Skip to content

Commit 42a0a0f

Browse files
HardMax71HardMax71
authored
Deploy via helm (#8)
* deploy with help + added instruction * nginx config doc fix of diagram * security policies doc updated * passing nginx.conf vals as part of deploy, + pre-built backend/frontend containers * ruff+mypy fixes * mypy fix * removed hardcoded redis ports * docker name fix (-> lowercase) * automatic build/load of base container * ci: updated gh actions' versions * ci: scan of backend+frontend (trivy) - in parallel; docs updated * ci: trivy updated to 0.68.2 * security: added automount=False for components that don't need k8s api access * chore: posix -> bash brackets * deploy: instead of sleep -> wait flags + healthchecks; + docs * deploy: replaced timeout with curling backend (that waits for all other contents); + updated docs * deploy: updated files, + msc fixes
1 parent 917bcdd commit 42a0a0f

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

53 files changed

+3674
-180
lines changed

‎.github/workflows/docker.yml‎

Lines changed: 258 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,275 @@
1-
name: Docker Build & Scan
1+
name: Docker Build, Scan & Publish
22

33
on:
44
push:
5-
branches: [ main, dev ]
5+
branches: [ main ]
6+
tags: [ 'v*' ]
67
pull_request:
7-
branches: [ main, dev ]
8+
branches: [ main ]
89
workflow_dispatch:
910

11+
env:
12+
REGISTRY: ghcr.io
13+
1014
jobs:
11-
docker:
12-
name: Docker Build & Scan
15+
build-base:
16+
name: Build Base
17+
runs-on: ubuntu-latest
18+
permissions:
19+
contents: read
20+
packages: write
21+
22+
outputs:
23+
image-tag: ${{ steps.image-tag.outputs.tag }}
24+
25+
steps:
26+
- uses: actions/checkout@v6
27+
28+
- name: Set lowercase image prefix
29+
run: echo "IMAGE_PREFIX=${GITHUB_REPOSITORY_OWNER,,}/integr8scode" >> $GITHUB_ENV
30+
31+
- name: Set up Docker Buildx
32+
uses: docker/setup-buildx-action@v3
33+
34+
- name: Log in to GitHub Container Registry
35+
uses: docker/login-action@v3
36+
with:
37+
registry: ${{ env.REGISTRY }}
38+
username: ${{ github.actor }}
39+
password: ${{ secrets.GITHUB_TOKEN }}
40+
41+
- name: Extract metadata
42+
id: meta
43+
uses: docker/metadata-action@v5
44+
with:
45+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/base
46+
tags: |
47+
type=ref,event=branch
48+
type=ref,event=pr
49+
type=semver,pattern={{version}}
50+
type=semver,pattern={{major}}.{{minor}}
51+
type=sha,prefix=sha-
52+
type=raw,value=latest,enable={{is_default_branch}}
53+
54+
- name: Determine image tag for dependent builds
55+
id: image-tag
56+
run: |
57+
if [ "${{ github.event_name }}" = "pull_request" ]; then
58+
echo "tag=pr-${{ github.event.number }}" >> $GITHUB_OUTPUT
59+
else
60+
echo "tag=latest" >> $GITHUB_OUTPUT
61+
fi
62+
63+
- name: Build and push
64+
uses: docker/build-push-action@v6
65+
with:
66+
context: ./backend
67+
file: ./backend/Dockerfile.base
68+
push: true
69+
tags: ${{ steps.meta.outputs.tags }}
70+
labels: ${{ steps.meta.outputs.labels }}
71+
cache-from: type=gha,scope=base
72+
cache-to: type=gha,mode=max,scope=base
73+
74+
build-backend:
75+
name: Build Backend
76+
needs: build-base
1377
runs-on: ubuntu-latest
78+
permissions:
79+
contents: read
80+
packages: write
81+
82+
outputs:
83+
image-ref: ${{ steps.image-ref.outputs.ref }}
84+
1485
steps:
15-
- uses: actions/checkout@v4
16-
- name: Build base image
86+
- uses: actions/checkout@v6
87+
88+
- name: Set lowercase image prefix
89+
run: echo "IMAGE_PREFIX=${GITHUB_REPOSITORY_OWNER,,}/integr8scode" >> $GITHUB_ENV
90+
91+
- name: Set up Docker Buildx
92+
uses: docker/setup-buildx-action@v3
93+
94+
- name: Log in to GitHub Container Registry
95+
uses: docker/login-action@v3
96+
with:
97+
registry: ${{ env.REGISTRY }}
98+
username: ${{ github.actor }}
99+
password: ${{ secrets.GITHUB_TOKEN }}
100+
101+
- name: Extract metadata
102+
id: meta
103+
uses: docker/metadata-action@v5
104+
with:
105+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/backend
106+
tags: |
107+
type=ref,event=branch
108+
type=ref,event=pr
109+
type=semver,pattern={{version}}
110+
type=semver,pattern={{major}}.{{minor}}
111+
type=sha,prefix=sha-
112+
type=raw,value=latest,enable={{is_default_branch}}
113+
114+
- name: Set image reference for scan
115+
id: image-ref
17116
run: |
18-
docker build -f ./backend/Dockerfile.base -t integr8scode-base:latest ./backend
117+
if [ "${{ github.event_name }}" = "pull_request" ]; then
118+
echo "ref=${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/backend:pr-${{ github.event.number }}" >> $GITHUB_OUTPUT
119+
else
120+
echo "ref=${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/backend:latest" >> $GITHUB_OUTPUT
121+
fi
122+
123+
- name: Build and push
124+
uses: docker/build-push-action@v6
125+
with:
126+
context: ./backend
127+
file: ./backend/Dockerfile
128+
push: true
129+
tags: ${{ steps.meta.outputs.tags }}
130+
labels: ${{ steps.meta.outputs.labels }}
131+
cache-from: type=gha,scope=backend
132+
cache-to: type=gha,mode=max,scope=backend
133+
build-contexts: |
134+
base=docker-image://${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/base:${{ needs.build-base.outputs.image-tag }}
135+
136+
build-frontend:
137+
name: Build Frontend
138+
needs: build-base
139+
runs-on: ubuntu-latest
140+
permissions:
141+
contents: read
142+
packages: write
143+
144+
outputs:
145+
image-ref: ${{ steps.image-ref.outputs.ref }}
146+
147+
steps:
148+
- uses: actions/checkout@v6
19149

