Merge branch 'main' into ubuntu-latest
This commit is contained in:
Beth Brennan
@@ -30,7 +30,7 @@ jobs:
|
||||
settings-path: ${{ github.workspace }} # location for the settings.xml file
|
||||
|
||||
- name: Setup Gradle
|
||||
uses: gradle/actions/setup-gradle@dbbdc275be76ac10734476cc723d82dfe7ec6eda # v3.4.2
|
||||
uses: gradle/actions/setup-gradle@af1da67850ed9a4cedd57bfd976089dd991e2582 # v4.0.0
|
||||
|
||||
- name: Build with Gradle
|
||||
run: ./gradlew build
|
||||
|
||||
+5
-5
@@ -31,7 +31,7 @@ jobs:
|
||||
# Configure Gradle for optimal use in GitHub Actions, including caching of downloaded dependencies.
|
||||
# See: https://github.com/gradle/actions/blob/main/setup-gradle/README.md
|
||||
- name: Setup Gradle
|
||||
uses: gradle/actions/setup-gradle@dbbdc275be76ac10734476cc723d82dfe7ec6eda # v3.4.2
|
||||
uses: gradle/actions/setup-gradle@af1da67850ed9a4cedd57bfd976089dd991e2582 # v4.0.0
|
||||
|
||||
- name: Build with Gradle Wrapper
|
||||
run: ./gradlew build
|
||||
@@ -40,11 +40,11 @@ jobs:
|
||||
# If your project does not have the Gradle Wrapper configured, you can use the following configuration to run Gradle with a specified version.
|
||||
#
|
||||
# - name: Setup Gradle
|
||||
# uses: gradle/actions/setup-gradle@dbbdc275be76ac10734476cc723d82dfe7ec6eda # v3.4.2
|
||||
# uses: gradle/actions/setup-gradle@af1da67850ed9a4cedd57bfd976089dd991e2582 # v4.0.0
|
||||
# with:
|
||||
# gradle-version: '8.5'
|
||||
# gradle-version: '8.9'
|
||||
#
|
||||
# - name: Build with Gradle 8.5
|
||||
# - name: Build with Gradle 8.9
|
||||
# run: gradle build
|
||||
|
||||
dependency-submission:
|
||||
@@ -64,4 +64,4 @@ jobs:
|
||||
# Generates and submits a dependency graph, enabling Dependabot Alerts for all project dependencies.
|
||||
# See: https://github.com/gradle/actions/blob/main/dependency-submission/README.md
|
||||
- name: Generate and submit dependency graph
|
||||
uses: gradle/actions/dependency-submission@dbbdc275be76ac10734476cc723d82dfe7ec6eda # v3.4.2
|
||||
uses: gradle/actions/dependency-submission@af1da67850ed9a4cedd57bfd976089dd991e2582 # v4.0.0
|
||||
|
||||
+50
-19
@@ -1,4 +1,4 @@
|
||||
# This workflow will upload a Python Package using Twine when a release is created
|
||||
# This workflow will upload a Python Package to PyPI when a release is created
|
||||
# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python#publishing-to-package-registries
|
||||
|
||||
# This workflow uses actions that are not certified by GitHub.
|
||||
@@ -16,24 +16,55 @@ permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
deploy:
|
||||
|
||||
release-build:
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@v3
|
||||
with:
|
||||
python-version: '3.x'
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
python -m pip install --upgrade pip
|
||||
pip install build
|
||||
- name: Build package
|
||||
run: python -m build
|
||||
- name: Publish package
|
||||
uses: pypa/gh-action-pypi-publish@27b31702a0e7fc50959f5ad993c78deac1bdfc29
|
||||
with:
|
||||
user: __token__
|
||||
password: ${{ secrets.PYPI_API_TOKEN }}
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- uses: actions/setup-python@v5
|
||||
with:
|
||||
python-version: "3.x"
|
||||
|
||||
- name: Build release distributions
|
||||
run: |
|
||||
# NOTE: put your own distribution build steps here.
|
||||
python -m pip install build
|
||||
python -m build
|
||||
|
||||
- name: Upload distributions
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: release-dists
|
||||
path: dist/
|
||||
|
||||
pypi-publish:
|
||||
runs-on: ubuntu-latest
|
||||
needs:
|
||||
- release-build
|
||||
permissions:
|
||||
# IMPORTANT: this permission is mandatory for trusted publishing
|
||||
id-token: write
|
||||
|
||||
# Dedicated environments with protections for publishing are strongly recommended.
|
||||
# For more information, see: https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules
|
||||
environment:
|
||||
name: pypi
|
||||
# OPTIONAL: uncomment and update to include your PyPI project URL in the deployment status:
|
||||
# url: https://pypi.org/p/YOURPROJECT
|
||||
#
|
||||
# ALTERNATIVE: if your GitHub Release name is the PyPI project version string
|
||||
# ALTERNATIVE: exactly, uncomment the following line instead:
|
||||
# url: https://pypi.org/project/YOURPROJECT/${{ github.event.release.name }}
|
||||
|
||||
steps:
|
||||
- name: Retrieve release distributions
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: release-dists
|
||||
path: dist/
|
||||
|
||||
- name: Publish release distributions to PyPI
|
||||
uses: pypa/gh-action-pypi-publish@release/v1
|
||||
with:
