Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Switch to canonical ci yaml workflows
- Loading branch information
Showing
18 changed files
with
1,647 additions
and
110 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,71 +1,275 @@ | ||
| name: Main | ||
| name: Main - reports Trails to https://app.kosli.com | ||
|
|
||
| on: | ||
| push: | ||
| branches: | ||
| - main | ||
|
|
||
| env: | ||
| KOSLI_DRY_RUN: ${{ vars.KOSLI_DRY_RUN }} # False | ||
| KOSLI_HOST: ${{ vars.KOSLI_HOST }} # https://app.kosli.com | ||
| KOSLI_HOST_STAGING: ${{ vars.KOSLI_HOST_STAGING }} # https://staging.app.kosli.com | ||
| KOSLI_ORG: ${{ vars.KOSLI_ORG }} # cyber-dojo | ||
| KOSLI_FLOW: languages-start-points-ci | ||
| KOSLI_API_TOKEN: ${{ secrets.KOSLI_API_TOKEN }} | ||
| KOSLI_TRAIL: ${{ github.sha }} | ||
|
|
||
| jobs: | ||
| pre-build: | ||
|
|
||
| kosli-trail: | ||
| runs-on: ubuntu-latest | ||
| outputs: | ||
| image_tag: ${{ steps.prep.outputs.image_tag }} | ||
| image_tag: ${{ steps.variables.outputs.image_tag }} | ||
| image_name: ${{ steps.variables.outputs.image_name }} | ||
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - name: Prepare | ||
| id: prep | ||
| run: | | ||
| TAG=$(echo $GITHUB_SHA | head -c7) | ||
| echo "image_tag=${TAG}" >> ${GITHUB_OUTPUT} | ||
| build-test-push: | ||
| needs: [pre-build] | ||
| uses: cyber-dojo/reusable-actions-workflows/.github/workflows/kosli_build_test_push.yml@v0.0.11 | ||
| secrets: | ||
| KOSLI_API_TOKEN: ${{ secrets.KOSLI_API_TOKEN }} | ||
| KOSLI_API_TOKEN_STAGING: ${{ secrets.KOSLI_API_TOKEN_STAGING }} | ||
| DOCKER_PASS: ${{ secrets.DOCKER_PASS }} | ||
| DOCKER_USER: ${{ secrets.DOCKER_USER }} | ||
| SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup Kosli CLI | ||
| uses: kosli-dev/setup-cli-action@v2 | ||
| with: | ||
| version: ${{ vars.KOSLI_CLI_VERSION }} | ||
|
|
||
| - name: Create Kosli Flow | ||
| run: | ||
| kosli create flow "${{ env.KOSLI_FLOW }}" | ||
| --description="Language+TestFramework choices" | ||
| --template-file=.kosli.yml | ||
|
|
||
| - name: Begin Kosli Trail | ||
| run: | ||
| kosli begin trail "${{ env.KOSLI_TRAIL }}" | ||
|
|
||
| - name: Set outputs | ||
| id: variables | ||
| run: | | ||
| IMAGE_TAG=${GITHUB_SHA:0:7} | ||
| echo "image_tag=${IMAGE_TAG}" >> ${GITHUB_OUTPUT} | ||
| echo "image_name=cyberdojo/languages-start-points:${IMAGE_TAG}" >> ${GITHUB_OUTPUT} | ||
| # pull-request: | ||
| # needs: [kosli-trail] | ||
| # runs-on: ubuntu-latest | ||
| # permissions: | ||
| # id-token: write | ||
| # contents: write | ||
| # pull-requests: read | ||
| # steps: | ||
| # - uses: actions/checkout@v4 | ||
| # | ||
| # - name: Setup Kosli CLI | ||
| # uses: kosli-dev/setup-cli-action@v2 | ||
| # with: | ||
| # version: ${{ vars.KOSLI_CLI_VERSION }} | ||
| # | ||
| # - name: Attest pull-request evidence to Kosli Trail | ||
| # run: | ||
| # kosli attest pullrequest github | ||
| # --github-token=${{ secrets.GITHUB_TOKEN }} | ||
| # --name=languages-start-points.pull-request | ||
|
|
||
|
|
||
| build-image: | ||
| needs: [kosli-trail] | ||
| runs-on: ubuntu-latest | ||
| env: | ||
| IMAGE_NAME: ${{ needs.kosli-trail.outputs.image_name }} | ||
| outputs: | ||
| kosli_fingerprint: ${{ steps.variables.outputs.kosli_fingerprint }} | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Build image | ||
| run: | ||
| make build | ||
|
|
||
| - uses: docker/login-action@v3 | ||
| with: | ||
| username: ${{ secrets.DOCKER_USER }} | ||
| password: ${{ secrets.DOCKER_PASS }} | ||
|
|
||
| - name: Push image to Dockerhub registry | ||
| run: | ||
| docker push "${IMAGE_NAME}" | ||
|