20-
- name: Build Docker image
150+
- name: Set lowercase image prefix
151+
run: echo "IMAGE_PREFIX=${GITHUB_REPOSITORY_OWNER,,}/integr8scode" >> $GITHUB_ENV
152+
153+
- name: Set up Docker Buildx
154+
uses: docker/setup-buildx-action@v3
155+
156+
- name: Log in to GitHub Container Registry
157+
uses: docker/login-action@v3
158+
with:
159+
registry: ${{ env.REGISTRY }}
160+
username: ${{ github.actor }}
161+
password: ${{ secrets.GITHUB_TOKEN }}
162+
163+
- name: Extract metadata
164+
id: meta
165+
uses: docker/metadata-action@v5
166+
with:
167+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/frontend
168+
tags: |
169+
type=ref,event=branch
170+
type=ref,event=pr
171+
type=semver,pattern={{version}}
172+
type=semver,pattern={{major}}.{{minor}}
173+
type=sha,prefix=sha-
174+
type=raw,value=latest,enable={{is_default_branch}}
175+
176+
- name: Set image reference for scan
177+
id: image-ref
21178
run: |
22-
DOCKER_BUILDKIT=1 docker build \
23-
--build-context base=docker-image://integr8scode-base:latest \
24-
-t integr8scode:test \
25-
./backend
179+
if [ "${{ github.event_name }}" = "pull_request" ]; then
180+
echo "ref=${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/frontend:pr-${{ github.event.number }}" >> $GITHUB_OUTPUT
181+
else
182+
echo "ref=${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/frontend:latest" >> $GITHUB_OUTPUT
183+
fi
184+
185+
- name: Build and push
186+
uses: docker/build-push-action@v6
187+
with:
188+
context: ./frontend
189+
file: ./frontend/Dockerfile.prod
190+
push: true
191+
tags: ${{ steps.meta.outputs.tags }}
192+
labels: ${{ steps.meta.outputs.labels }}
193+
cache-from: type=gha,scope=frontend
194+
cache-to: type=gha,mode=max,scope=frontend
195+
196+
scan-backend:
197+
name: Scan Backend
198+
needs: build-backend
199+
runs-on: ubuntu-latest
200+
permissions:
201+
contents: read
202+
security-events: write
203+
204+
steps:
205+
- uses: actions/checkout@v6
206+
207+
- name: Run Trivy vulnerability scanner
208+
uses: aquasecurity/[email protected]
209+
with:
210+
image-ref: ${{ needs.build-backend.outputs.image-ref }}
211+
format: 'sarif'
212+
output: 'trivy-backend-results.sarif'
213+
ignore-unfixed: true
214+
severity: 'CRITICAL,HIGH'
215+
timeout: '5m0s'
216+
trivyignores: 'backend/.trivyignore'
217+
version: 'v0.68.2'
218+
219+
- name: Upload Trivy scan results
220+
if: always()
221+
uses: github/codeql-action/upload-sarif@v4
222+
with:
223+
sarif_file: 'trivy-backend-results.sarif'
224+
category: 'trivy-backend'
225+
226+
scan-frontend:
227+
name: Scan Frontend
228+
needs: build-frontend
229+
runs-on: ubuntu-latest
230+
permissions:
231+
contents: read
232+
security-events: write
233+
234+
steps:
26235
- name: Run Trivy vulnerability scanner
27-
uses: aquasecurity/trivy-action@master
236+
uses: aquasecurity/trivy-action@0.33.1
28237
with:
29-