|
||||
packages-dir: dist/
|
||||
|
||||
@@ -0,0 +1,54 @@
|
||||
# This workflow uses actions that are not certified by GitHub. They are provided by a third-party and are governed by
|
||||
# separate terms of service, privacy policy, and support documentation.
|
||||
#
|
||||
# Appknox: Leader in Mobile Application Security Testing Solutions <https://www.appknox.com/>
|
||||
#
|
||||
# To use this workflow, you must be an existing Appknox customer with GitHub Advanced Security (GHAS) enabled for your
|
||||
# repository.
|
||||
#
|
||||
# If you *are not* an existing customer, click here to contact us for licensing and pricing details:
|
||||
# <https://www.appknox.com/free-trial>.
|
||||
#
|
||||
# Instructions:
|
||||
#
|
||||
# 1. In your repository settings, navigate to 'Secrets' and click on 'New repository secret.' Name the
|
||||
# secret APPKNOX_ACCESS_TOKEN and paste your appknox user token into the value field. If you don't have a appknox token
|
||||
# or need to generate a new one for GitHub, visit the Appknox Platform, go to Account Settings->Developer Settings
|
||||
# and create a token labeled GitHub
|
||||
#
|
||||
# 2. Refer to the detailed workflow below, make any required adjustments, and then save it to your repository. After the
|
||||
# action executes, check the 'Security' tab for results
|
||||
|
||||
name: Appknox
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ $default-branch, $protected-branches ]
|
||||
pull_request:
|
||||
branches: [ $default-branch ]
|
||||
jobs:
|
||||
appknox:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout Code
|
||||
uses: actions/checkout@v2
|
||||
|
||||
- name: Grant execute permission for gradlew
|
||||
run: chmod +x gradlew
|
||||
|
||||
- name: Build the app
|
||||
run: ./gradlew build # Update this to build your Android or iOS application
|
||||
|
||||
- name: Appknox GitHub action
|
||||
uses: appknox/appknox-github-action@b7d2bfb2321d5544e97bffcba48557234ab953a4
|
||||
with:
|
||||
appknox_access_token: ${{ secrets.APPKNOX_ACCESS_TOKEN }}
|
||||
file_path: app/build/outputs/apk/debug/app-debug.apk # Specify the path to your .ipa or .apk here
|
||||
risk_threshold: MEDIUM # Update this to desired risk threshold [LOW, MEDIUM, HIGH, CRITICAL]
|
||||
sarif: Enable
|
||||
|
||||
- name: Upload SARIF to GHAS
|
||||
if: always()
|
||||
uses: github/codeql-action/upload-sarif@v3
|
||||
with:
|
||||
sarif_file: report.sarif
|
||||
@@ -9,7 +9,7 @@
|
||||
# the `language` matrix defined below to confirm you have the correct set of
|
||||
# supported CodeQL languages.
|
||||
#
|
||||
name: "CodeQL"
|
||||
name: "CodeQL Advanced"
|
||||
|
||||
on:
|
||||
push:
|
||||
@@ -28,7 +28,6 @@ jobs:
|
||||
# - https://gh.io/using-larger-runners (GitHub.com only)
|
||||
# Consider using larger runners or machines with greater resources for possible analysis time improvements.
|
||||
runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
|
||||
timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
|
||||
permissions:
|
||||
# required for all workflows
|
||||
security-events: write
|
||||
|
||||
@@ -0,0 +1,43 @@
|
||||
# This workflow uses actions that are not certified by GitHub.
|
||||
# They are provided by a third-party and are governed by
|
||||
# separate terms of service, privacy policy, and support
|
||||
# documentation.
|
||||
|
||||
#####################################################################################################################################################################
|
||||
# Use this workflow template as a basis for integrating Debricked into your GitHub workflows. #
|
||||
# #
|
||||
# If you need additional assistance with configuration feel free to contact us via chat or email at [email protected] #
|
||||
# To learn more about Debricked or contact our team, visit https://debricked.com/ #
|
||||
# #
|
||||
# To run this workflow, complete the following set-up steps: #
|
||||
# #
|
||||
# 1. If you don’t have a Debricked account, create one by visiting https://debricked.com/app/en/register #
|
||||
# 2. Generate your Debricked access token, by following the steps mentioned in https://portal.debricked.com/administration-47/how-do-i-generate-an-access-token-130 #
|
||||
# 3. In GitHub, navigate to the repository #
|
||||
# 4. Click on “Settings” (If you cannot see the “Settings” tab, select the dropdown menu, then click “Settings”) #
|
||||
# 5. In the “Security” section click on “Secrets and variables”, then click “Actions” #
|
||||
# 6. In the “Secrets” tab, click on “New repository secret” #
|
||||
# 7. In the “Name” field, type the name of the secret #
|
||||
# 8. In the “Secret” field, enter the value of the secret #
|
||||
# 9. Click “Add secret” #
|
||||
# 10. You should now be ready to use the workflow! #
|
||||
#####################################################################################################################################################################
|
||||
|
||||
name: Debricked Scan
|
||||
|
||||
on:
|
||||
push:
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
vulnerabilities-scan:
|
||||
name: Vulnerabilities scan
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: debricked/actions@v3
|
||||
env:
|
||||
DEBRICKED_TOKEN: ${{ secrets.DEBRICKED_TOKEN }}
|
||||
@@ -33,9 +33,11 @@ jobs:
|
||||
- name: Install ESLint
|
||||
run: |
|
||||
npm install [email protected]
|
||||
npm install @microsoft/eslint-formatter-sarif@2.1.7
|
||||
npm install @microsoft/eslint-formatter-sarif@3.1.0
|
||||
|
||||
- name: Run ESLint
|
||||
env:
|
||||
SARIF_ESLINT_IGNORE_SUPPRESSED: "true"
|
||||
run: npx eslint .
|
||||
--config .eslintrc.js
|
||||
--ext .js,.jsx,.ts,.tsx
|
||||
@@ -47,4 +49,4 @@ jobs:
|
||||
uses: github/codeql-action/upload-sarif@v3
|
||||
with:
|
||||
sarif_file: eslint-results.sarif
|
||||
wait-for-processing: true
|
||||
wait-for-processing: true
|
||||
|
||||
@@ -0,0 +1,54 @@
|
||||
# This workflow uses actions that are not certified by GitHub.
|
||||
# They are provided by a third-party and are governed by
|
||||
# separate terms of service, privacy policy, and support
|
||||
# documentation.
|
||||
# JFrog SAST performs 1st party source code security analysis
|
||||
# For more information, see
|
||||
# https://docs.jfrog-applications.jfrog.io/jfrog-security-features/sast
|
||||
|
||||
name: "JFrog SAST Scan"
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ $default-branch, $protected-branches ]
|
||||
pull_request:
|
||||
branches: [ $default-branch, $protected-branches ]
|
||||
schedule:
|
||||
- cron: $cron-weekly
|
||||
|
||||
env:
|
||||
# [Mandatory]
|
||||
# JFrog platform URL and access token for
|
||||
# a JFrog platform instance with active
|
||||
# JFrog Advanced Security subscription
|
||||
JF_URL: ${{ secrets.JF_URL }}
|
||||
JF_TOKEN: ${{ secrets.JF_ACCESS_TOKEN }}
|
||||
jobs:
|
||||
analyze:
|
||||
name: Analyze
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
actions: read
|
||||
contents: read
|
||||
security-events: write
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@v4
|
||||
|
||||
- name: Install and configure JFrog CLI
|
||||
run: |
|
||||
npm install -g jfrog-cli-v2-jf
|
||||
echo $JF_TOKEN | jf c add --interactive=false --url=$JF_URL --access-token-stdin
|
||||
|
||||
- name: Run JFrog SAST
|
||||
run: |
|
||||
jf audit --sast --format=sarif > jfrog_sast.sarif
|
||||
|
||||
|
||||
- name: Upload output to generate autofix
|
||||
uses: github/codeql-action/upload-sarif@v3
|
||||
with:
|
||||
sarif_file: jfrog_sast.sarif
|
||||
@@ -0,0 +1,21 @@
|
||||
{
|
||||
"name": "Appknox",
|
||||
"creator": "Appknox",
|
||||
"description": "Use Appknox action for faster and precise security assessments of your iOS and Android apps developed using any programming language",
|
||||
"iconName": "appknox",
|
||||
"categories": [
|
||||
"Code Scanning",
|
||||
"Java",
|
||||
"Kotlin",
|
||||
"Scala",
|
||||
"Swift",
|
||||
"Objective C",
|
||||
"C",
|
||||
"C++",
|
||||
"C#",
|
||||
"Rust",
|
||||
"JavaScript",
|
||||
"TypeScript",
|
||||
"Node"
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,19 @@
|
||||
{
|
||||
"name": "Debricked Scan",
|
||||
"creator": "OpenText",
|
||||
"description": "Integrate with Debricked's state of the art AI-powered Software Composition Analysis to automate your security.",
|
||||
"iconName": "debricked",
|
||||
"categories": [
|
||||
"Code Scanning",
|
||||
"Python",
|
||||
"JavaScript",
|
||||
"Java",
|
||||
"PHP",
|
||||
"Ruby",
|
||||
"Go",
|
||||
"Rust",
|
||||
"Swift",
|
||||
"C#",
|
||||
"Objective-C"
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,16 @@
|
||||
{
|
||||
"name": "JFrog SAST",
|
||||
"description": "Scan for security vulnerabilities in source code using JFrog SAST",
|
||||
"iconName": "frogbot",
|
||||
"categories":
|
||||
[
|
||||
"Code Scanning",
|
||||
"security",
|
||||
"python",
|
||||
"java",
|
||||
"javascript",
|
||||
"typescript",
|
||||
"go"
|
||||
],
|
||||
"creator": "JFrog"
|
||||
}
|
||||
@@ -36,7 +36,7 @@ jobs:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Run SOOS DAST Analysis
|
||||
uses: soos-io/soos-dast-github-action@a7f2cb2dfd143cb3224712d902ca0a1da0198ea9
|
||||
uses: soos-io/soos-dast-github-action@65d9878d77c8993f3db9e86a92bc2ad3a6e060af
|
||||
with:
|
||||
client_id: ${{ secrets.SOOS_CLIENT_ID }}
|
||||
api_key: ${{ secrets.SOOS_API_KEY }}
|
||||
|
||||
@@ -1,113 +1,95 @@
|
||||
# This workflow build and push a Docker container to Google Artifact Registry and deploy it on Cloud Run when a commit is pushed to the $default-branch branch
|
||||
#
|
||||
# Overview:
|
||||
#
|
||||
# 1. Authenticate to Google Cloud
|
||||
# 2. Authenticate Docker to Artifact Registry
|
||||
# 3. Build a docker container
|
||||
# 4. Publish it to Google Artifact Registry
|
||||
# 5. Deploy it to Cloud Run
|
||||
# This workflow build and push a Docker container to Google Artifact Registry
|
||||
# and deploy it on Cloud Run when a commit is pushed to the $default-branch
|
||||
# branch.
|
||||
#
|
||||
# To configure this workflow:
|
||||
#
|
||||
# 1. Ensure the required Google Cloud APIs are enabled:
|
||||
# 1. Enable the following Google Cloud APIs:
|
||||
#
|
||||
# Cloud Run run.googleapis.com
|
||||
# Artifact Registry artifactregistry.googleapis.com
|
||||
# - Artifact Registry (artifactregistry.googleapis.com)
|
||||
# - Cloud Run (run.googleapis.com)
|
||||
# - IAM Credentials API (iamcredentials.googleapis.com)
|
||||
#
|
||||
# 2. Create and configure Workload Identity Federation for GitHub (https://github.com/google-github-actions/auth#setting-up-workload-identity-federation)
|
||||
# You can learn more about enabling APIs at
|
||||
# https://support.google.com/googleapi/answer/6158841.
|
||||
#
|
||||
# 3. Ensure the required IAM permissions are granted
|
||||
# 2. Create and configure a Workload Identity Provider for GitHub:
|
||||
# https://github.com/google-github-actions/auth#preferred-direct-workload-identity-federation.
|
||||
#
|
||||
# Cloud Run
|
||||
# roles/run.admin
|
||||
# roles/iam.serviceAccountUser (to act as the Cloud Run runtime service account)
|
||||
# Depending on how you authenticate, you will need to grant an IAM principal
|
||||
# permissions on Google Cloud:
|
||||
#
|
||||
# Artifact Registry
|
||||
# roles/artifactregistry.admin (project or repository level)
|
||||
# - Artifact Registry Administrator (roles/artifactregistry.admin)
|
||||
# - Cloud Run Developer (roles/run.developer)
|
||||
#
|
||||
# NOTE: You should always follow the principle of least privilege when assigning IAM roles
|
||||
# You can learn more about setting IAM permissions at
|
||||
# https://cloud.google.com/iam/docs/manage-access-other-resources
|
||||
#
|
||||
# 4. Create GitHub secrets for WIF_PROVIDER and WIF_SERVICE_ACCOUNT
|
||||
#
|
||||
# 5. Change the values for the GAR_LOCATION, SERVICE and REGION environment variables (below).
|
||||
#
|
||||
# NOTE: To use Google Container Registry instead, replace ${{ env.GAR_LOCATION }}-docker.pkg.dev with gcr.io
|
||||
#
|
||||
# For more support on how to run this workflow, please visit https://github.com/marketplace/actions/deploy-to-cloud-run
|
||||
#
|
||||
# Further reading:
|
||||
# Cloud Run IAM permissions - https://cloud.google.com/run/docs/deploying
|
||||
# Artifact Registry IAM permissions - https://cloud.google.com/artifact-registry/docs/access-control#roles
|
||||
# Container Registry vs Artifact Registry - https://cloud.google.com/blog/products/application-development/understanding-artifact-registry-vs-container-registry
|
||||
# Principle of least privilege - https://cloud.google.com/blog/products/identity-security/dont-get-pwned-practicing-the-principle-of-least-privilege
