Ashwin Sangem
44278596c1
* Secure workflows (#1) (#1072) * Restrict permissions for the GITHUB_TOKEN in .github/workflows/label-feature.yml * Restrict permissions for the GITHUB_TOKEN in .github/workflows/label-support.yml * Restrict permissions for the GITHUB_TOKEN in .github/workflows/stale.yml * Restrict permissions for the GITHUB_TOKEN in .github/workflows/sync_ghes.yaml * Restrict permissions for the GITHUB_TOKEN in .github/workflows/validate-data.yaml Co-authored-by: Step Security <bot@stepsecurity.io> Co-authored-by: step-security[bot] <89328102+step-security[bot]@users.noreply.github.com> Co-authored-by: Step Security <bot@stepsecurity.io> * Directory for deployments (#1071) * moving deployment templates * including deployment directory in scripts * validate categories script init * introducing scout * introducing workflow * Update validate-categories.yaml * Update validate-categories.yaml * Update validate-categories.yaml * Update validate.rb * Update validate.rb * Update validate.rb * Update validate.rb * Update validate-categories.yaml * Update validate-categories.yaml * Update validate-categories.yaml * Update validate.rb * Update validate-categories.yaml * Update validate-categories.yaml * Create test_comment.yaml * rename * using [enter] * testing newline * test * setting up variable * using echo -e * using join * testing space space new line * setting multi line in echo * removing checkout * setting rows-generator * fixing error * using join * commit * Update test_comment.yaml * escaping pipe * printing debug line * using %0A * Update validate-categories.yaml * Update validate.rb * Update validate.rb * removing debug * removing variable * Update validate.rb * Update validate-categories.yaml * Validate categories comment on pr (#32) * reverting deployment directory * checking for output * Categories validation two workflows (#34) comment on pr in a separate workflow * Categories validation two workflows (#35) using right dir name * Categories validation two workflows (#36) . * Categories validation two workflows (#37) fixing typo * adding if conditions * adding try catch * using console instead of echo * equating to upstream * moving deployment templates * add codeql workflow to ghes * restoring from main (#1078) * Revert "add codeql workflow to ghes branch" * add codeql workflow to ghes * only run ghes sync checks on YML files * only check nwo of supported actions * Testing Partner Toggle. Co-authored-by: Varun Sharma <varunsh@stepsecurity.io> Co-authored-by: step-security[bot] <89328102+step-security[bot]@users.noreply.github.com> Co-authored-by: Step Security <bot@stepsecurity.io> Co-authored-by: Aparna Ravindra <82894348+aparna-ravindra@users.noreply.github.com> Co-authored-by: Nick Fyson <nickfyson@github.com>
81 lines
2.9 KiB
YAML
81 lines
2.9 KiB
YAML
# This workflow will build a docker container, publish it to Google Container Registry, and deploy it to GKE when a release is created
|
|
#
|
|
# To configure this workflow:
|
|
#
|
|
# 1. Ensure that your repository contains the necessary configuration for your Google Kubernetes Engine cluster, including deployment.yml, kustomization.yml, service.yml, etc.
|
|
#
|
|
# 2. Set up secrets in your workspace: GKE_PROJECT with the name of the project and GKE_SA_KEY with the Base64 encoded JSON service account key (https://github.com/GoogleCloudPlatform/github-actions/tree/docs/service-account-key/setup-gcloud#inputs).
|
|
#
|
|
# 3. Change the values for the GKE_ZONE, GKE_CLUSTER, IMAGE, and DEPLOYMENT_NAME environment variables (below).
|
|
#
|
|
# For more support on how to run the workflow, please visit https://github.com/google-github-actions/setup-gcloud/tree/master/example-workflows/gke
|
|
|
|
name: Build and Deploy to GKE
|
|
|
|
on:
|
|
release:
|
|
types: [created]
|
|
|
|
env:
|
|
PROJECT_ID: ${{ secrets.GKE_PROJECT }}
|
|
GKE_CLUSTER: cluster-1 # TODO: update to cluster name
|
|
GKE_ZONE: us-central1-c # TODO: update to cluster zone
|
|
DEPLOYMENT_NAME: gke-test # TODO: update to deployment name
|
|
IMAGE: static-site
|
|
|
|
jobs:
|
|
setup-build-publish-deploy:
|
|
name: Setup, Build, Publish, and Deploy
|
|
runs-on: ubuntu-latest
|
|
environment: production
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v2
|
|
|
|
# Setup gcloud CLI
|
|
- uses: google-github-actions/setup-gcloud@v0.2.0
|
|
with:
|
|
service_account_key: ${{ secrets.GKE_SA_KEY }}
|
|
project_id: ${{ secrets.GKE_PROJECT }}
|
|
|
|
# Configure Docker to use the gcloud command-line tool as a credential
|
|
# helper for authentication
|
|
- run: |-
|
|
gcloud --quiet auth configure-docker
|
|
|
|
# Get the GKE credentials so we can deploy to the cluster
|
|
- uses: google-github-actions/get-gke-credentials@v0.2.1
|
|
with:
|
|
cluster_name: ${{ env.GKE_CLUSTER }}
|
|
location: ${{ env.GKE_ZONE }}
|
|
credentials: ${{ secrets.GKE_SA_KEY }}
|
|
|
|
# Build the Docker image
|
|
- name: Build
|
|
run: |-
|
|
docker build \
|
|
--tag "gcr.io/$PROJECT_ID/$IMAGE:$GITHUB_SHA" \
|
|
--build-arg GITHUB_SHA="$GITHUB_SHA" \
|
|
--build-arg GITHUB_REF="$GITHUB_REF" \
|
|
.
|
|
|
|
# Push the Docker image to Google Container Registry
|
|
- name: Publish
|
|
run: |-
|
|
docker push "gcr.io/$PROJECT_ID/$IMAGE:$GITHUB_SHA"
|
|
|
|
# Set up kustomize
|
|
- name: Set up Kustomize
|
|
run: |-
|
|
curl -sfLo kustomize https://github.com/kubernetes-sigs/kustomize/releases/download/v3.1.0/kustomize_3.1.0_linux_amd64
|
|
chmod u+x ./kustomize
|
|
|
|
# Deploy the Docker image to the GKE cluster
|
|
- name: Deploy
|
|
run: |-
|
|
./kustomize edit set image gcr.io/PROJECT_ID/IMAGE:TAG=gcr.io/$PROJECT_ID/$IMAGE:$GITHUB_SHA
|
|
./kustomize build . | kubectl apply -f -
|
|
kubectl rollout status deployment/$DEPLOYMENT_NAME
|
|
kubectl get services -o wide
|