|
||
| - name: Setup Kosli CLI | ||
| uses: kosli-dev/setup-cli-action@v2 | ||
| with: | ||
| version: ${{ vars.KOSLI_CLI_VERSION }} | ||
|
|
||
| - name: Attest image evidence to Kosli Trail | ||
| run: | ||
| kosli attest artifact "${IMAGE_NAME}" | ||
| --artifact-type=docker | ||
| --name=languages-start-points | ||
| --trail="${GITHUB_SHA}" | ||
|
|
||
| - name: Set outputs | ||
| id: variables | ||
| run: | | ||
| FINGERPRINT=$(kosli fingerprint "${IMAGE_NAME}" --artifact-type=docker) | ||
| echo "kosli_fingerprint=${FINGERPRINT}" >> ${GITHUB_OUTPUT} | ||
| snyk-container-scan: | ||
| needs: [build-image, kosli-trail] | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup Kosli CLI | ||
| uses: kosli-dev/setup-cli-action@v2 | ||
| with: | ||
| version: ${{ vars.KOSLI_CLI_VERSION }} | ||
|
|
||
| - name: Setup Snyk | ||
| uses: snyk/actions/setup@master | ||
|
|
||
| - name: Run Snyk container scan and report results to Kosli Trail | ||
| env: | ||
| IMAGE_NAME: ${{ needs.kosli-trail.outputs.image_name }} | ||
| KOSLI_FINGERPRINT: ${{ needs.build-image.outputs.kosli_fingerprint }} | ||
| KOSLI_ATTACHMENTS: /tmp/kosli_attachments | ||
| SARIF_FILENAME: snyk.container.scan.json | ||
| SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} | ||
| run: | | ||
| set +e | ||
| snyk container test ${IMAGE_NAME} \ | ||
| --sarif \ | ||
| --sarif-file-output="${SARIF_FILENAME}" \ | ||
| --policy-path=.snyk | ||
| set -e | ||
| mkdir "${KOSLI_ATTACHMENTS}" | ||
| cp .snyk "${KOSLI_ATTACHMENTS}" | ||
| kosli attest snyk "${IMAGE_NAME}" \ | ||
| --name=languages-start-points.snyk-container-scan \ | ||
| --scan-results="${SARIF_FILENAME}" | ||
| snyk-code-scan: | ||
| needs: [build-image, kosli-trail] | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup Kosli CLI | ||
| uses: kosli-dev/setup-cli-action@v2 | ||
| with: | ||
| version: ${{ vars.KOSLI_CLI_VERSION }} | ||
|
|
||
| - name: Setup Snyk | ||
| uses: snyk/actions/setup@master | ||
|
|
||
| - name: Run Snyk code scan and report results to Kosli Trail | ||
| env: | ||
| IMAGE_NAME: ${{ needs.kosli-trail.outputs.image_name }} | ||
| KOSLI_FINGERPRINT: ${{ needs.build-image.outputs.kosli_fingerprint }} | ||
| KOSLI_ATTACHMENTS: /tmp/kosli_attachments | ||
| SARIF_FILENAME: snyk.code.scan.json | ||
| SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} | ||
| run: | | ||
| set +e | ||
| snyk code test \ | ||
| --sarif \ | ||
| --sarif-file-output="${SARIF_FILENAME}" \ | ||
| --policy-path=.snyk \ | ||
| . | ||
| set -e | ||
| mkdir "${KOSLI_ATTACHMENTS}" | ||
| cp .snyk "${KOSLI_ATTACHMENTS}" | ||
| kosli attest snyk "${IMAGE_NAME}" \ | ||
| --name=languages-start-points.snyk-code-scan \ | ||
| --scan-results="${SARIF_FILENAME}" | ||
| sdlc-control-gate: | ||
| needs: [snyk-container-scan, snyk-code-scan, kosli-trail, build-image] | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Setup Kosli CLI | ||
| uses: kosli-dev/setup-cli-action@v2 | ||
| with: | ||
| version: ${{ vars.KOSLI_CLI_VERSION }} | ||
|
|
||
| - name: Kosli SDLC gate to short-circuit the Trail | ||
| env: | ||
| IMAGE_NAME: ${{ needs.kosli-trail.outputs.image_name }} | ||
| KOSLI_FINGERPRINT: ${{ needs.build-image.outputs.kosli_fingerprint }} | ||
| run: | ||
| kosli assert artifact ${IMAGE_NAME} | ||
|
|
||
|
|
||
| approve-deployment-to-beta: | ||
| needs: [sdlc-control-gate, kosli-trail, build-image] | ||
| runs-on: ubuntu-latest | ||
| environment: | ||
| name: staging | ||
| url: ${{ vars.KOSLI_HOST_STAGING }} | ||
| env: | ||
| IMAGE_NAME: ${{ needs.kosli-trail.outputs.image_name }} | ||
| KOSLI_FINGERPRINT: ${{ needs.build-image.outputs.kosli_fingerprint }} | ||