|
||||
# 3. Change the values in the "env" block to match your values.
|
||||
|
||||
name: Build and Deploy to Cloud Run
|
||||
name: 'Build and Deploy to Cloud Run'
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ $default-branch ]
|
||||
branches:
|
||||
- '$default-branch'
|
||||
|
||||
env:
|
||||
PROJECT_ID: YOUR_PROJECT_ID # TODO: update Google Cloud project id
|
||||
GAR_LOCATION: YOUR_GAR_LOCATION # TODO: update Artifact Registry location
|
||||
SERVICE: YOUR_SERVICE_NAME # TODO: update Cloud Run service name
|
||||
REGION: YOUR_SERVICE_REGION # TODO: update Cloud Run service region
|
||||
PROJECT_ID: 'my-project' # TODO: update to your Google Cloud project ID
|
||||
REGION: 'us-central1' # TODO: update to your region
|
||||
SERVICE: 'my-service' # TODO: update to your service name
|
||||
WORKLOAD_IDENTITY_PROVIDER: 'projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider' # TODO: update to your workload identity provider
|
||||
|
||||
jobs:
|
||||
deploy:
|
||||
# Add 'id-token' with the intended permissions for workload identity federation
|
||||
runs-on: 'ubuntu-latest'
|
||||
|
||||
permissions:
|
||||
contents: 'read'
|
||||
id-token: 'write'
|
||||
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v2
|
||||
- name: 'Checkout'
|
||||
uses: 'actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332' # actions/checkout@v4
|
||||
|
||||
- name: Google Auth
|
||||
id: auth
|
||||
uses: 'google-github-actions/auth@v0'
|
||||
# Configure Workload Identity Federation and generate an access token.
|
||||
#
|
||||
# See https://github.com/google-github-actions/auth for more options,
|
||||
# including authenticating via a JSON credentials file.
|
||||
- id: 'auth'
|
||||
name: 'Authenticate to Google Cloud'
|
||||
uses: 'google-github-actions/auth@f112390a2df9932162083945e46d439060d66ec2' # google-github-actions/auth@v2
|
||||
with:
|
||||
token_format: 'access_token'
|
||||
workload_identity_provider: '${{ secrets.WIF_PROVIDER }}' # e.g. - projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider
|
||||
service_account: '${{ secrets.WIF_SERVICE_ACCOUNT }}' # e.g. - [email protected]
|
||||
workload_identity_provider: '${{ env.WORKLOAD_IDENTITY_PROVIDER }}'
|
||||
|
||||
# NOTE: Alternative option - authentication via credentials json
|
||||
# - name: Google Auth
|
||||
# id: auth
|
||||
# uses: 'google-github-actions/auth@v0'
|
||||
# with:
|
||||
# credentials_json: '${{ secrets.GCP_CREDENTIALS }}''
|
||||
|
||||
# BEGIN - Docker auth and build (NOTE: If you already have a container image, these Docker steps can be omitted)
|
||||
|
||||
# Authenticate Docker to Google Cloud Artifact Registry
|
||||
- name: Docker Auth
|
||||
id: docker-auth
|
||||
uses: 'docker/login-action@v1'
|
||||
# BEGIN - Docker auth and build
|
||||
#
|
||||
# If you already have a container image, you can omit these steps.
|
||||
- name: 'Docker Auth'
|
||||
uses: 'docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567' # docker/login-action@v3
|
||||
with:
|
||||
username: 'oauth2accesstoken'
|
||||
password: '${{ steps.auth.outputs.access_token }}'
|
||||
registry: '${{ env.GAR_LOCATION }}-docker.pkg.dev'
|
||||
password: '${{ steps.auth.outputs.auth_token }}'
|
||||
registry: '${{ env.REGION }}-docker.pkg.dev'
|
||||
|
||||
- name: Build and Push Container
|
||||
- name: 'Build and Push Container'
|
||||
run: |-
|
||||
docker build -t "${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}:${{ github.sha }}" ./
|
||||
docker push "${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}:${{ github.sha }}"
|
||||
DOCKER_TAG="$${{ env.REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}:${{ github.sha }}"
|
||||
docker build --tag "${DOCKER_TAG}" .
|
||||
docker push "${DOCKER_TAG}"
|
||||
- name: 'Deploy to Cloud Run'
|
||||
|
||||
# END - Docker auth and build
|
||||
# END - Docker auth and build
|
||||
|
||||
- name: Deploy to Cloud Run
|
||||
id: deploy
|
||||
uses: google-github-actions/deploy-cloudrun@v0
|
||||
uses: 'google-github-actions/deploy-cloudrun@33553064113a37d688aa6937bacbdc481580be17' # google-github-actions/deploy-cloudrun@v2
|
||||
with:
|
||||
service: ${{ env.SERVICE }}
|
||||
region: ${{ env.REGION }}
|
||||
# NOTE: If using a pre-built image, update the image name here
|
||||
image: ${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}:${{ github.sha }}
|
||||
service: '${{ env.SERVICE }}'
|
||||
region: '${{ env.REGION }}'
|
||||
# NOTE: If using a pre-built image, update the image name below:
|
||||
|
||||
# If required, use the Cloud Run url output in later steps
|
||||
- name: Show Output
|
||||
run: echo ${{ steps.deploy.outputs.url }}
|
||||
image: '${{ env.REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}:${{ github.sha }}'
|
||||
# If required, use the Cloud Run URL output in later steps
|
||||
- name: 'Show output'
|
||||
run: |2-
|
||||
|
||||
echo ${{ steps.deploy.outputs.url }}
|
||||
|
||||
@@ -1,95 +1,75 @@
|
||||
# This workflow will deploy source code on Cloud Run when a commit is pushed to the $default-branch branch
|
||||
#
|
||||
# Overview:
|
||||
#
|
||||
# 1. Authenticate to Google Cloud
|
||||
# 2. Deploy it to Cloud Run
|
||||
# This workflow will deploy source code on Cloud Run when a commit is pushed to
|
||||
# the $default-branch branch.
|
||||
#
|
||||
# To configure this workflow:
|
||||
#
|
||||
# 1. Ensure the required Google Cloud APIs are enabled:
|
||||
# 1. Enable the following Google Cloud APIs:
|
||||
#
|
||||
# Cloud Run run.googleapis.com
|
||||
# Cloud Build cloudbuild.googleapis.com
|
||||
# Artifact Registry artifactregistry.googleapis.com
|
||||
# - Artifact Registry (artifactregistry.googleapis.com)
|
||||
# - Cloud Build (cloudbuild.googleapis.com)
|
||||
# - Cloud Run (run.googleapis.com)
|
||||
# - IAM Credentials API (iamcredentials.googleapis.com)
|
||||
#
|
||||
# 2. Create and configure Workload Identity Federation for GitHub (https://github.com/google-github-actions/auth#setting-up-workload-identity-federation)