image-ref: 'integr8scode:test'
30-
format: 'table'
31-
exit-code: '1'
238+
image-ref: ${{ needs.build-frontend.outputs.image-ref }}
239+
format: 'sarif'
240+
output: 'trivy-frontend-results.sarif'
32241
ignore-unfixed: true
33242
severity: 'CRITICAL,HIGH'
34243
timeout: '5m0s'
35-
trivyignores: 'backend/.trivyignore'
244+
version: 'v0.68.2'
245+
246+
- name: Upload Trivy scan results
247+
if: always()
248+
uses: github/codeql-action/upload-sarif@v4
249+
with:
250+
sarif_file: 'trivy-frontend-results.sarif'
251+
category: 'trivy-frontend'
252+
253+
summary:
254+
name: Summary
255+
if: github.event_name != 'pull_request'
256+
needs: [build-base, build-backend, build-frontend, scan-backend, scan-frontend]
257+
runs-on: ubuntu-latest
258+
259+
steps:
260+
- name: Set lowercase image prefix
261+
run: echo "IMAGE_PREFIX=${GITHUB_REPOSITORY_OWNER,,}/integr8scode" >> $GITHUB_ENV
262+
263+
- name: Generate summary
264+
run: |
265+
echo "## Docker Images Published" >> $GITHUB_STEP_SUMMARY
266+
echo "" >> $GITHUB_STEP_SUMMARY
267+
echo "| Image | Pull Command |" >> $GITHUB_STEP_SUMMARY
268+
echo "|-------|--------------|" >> $GITHUB_STEP_SUMMARY
269+
echo "| Base | \`docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/base:latest\` |" >> $GITHUB_STEP_SUMMARY
270+
echo "| Backend | \`docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/backend:latest\` |" >> $GITHUB_STEP_SUMMARY
271+
echo "| Frontend | \`docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/frontend:latest\` |" >> $GITHUB_STEP_SUMMARY
272+
echo "" >> $GITHUB_STEP_SUMMARY
273+
echo "### Scan Results" >> $GITHUB_STEP_SUMMARY
274+
echo "- Backend scan: ✅ Passed" >> $GITHUB_STEP_SUMMARY
275+
echo "- Frontend scan: ✅ Passed" >> $GITHUB_STEP_SUMMARY

‎.github/workflows/docs.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ jobs:
2929
runs-on: ubuntu-latest
3030
steps:
3131
- name: Checkout repository
32-
uses: actions/checkout@v4
32+
uses: actions/checkout@v6
3333

3434
- name: Set up uv
3535
uses: astral-sh/setup-uv@v5

‎.github/workflows/mypy.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
name: Mypy Type Checking
1313
runs-on: ubuntu-latest
1414
steps:
15-
- uses: actions/checkout@v4
15+
- uses: actions/checkout@v6
1616

1717
- name: Set up uv
1818
uses: astral-sh/setup-uv@v5

‎.github/workflows/ruff.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
name: Ruff Linting
1313
runs-on: ubuntu-latest
1414
steps:
15-
- uses: actions/checkout@v4
15+
- uses: actions/checkout@v6
1616

1717
- name: Set up uv
1818
uses: astral-sh/setup-uv@v5

‎.github/workflows/security.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
name: Security Scanning
1313
runs-on: ubuntu-latest
1414
steps:
15-
- uses: actions/checkout@v4
15+
- uses: actions/checkout@v6
1616

1717
- name: Set up uv
1818
uses: astral-sh/setup-uv@v5

0 commit comments

Comments
 (0)