| KOSLI_ENVIRONMENT: aws-beta | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Setup Kosli CLI | ||
| uses: kosli-dev/setup-cli-action@v2 | ||
| with: | ||
| version: ${{ vars.KOSLI_CLI_VERSION }} | ||
|
|
||
| - name: Attest approval of deployment to Kosli | ||
| run: | ||
| kosli report approval ${IMAGE_NAME} | ||
| --approver="${{ github.actor }}" | ||
|
|
||
|
|
||
| deploy-to-beta: | ||
| needs: [approve-deployment-to-beta, kosli-trail] | ||
| uses: ./.github/workflows/sub_deploy_to_beta.yml | ||
| with: | ||
| BUILD_COMMAND: build_test_publish.sh | ||
| image_tag: ${{ needs.pre-build.outputs.image_tag }} | ||
| AWS_ACCOUNT_ID: 244531986313 | ||
| AWS_REGION: eu-central-1 | ||
| ecr_registry: 244531986313.dkr.ecr.eu-central-1.amazonaws.com | ||
| service_name: languages-start-points | ||
| gh_actions_iam_role_name: gh_actions_services | ||
|
|
||
| deploy-staging: | ||
| needs: [pre-build, build-test-push] | ||
| uses: cyber-dojo/reusable-actions-workflows/.github/workflows/kosli_deploy.yml@v0.0.11 | ||
| IMAGE_TAG: ${{ needs.kosli-trail.outputs.image_tag }} | ||
| secrets: | ||
| KOSLI_API_TOKEN: ${{ secrets.KOSLI_API_TOKEN }} | ||
| KOSLI_API_TOKEN_STAGING: ${{ secrets.KOSLI_API_TOKEN_STAGING }} | ||
|
|
||
|
|
||
| approve-deployment-to-prod: | ||
| needs: [deploy-to-beta, kosli-trail, build-image] | ||
| runs-on: ubuntu-latest | ||
| environment: | ||
| name: production | ||
| url: ${{ vars.KOSLI_HOST }} | ||
| env: | ||
| IMAGE_NAME: ${{ needs.kosli-trail.outputs.image_name }} | ||
| KOSLI_FINGERPRINT: ${{ needs.build-image.outputs.kosli_fingerprint }} | ||
| KOSLI_ENVIRONMENT: aws-prod | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Setup Kosli CLI | ||
| uses: kosli-dev/setup-cli-action@v2 | ||
| with: | ||
| version: ${{ vars.KOSLI_CLI_VERSION }} | ||
|
|
||
| - name: Attest approval of deployment to Kosli | ||
| run: | ||
| kosli report approval ${IMAGE_NAME} | ||
| --approver="${{ github.actor }}" | ||
|
|
||
|
|
||
| deploy-to-prod: | ||
| needs: [approve-deployment-to-prod, kosli-trail] | ||
| uses: ./.github/workflows/sub_deploy_to_prod.yml | ||
| with: | ||
| tagged_image: 244531986313.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:${{ needs.pre-build.outputs.image_tag }} | ||
| AWS_ACCOUNT_ID: 244531986313 | ||
| AWS_REGION: eu-central-1 | ||
| gh_actions_iam_role_name: gh_actions_services | ||
| environment_url: https://beta.cyber-dojo.org | ||
| environment_name: staging | ||
| cyber_dojo_env_name_aws: aws-beta | ||
| kosli_host_staging: https://staging.app.kosli.com | ||
| kosli_host_production: https://app.kosli.com | ||
|
|
||
| deploy-prod: | ||
| needs: [pre-build, build-test-push, deploy-staging] | ||
| uses: cyber-dojo/reusable-actions-workflows/.github/workflows/kosli_deploy.yml@v0.0.11 | ||
| IMAGE_TAG: ${{ needs.kosli-trail.outputs.image_tag }} | ||
| secrets: | ||
| KOSLI_API_TOKEN: ${{ secrets.KOSLI_API_TOKEN }} | ||
| KOSLI_API_TOKEN_STAGING: ${{ secrets.KOSLI_API_TOKEN_STAGING }} | ||
| with: | ||
| tagged_image: 274425519734.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:${{ needs.pre-build.outputs.image_tag }} | ||
| AWS_ACCOUNT_ID: 274425519734 | ||
| AWS_REGION: eu-central-1 | ||
| gh_actions_iam_role_name: gh_actions_services | ||
| environment_url: https://cyber-dojo.org | ||
| environment_name: production | ||
| cyber_dojo_env_name_aws: aws-prod | ||
| kosli_host_staging: https://staging.app.kosli.com | ||
| kosli_host_production: https://app.kosli.com | ||
| KOSLI_API_TOKEN_STAGING: ${{ secrets.KOSLI_API_TOKEN_STAGING }} |
Oops, something went wrong.