|
||||
# You can learn more about enabling APIs at
|
||||
# https://support.google.com/googleapi/answer/6158841.
|
||||
#
|
||||
# 3. Ensure the required IAM permissions are granted
|
||||
# 2. Create and configure a Workload Identity Provider for GitHub:
|
||||
# https://github.com/google-github-actions/auth#preferred-direct-workload-identity-federation.
|
||||
#
|
||||
# Cloud Run
|
||||
# roles/run.admin
|
||||
# roles/iam.serviceAccountUser (to act as the Cloud Run runtime service account)
|
||||
# Depending on how you authenticate, you will need to grant an IAM principal
|
||||
# permissions on Google Cloud:
|
||||
#
|
||||
# Cloud Build
|
||||
# roles/cloudbuild.builds.editor
|
||||
# - Artifact Registry Administrator (roles/artifactregistry.admin)
|
||||
# - Cloud Run Source Developer (roles/run.sourceDeveloper)
|
||||
#
|
||||
# Cloud Storage
|
||||
# roles/storage.objectAdmin
|
||||
# You can learn more about setting IAM permissions at
|
||||
# https://cloud.google.com/iam/docs/manage-access-other-resources.
|
||||
#
|
||||
# Artifact Registry
|
||||
# roles/artifactregistry.admin (project or repository level)
|
||||
#
|
||||
# NOTE: You should always follow the principle of least privilege when assigning IAM roles
|
||||
#
|
||||
# 4. Create GitHub secrets for WIF_PROVIDER and WIF_SERVICE_ACCOUNT
|
||||
#
|
||||
# 5. Change the values for the SERVICE and REGION environment variables (below).
|
||||
#
|
||||
# For more support on how to run this workflow, please visit https://github.com/marketplace/actions/deploy-to-cloud-run
|
||||
#
|
||||
# Further reading:
|
||||
# Cloud Run runtime service account - https://cloud.google.com/run/docs/securing/service-identity
|
||||
# Cloud Run IAM permissions - https://cloud.google.com/run/docs/deploying-source-code#permissions_required_to_deploy
|
||||
# Cloud Run builds from source - https://cloud.google.com/run/docs/deploying-source-code
|
||||
# Principle of least privilege - https://cloud.google.com/blog/products/identity-security/dont-get-pwned-practicing-the-principle-of-least-privilege
|
||||
# 3. Change the values in the "env" block to match your values.
|
||||
|
||||
name: Deploy to Cloud Run from Source
|
||||
name: 'Deploy to Cloud Run from Source'
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ $default-branch ]
|
||||
branches:
|
||||
- '$default-branch'
|
||||
|
||||
env:
|
||||
PROJECT_ID: YOUR_PROJECT_ID # TODO: update Google Cloud project id
|
||||
SERVICE: YOUR_SERVICE_NAME # TODO: update Cloud Run service name
|
||||
REGION: YOUR_SERVICE_REGION # TODO: update Cloud Run service region
|
||||
PROJECT_ID: 'my-project' # TODO: update to your Google Cloud project ID
|
||||
REGION: 'us-central1' # TODO: update to your region
|
||||
SERVICE: 'my-service' # TODO: update to your service name
|
||||
|
||||
jobs:
|
||||
deploy:
|
||||
# Add 'id-token' with the intended permissions for workload identity federation
|
||||
runs-on: 'ubuntu-latest'
|
||||
|
||||
permissions:
|
||||
contents: 'read'
|
||||
id-token: 'write'
|
||||
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v2
|
||||
- name: 'Checkout'
|
||||
uses: 'actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332' # actions/checkout@v4
|
||||
|
||||
- name: Google Auth
|
||||
id: auth
|
||||
uses: 'google-github-actions/auth@v0'
|
||||
# Configure Workload Identity Federation and generate an access token.
|
||||
#
|
||||
# See https://github.com/google-github-actions/auth for more options,
|
||||
# including authenticating via a JSON credentials file.
|
||||
- id: 'auth'
|
||||
name: 'Authenticate to Google Cloud'
|
||||
uses: 'google-github-actions/auth@f112390a2df9932162083945e46d439060d66ec2' # google-github-actions/auth@v2
|
||||
with:
|
||||
workload_identity_provider: '${{ secrets.WIF_PROVIDER }}' # e.g. - projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider
|
||||
service_account: '${{ secrets.WIF_SERVICE_ACCOUNT }}' # e.g. - [email protected]
|
||||
workload_identity_provider: 'projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider' # TODO: replace with your workload identity provider
|
||||
|
||||
# NOTE: Alternative option - authentication via credentials json
|
||||
# - name: Google Auth
|
||||
# id: auth
|
||||
# uses: 'google-github-actions/auth@v0'
|
||||
# with:
|
||||
# credentials_json: '${{ secrets.GCP_CREDENTIALS }}'
|
||||
|
||||
- name: Deploy to Cloud Run
|
||||
id: deploy
|
||||
uses: google-github-actions/deploy-cloudrun@v0
|
||||
- name: 'Deploy to Cloud Run'
|
||||
uses: 'google-github-actions/deploy-cloudrun@33553064113a37d688aa6937bacbdc481580be17' # google-github-actions/deploy-cloudrun@v2
|
||||
with:
|
||||
service: ${{ env.SERVICE }}
|
||||
region: ${{ env.REGION }}
|
||||
# NOTE: If required, update to the appropriate source folder
|
||||
source: ./
|
||||
service: '${{ env.SERVICE }}'
|
||||
region: '${{ env.REGION }}'
|
||||
# NOTE: If using a different source folder, update the image name below:
|
||||
source: './'
|
||||
|
||||
# If required, use the Cloud Run url output in later steps
|
||||
- name: Show Output
|
||||
run: echo ${{ steps.deploy.outputs.url }}
|
||||
# If required, use the Cloud Run URL output in later steps
|
||||
- name: 'Show output'
|
||||
run: |-
|
||||
echo ${{ steps.deploy.outputs.url }}
|
||||
|
||||
+91
-66
@@ -1,91 +1,116 @@
|
||||
# This workflow will build a docker container, publish it to Google Container Registry, and deploy it to GKE when there is a push to the $default-branch branch.
|
||||
# This workflow will build a docker container, publish it to Google Container
|
||||
# Registry, and deploy it to GKE when there is a push to the $default-branch
|
||||
# branch.
|
||||
#
|
||||
# To configure this workflow:
|
||||
#
|
||||
# 1. Ensure that your repository contains the necessary configuration for your Google Kubernetes Engine cluster, including deployment.yml, kustomization.yml, service.yml, etc.
