git | |
| cd config-for-helm-sample/gitops-helm | |
| # set user info | |
| git config --global user.email "${{ secrets.EMAIL }}" | |
| git config --global user.name "${{ secrets.GH_USERNAME }}" | |
| # update values.yaml in new branch | |
| git branch feature/${{ github.run_number }} | |
| git checkout feature/${{ github.run_number }} | |
| sed -i 's/tag: [0-9]*/tag: ${{ github.run_number }}/g' values.yaml | |
| # git push | |
| git add values.yaml | |
| git commit -m "Update tag ${{ github.run_number }}" | |
| git push origin feature/${{ github.run_number }} | |
| # create pull request | |
| echo ${{ secrets.PERSONAL_ACCESS_TOKEN }} > token.txt | |
| gh auth login --with-token < token.txt | |
| gh pr create --title 'Update Tag ${{ github.run_number }}' --body "Please Merge!!" | |