|
||||
# 1. Enable the following Google Cloud APIs:
|
||||
#
|
||||
# 2. Create and configure a Workload Identity Provider for GitHub (https://github.com/google-github-actions/auth#setting-up-workload-identity-federation)
|
||||
# - Artifact Registry (artifactregistry.googleapis.com)
|
||||
# - Google Kubernetes Engine (container.googleapis.com)
|
||||
# - IAM Credentials API (iamcredentials.googleapis.com)
|
||||
#
|
||||
# 3. Change the values for the GAR_LOCATION, GKE_ZONE, GKE_CLUSTER, IMAGE, REPOSITORY and DEPLOYMENT_NAME environment variables (below).
|
||||
# You can learn more about enabling APIs at
|
||||
# https://support.google.com/googleapi/answer/6158841.
|
||||
#
|
||||
# For more support on how to run the workflow, please visit https://github.com/google-github-actions/setup-gcloud/tree/master/example-workflows/gke-kustomize
|
||||
# 2. Ensure that your repository contains the necessary configuration for your
|
||||
# Google Kubernetes Engine cluster, including deployment.yml,
|
||||
# kustomization.yml, service.yml, etc.
|
||||
#
|
||||
# 3. Create and configure a Workload Identity Provider for GitHub:
|
||||
# https://github.com/google-github-actions/auth#preferred-direct-workload-identity-federation.
|
||||
#
|
||||
# Depending on how you authenticate, you will need to grant an IAM principal
|
||||
# permissions on Google Cloud:
|
||||
#
|
||||
# - Artifact Registry Administrator (roles/artifactregistry.admin)
|
||||
# - Kubernetes Engine Developer (roles/container.developer)
|
||||
#
|
||||
# You can learn more about setting IAM permissions at
|
||||
# https://cloud.google.com/iam/docs/manage-access-other-resources
|
||||
#
|
||||
# 5. Change the values in the "env" block to match your values.
|
||||
|
||||
name: Build and Deploy to GKE
|
||||
name: 'Build and Deploy to GKE'
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ $default-branch ]
|
||||
branches:
|
||||
- '$default-branch'
|
||||
|
||||
env:
|
||||
PROJECT_ID: ${{ secrets.GKE_PROJECT }}
|
||||
GAR_LOCATION: us-central1 # TODO: update region of the Artifact Registry
|
||||
GKE_CLUSTER: cluster-1 # TODO: update to cluster name
|
||||
GKE_ZONE: us-central1-c # TODO: update to cluster zone
|
||||
DEPLOYMENT_NAME: gke-test # TODO: update to deployment name
|
||||
REPOSITORY: samples # TODO: update to Artifact Registry docker repository
|
||||
IMAGE: static-site
|
||||
PROJECT_ID: 'my-project' # TODO: update to your Google Cloud project ID
|
||||
GAR_LOCATION: 'us-central1' # TODO: update to your region
|
||||
GKE_CLUSTER: 'cluster-1' # TODO: update to your cluster name
|
||||
GKE_ZONE: 'us-central1-c' # TODO: update to your cluster zone
|
||||
DEPLOYMENT_NAME: 'gke-test' # TODO: update to your deployment name
|
||||
REPOSITORY: 'samples' # TODO: update to your Artifact Registry docker repository name
|
||||
IMAGE: 'static-site'
|
||||
WORKLOAD_IDENTITY_PROVIDER: 'projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider' # TODO: update to your workload identity provider
|
||||
|
||||
jobs:
|
||||
setup-build-publish-deploy:
|
||||
name: Setup, Build, Publish, and Deploy
|
||||
runs-on: ubuntu-latest
|
||||
environment: production
|
||||
name: 'Setup, Build, Publish, and Deploy'
|
||||
runs-on: 'ubuntu-latest'
|
||||
environment: 'production'
|
||||
|
||||
permissions:
|
||||
contents: 'read'
|
||||
id-token: 'write'
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
- name: 'Checkout'
|
||||
uses: 'actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332' # actions/checkout@v4
|
||||
|
||||
# Configure Workload Identity Federation and generate an access token.
|
||||
- id: 'auth'
|
||||
name: 'Authenticate to Google Cloud'
|
||||
uses: 'google-github-actions/auth@v0'
|
||||
with:
|
||||
token_format: 'access_token'
|
||||
workload_identity_provider: 'projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider'
|
||||
service_account: '[email protected]'
|
||||
# Configure Workload Identity Federation and generate an access token.
|
||||
#
|
||||
# See https://github.com/google-github-actions/auth for more options,
|
||||
# including authenticating via a JSON credentials file.
|
||||
- id: 'auth'
|
||||
name: 'Authenticate to Google Cloud'
|
||||
uses: 'google-github-actions/auth@f112390a2df9932162083945e46d439060d66ec2' # google-github-actions/auth@v2
|
||||
with:
|
||||
workload_identity_provider: '${{ env.WORKLOAD_IDENTITY_PROVIDER }}'
|
||||
|
||||
# Alternative option - authentication via credentials json
|
||||
# - id: 'auth'
|
||||
# uses: 'google-github-actions/auth@v0'
|
||||
# with:
|
||||
# credentials_json: '${{ secrets.GCP_CREDENTIALS }}'
|
||||
# Authenticate Docker to Google Cloud Artifact Registry
|
||||
- name: 'Docker Auth'
|
||||
uses: 'docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567' # docker/login-action@v3
|
||||
with:
|
||||
username: 'oauth2accesstoken'
|
||||
password: '${{ steps.auth.outputs.auth_token }}'
|
||||
registry: '${{ env.GAR_LOCATION }}-docker.pkg.dev'
|
||||
|
||||
- name: Docker configuration
|
||||
run: |-
|
||||
echo ${{steps.auth.outputs.access_token}} | docker login -u oauth2accesstoken --password-stdin https://$GAR_LOCATION-docker.pkg.dev
|
||||
# Get the GKE credentials so we can deploy to the cluster
|
||||
- name: Set up GKE credentials
|
||||
uses: google-github-actions/get-gke-credentials@v0
|
||||
with:
|
||||
cluster_name: ${{ env.GKE_CLUSTER }}
|
||||
location: ${{ env.GKE_ZONE }}
|
||||
# Get the GKE credentials so we can deploy to the cluster
|
||||
- name: 'Set up GKE credentials'
|
||||
uses: 'google-github-actions/get-gke-credentials@6051de21ad50fbb1767bc93c11357a49082ad116' # google-github-actions/get-gke-credentials@v2
|
||||
with:
|
||||
cluster_name: '${{ env.GKE_CLUSTER }}'
|
||||
location: '${{ env.GKE_ZONE }}'
|
||||
|
||||
# Build the Docker image
|
||||
- name: Build
|
||||
run: |-
|
||||
docker build \
|
||||
--tag "$GAR_LOCATION-docker.pkg.dev/$PROJECT_ID/$REPOSITORY/$IMAGE:$GITHUB_SHA" \
|
||||
--build-arg GITHUB_SHA="$GITHUB_SHA" \
|
||||
--build-arg GITHUB_REF="$GITHUB_REF" \
|
||||
.
|
||||
# Push the Docker image to Google Artifact Registry
|
||||
- name: Publish
|
||||
run: |-
|
||||
docker push "$GAR_LOCATION-docker.pkg.dev/$PROJECT_ID/$REPOSITORY/$IMAGE:$GITHUB_SHA"
|
||||
# Set up kustomize
|
||||
- name: Set up Kustomize
|
||||
run: |-
|
||||
curl -sfLo kustomize https://github.com/kubernetes-sigs/kustomize/releases/download/v3.1.0/kustomize_3.1.0_linux_amd64
|
||||
chmod u+x ./kustomize
|
||||
# Deploy the Docker image to the GKE cluster
|
||||
- name: Deploy
|
||||
run: |-
|
||||
# replacing the image name in the k8s template
|
||||
./kustomize edit set image LOCATION-docker.pkg.dev/PROJECT_ID/REPOSITORY/IMAGE:TAG=$GAR_LOCATION-docker.pkg.dev/$PROJECT_ID/$REPOSITORY/$IMAGE:$GITHUB_SHA
|
||||
./kustomize build . | kubectl apply -f -
|
||||
kubectl rollout status deployment/$DEPLOYMENT_NAME
|
||||
kubectl get services -o wide
|
||||
# Build the Docker image
|
||||
- name: 'Build and push Docker container'
|
||||
run: |-
|
||||
DOCKER_TAG="${GAR_LOCATION}-docker.pkg.dev/${PROJECT_ID}/${REPOSITORY}/${IMAGE}:${GITHUB_SHA}"
|
||||
|
||||
docker build \
|
||||
--tag "${DOCKER_TAG}" \
|
||||
--build-arg GITHUB_SHA="${GITHUB_SHA}" \
|
||||
--build-arg GITHUB_REF="${GITHUB_REF}" \
|
||||
.
|
||||
|
||||
docker push "${DOCKER_TAG}"
|
||||
|
||||
# Set up kustomize
|
||||
- name: 'Set up Kustomize'
|
||||
run: |-
|
||||
curl -sfLo kustomize https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv5.4.3/kustomize_v5.4.3_linux_amd64.tar.gz
|
||||
chmod u+x ./kustomize
|
||||
|
||||
# Deploy the Docker image to the GKE cluster
|
||||
- name: 'Deploy to GKE'
|
||||
run: |-
|
||||
# replacing the image name in the k8s template
|
||||
./kustomize edit set image LOCATION-docker.pkg.dev/PROJECT_ID/REPOSITORY/IMAGE:TAG=$GAR_LOCATION-docker.pkg.dev/$PROJECT_ID/$REPOSITORY/$IMAGE:$GITHUB_SHA
|
||||
./kustomize build . | kubectl apply -f -
|
||||
kubectl rollout status deployment/$DEPLOYMENT_NAME
|
||||
kubectl get services -o wide
|
||||
|
||||
@@ -0,0 +1,112 @@
|
||||
# This workflow uses actions that are not certified by GitHub.
|
||||
# They are provided by a third-party and are governed by separate terms of service,
|
||||
# privacy policy, and support documentation.
|
||||
#
|
||||
# This workflow will build and publish a Docker container which is then deployed through Octopus Deploy.
|
||||
#
|
||||
# The build job in this workflow currently assumes that there is a Dockerfile that generates the relevant application image.
|
||||
# If required, this job can be modified to generate whatever alternative build artifact is required for your deployment.
|
||||
#
|
||||
# This workflow assumes you have already created a Project in Octopus Deploy.
|
||||
# For instructions see https://octopus.com/docs/projects/setting-up-projects
|
||||
#
|
||||
# To configure this workflow:
|
||||
#
|
||||
# 1. Decide where you are going to host your image.
|
||||
# This template uses the GitHub Registry for simplicity but if required you can update the relevant DOCKER_REGISTRY variables below.
|
||||
#
|
||||
# 2. Create and configure an OIDC credential for a service account in Octopus.
|
||||
# This allows for passwordless authentication to your Octopus instance through a trust relationship configured between Octopus, GitHub and your GitHub Repository.
|
||||
# https://octopus.com/docs/octopus-rest-api/openid-connect/github-actions
|
||||
#
|
||||
# 3. Configure your Octopus project details below:
|
||||
# OCTOPUS_URL: update to your Octopus Instance Url
|
||||
# OCTOPUS_SERVICE_ACCOUNT: update to your service account Id
|
||||
# OCTOPUS_SPACE: update to the name of the space your project is configured in
|
||||
# OCTOPUS_PROJECT: update to the name of your Octopus project
|
||||
# OCTOPUS_ENVIRONMENT: update to the name of the environment to recieve the first deployment
|
||||
|
||||
|
||||
name: 'Build and Deploy to Octopus Deploy'
|
||||
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- '$default-branch'
|
||||
|
||||
jobs:
|
||||
build:
|
||||
name: Build
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
packages: write
|
||||
contents: read
|
||||
env:
|
||||
DOCKER_REGISTRY: ghcr.io # TODO: Update to your docker registry uri
|
||||
DOCKER_REGISTRY_USERNAME: ${{ github.actor }} # TODO: Update to your docker registry username
|
||||
DOCKER_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }} # TODO: Update to your docker registry password
|
||||
outputs:
|
||||
image_tag: ${{ steps.meta.outputs.version }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
|
||||
|
||||
- name: Log in to the Container registry
|
||||
uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
|
||||
with:
|
||||
registry: ${{ env.DOCKER_REGISTRY }}
|
||||
username: ${{ env.DOCKER_REGISTRY_USERNAME }}
|
||||
password: ${{ env.DOCKER_REGISTRY_PASSWORD }}
|
||||
|
||||
- name: Extract metadata (tags, labels) for Docker
|
||||
id: meta
|
||||
uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
|
||||
with:
|
||||
images: ${{ env.DOCKER_REGISTRY }}/${{ github.repository }}
|
||||
tags: type=semver,pattern={{version}},value=v1.0.0-{{sha}}
|
||||
|
||||
- name: Build and push Docker image
|
||||
id: push
|
||||
uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
|
||||
with:
|
||||
context: .
|
||||
push: true
|
||||
tags: ${{ steps.meta.outputs.tags }}
|
||||
labels: ${{ steps.meta.outputs.labels }}
|
||||
deploy:
|
||||
name: Deploy
|
||||
permissions:
|
||||
id-token: write
|
||||
runs-on: ubuntu-latest
|
||||
needs: [ build ]
|
||||
env:
|
||||
OCTOPUS_URL: 'https://your-octopus-url' # TODO: update to your Octopus Instance url
|
||||
OCTOPUS_SERVICE_ACCOUNT: 'your-service-account-id' # TODO: update to your service account Id
|
||||
OCTOPUS_SPACE: 'your-space' # TODO: update to the name of the space your project is configured in
|
||||
OCTOPUS_PROJECT: 'your-project' # TODO: update to the name of your Octopus project
|
||||
OCTOPUS_ENVIRONMENT: 'your-environment' # TODO: update to the name of the environment to recieve the first deployment
|
||||
|
||||
steps:
|
||||
- name: Login to Octopus Deploy
|
||||
uses: OctopusDeploy/login@34b6dcc1e86fa373c14e6a28c5507d221e4de629 #v1.0.2
|
||||
with:
|
||||
server: '${{ env.OCTOPUS_URL }}'
|
||||
service_account_id: '${{ env.OCTOPUS_SERVICE_ACCOUNT }}'
|
||||
|
||||
- name: Create Release
|
||||
id: create_release
|
||||
uses: OctopusDeploy/create-release-action@fea7e7b45c38c021b6bc5a14bd7eaa2ed5269214 #v3.2.2
|
||||
with:
|
||||
project: '${{ env.OCTOPUS_PROJECT }}'
|
||||
space: '${{ env.OCTOPUS_SPACE }}'
|
||||
packages: '*:${{ needs.build.outputs.image_tag }}'
|
||||
|
||||
- name: Deploy Release
|
||||
uses: OctopusDeploy/deploy-release-action@b10a606c903b0a5bce24102af9d066638ab429ac #v3.2.1
|
||||
with:
|
||||
project: '${{ env.OCTOPUS_PROJECT }}'
|
||||
space: '${{ env.OCTOPUS_SPACE }}'
|
||||
release_number: '${{ steps.create_release.outputs.release_number }}'
|
||||
environments: ${{ env.OCTOPUS_ENVIRONMENT }}
|
||||
@@ -0,0 +1,7 @@
|
||||
{
|
||||
"name": "Build and Deploy with Octopus Deploy",
|
||||
"description": "Build a docker container, create a release in Octopus Deploy and deploy it to your environment.",
|
||||
"creator": "Octopus Deploy",
|
||||
"iconName": "octopusdeploy",
|
||||
"categories": ["Deployment", "Containers", "Dockerfile"]
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
<svg width="913" height="747" viewBox="0 0 913 747" fill="none" xmlns="http://www.w3.org/2000/svg">
|
||||
<g clip-path="url(#clip0_2_25)">
|
||||
<path d="M817.216 165.78L347 167L346.464 167.121C302.41 170.874 261.309 190.92 231.128 223.377C194.908 261.674 176.798 311.72 176.798 373.515C176.798 433.583 195.14 482.876 231.826 521.397C268.51 559.916 314.412 579.177 369.531 579.177C425.944 579.177 472.27 560.141 508.51 522.068C544.751 483.994 562.881 434.476 562.901 373.515C562.901 316.466 546.511 269.267 514.337 231.67H714.02C732.426 276.89 741.8 325.304 741.61 374.155C741.849 439.763 724.656 504.245 691.807 560.949C658.956 617.653 611.637 664.522 554.736 696.719C497.519 729.853 432.598 747.199 366.557 747C274.247 747 192.57 714.792 121.528 650.375C40.5904 576.382 0.121582 483.892 0.121582 372.906C0.121582 269.236 35.9768 181.197 107.687 108.792C179.399 36.386 265.961 0.142345 367.375 0.0610352C376.906 0.0610352 384.554 0.396444 388.896 0.640372H391.657C392.719 0.640372 595.954 0.853638 911.337 1.03659L817.216 165.78Z" fill="#FF4D3F"/>
|
||||
</g>
|
||||
<defs>
|
||||
<clipPath id="clip0_2_25">
|
||||
<rect width="913" height="747" fill="white"/>
|
||||
</clipPath>
|
||||
</defs>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 1.1 KiB |
@@ -0,0 +1,3 @@
|
||||
<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 130.82474 165.72391">
|
||||
<path d="M130.80005,64.2v3.5a24.02765,24.02765,0,0,1-24,24.1h-.2A22.62736,22.62736,0,0,1,88,83c-4.8999-6.2-10.8999-10.9-22.3-10.9-12.1001,0-27.3,7.8-27.3,29.8,0,21.1,13.7,30.6,27.30005,30.6,13.1001,0,18.3999-7.1,21.8999-11.1,6.1001-7,12.39991-9.1,19.89991-9,9.10009,0,23.10009,8,23.2,24.1.2,18.7.10009,27.7.10009,27.7H92.69971l.10009-22.4s-8.10009,24.8-41.8999,23.9C25.3999,165,0,144.3,0,102.3,0,61.5,23.80005,39.7,51,38.9c24.5-.8,36.5,11.7,41.80005,23.9L92.7,0h38.1001Z" fill="#0d1840"/>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 606 B |
@@ -0,0 +1,11 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
|
||||
viewBox="0 0 48 48" style="enable-background:new 0 0 48 48;" xml:space="preserve">
|
||||
<style type="text/css">
|
||||
.st0{fill:#0D80D8;}
|
||||
</style>
|
||||
<path class="st0" d="M4.2,36.3C7.8,34,12,30,10.4,25.4c-0.9-2.6-2-4.7-2.3-7.5c-0.1-2.4,0.2-4.7,1-6.8C12.4,2.4,21.9-1.8,30.5,0.8
|
||||
c7.9,2.4,13.4,11.8,10.1,19.8c-1.9,4.7-2.8,8.4,1.5,12c1.2,1,3.9,2.5,3.9,4.3c0,2.3-4.5-0.5-4.9-0.9c0.6,1,6.2,6.9,2.6,7.3
|
||||
c-3.3,0.4-6.2-4.3-8.1-6.2c-3.3-3.4-2.8,4-2.8,5.6c0,2.4-1.7,7.3-4.7,4.1c-2.5-2.6-1.5-6.8-3.3-9.8c-1.9-3.2-5.1,3.2-5.9,4.4
|
||||
c-0.9,1.3-5.3,7.6-7.1,4.3c-1.5-2.7,0.9-7.1,2-9.6c-0.4,0.9-3.3,2.2-4.1,2.6c-1.8,1-3.9,1.5-6,1.4C-1,39.9,2.4,37.5,4.2,36.3z"/>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 817 B |
Reference in New Issue
Block a user