| 
 | 1 | +# This workflow uses actions that are not certified by GitHub.  | 
 | 2 | +# They are provided by a third-party and are governed by  | 
 | 3 | +# separate terms of service, privacy policy, and support  | 
 | 4 | +# documentation.  | 
 | 5 | + | 
 | 6 | +# 💁 The OpenShift Starter workflow will:  | 
 | 7 | +# - Checkout your repository  | 
 | 8 | +# - Perform a container image build  | 
 | 9 | +# - Push the built image to the GitHub Container Registry (GHCR)  | 
 | 10 | +# - Log in to your OpenShift cluster  | 
 | 11 | +# - Create an OpenShift app from the image and expose it to the internet  | 
 | 12 | + | 
 | 13 | +# ℹ️ Configure your repository and the workflow with the following steps:  | 
 | 14 | +# 1. Have access to an OpenShift cluster. Refer to https://www.openshift.com/try  | 
 | 15 | +# 2. Create the OPENSHIFT_SERVER and OPENSHIFT_TOKEN repository secrets. Refer to:  | 
 | 16 | +#   - https://github.com/redhat-actions/oc-login#readme  | 
 | 17 | +#   - https://docs.github.com/en/actions/reference/encrypted-secrets  | 
 | 18 | +#   - https://cli.github.com/manual/gh_secret_set  | 
 | 19 | +# 3. (Optional) Edit the top-level 'env' section as marked with '🖊️' if the defaults are not suitable for your project.  | 
 | 20 | +# 4. (Optional) Edit the build-image step to build your project.  | 
 | 21 | +#    The default build type is by using a Dockerfile at the root of the repository,  | 
 | 22 | +#    but can be replaced with a different file, a source-to-image build, or a step-by-step buildah build.  | 
 | 23 | +# 5. Commit and push the workflow file to your default branch to trigger a workflow run.  | 
 | 24 | + | 
 | 25 | +# 👋 Visit our GitHub organization at https://github.com/redhat-actions/ to see our actions and provide feedback.  | 
 | 26 | + | 
 | 27 | +name: OpenShift  | 
 | 28 | + | 
 | 29 | +env:  | 
 | 30 | +  # 🖊️ EDIT your repository secrets to log into your OpenShift cluster and set up the context.  | 
 | 31 | +  # See https://github.com/redhat-actions/oc-login#readme for how to retrieve these values.  | 
 | 32 | +  # To get a permanent token, refer to https://github.com/redhat-actions/oc-login/wiki/Using-a-Service-Account-for-GitHub-Actions  | 
 | 33 | +  OPENSHIFT_SERVER: ${{ secrets.OPENSHIFT_SERVER }}  | 
 | 34 | +  OPENSHIFT_TOKEN: ${{ secrets.OPENSHIFT_TOKEN }}  | 
 | 35 | +  # 🖊️ EDIT to set the kube context's namespace after login. Leave blank to use your user's default namespace.  | 
 | 36 | +  OPENSHIFT_NAMESPACE: ""  | 
 | 37 | + | 
 | 38 | +  # 🖊️ EDIT to set a name for your OpenShift app, or a default one will be generated below.  | 
 | 39 | +  APP_NAME: ""  | 
 | 40 | + | 
 | 41 | +  # 🖊️ EDIT with the port your application should be accessible on.  | 
 | 42 | +  # If the container image exposes *exactly one* port, this can be left blank.  | 
 | 43 | +  # Refer to the 'port' input of https://github.com/redhat-actions/oc-new-app  | 
 | 44 | +  APP_PORT: ""  | 
 | 45 | + | 
 | 46 | +  # 🖊️ EDIT to change the image registry settings.  | 
 | 47 | +  # Registries such as GHCR, Quay.io, and Docker Hub are supported.  | 
 | 48 | +  IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}  | 
 | 49 | +  IMAGE_REGISTRY_USER: ${{ github.actor }}  | 
 | 50 | +  IMAGE_REGISTRY_PASSWORD: ${{ github.token }}  | 
 | 51 | + | 
 | 52 | +  # 🖊️ EDIT to specify custom tags for the container image, or default tags will be generated below.  | 
 | 53 | +  IMAGE_TAGS: ""  | 
 | 54 | + | 
 | 55 | +on:  | 
 | 56 | +  # https://docs.github.com/en/actions/reference/events-that-trigger-workflows  | 
 | 57 | +  workflow_dispatch:  | 
 | 58 | +  push:  | 
 | 59 | +    # Edit to the branch(es) you want to build and deploy on each push.  | 
 | 60 | +    branches: [ "main" ]  | 
 | 61 | + | 
 | 62 | +jobs:  | 
 | 63 | +  # 🖊️ EDIT if you want to run vulnerability check on your project before deploying  | 
 | 64 | +  # the application. Please uncomment the below CRDA scan job and configure to run it in  | 
 | 65 | +  # your workflow. For details about CRDA action visit https://github.com/redhat-actions/crda/blob/main/README.md  | 
 | 66 | +  #  | 
 | 67 | +  # TODO: Make sure to add 'CRDA Scan' starter workflow from the 'Actions' tab.  | 
 | 68 | +  # For guide on adding new starter workflow visit https://docs.github.com/en/github-ae@latest/actions/using-workflows/using-starter-workflows  | 
 | 69 | + | 
 | 70 | +  crda-scan:  | 
 | 71 | +    uses: ./.github/workflows/crda.yml  | 
 | 72 | +    secrets:  | 
 | 73 | +      CRDA_KEY: ${{ secrets.CRDA_KEY }}  | 
 | 74 | +      # SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}       # Either use SNYK_TOKEN or CRDA_KEY  | 
 | 75 | + | 
 | 76 | +  openshift-ci-cd:  | 
 | 77 | +    # 🖊️ Uncomment this if you are using CRDA scan step above  | 
 | 78 | +    # needs: crda-scan  | 
 | 79 | +    name: Build and deploy to OpenShift  | 
 | 80 | +    runs-on: ubuntu-20.04  | 
 | 81 | +    environment: production  | 
 | 82 | + | 
 | 83 | +    outputs:  | 
 | 84 | +      ROUTE: ${{ steps.deploy-and-expose.outputs.route }}  | 
 | 85 | +      SELECTOR: ${{ steps.deploy-and-expose.outputs.selector }}  | 
 | 86 | + | 
 | 87 | +    steps:  | 
 | 88 | +    - name: Check for required secrets  | 
 | 89 | +      uses: actions/github-script@v6  | 
 | 90 | +      with:  | 
 | 91 | +        script: |  | 
 | 92 | +          const secrets = {  | 
 | 93 | +            OPENSHIFT_SERVER: `${{ secrets.OPENSHIFT_SERVER }}`,  | 
 | 94 | +            OPENSHIFT_TOKEN: `${{ secrets.OPENSHIFT_TOKEN }}`,  | 
 | 95 | +          };  | 
 | 96 | +
  | 
 | 97 | +          const GHCR = "ghcr.io";  | 
 | 98 | +          if (`${{ env.IMAGE_REGISTRY }}`.startsWith(GHCR)) {  | 
 | 99 | +            core.info(`Image registry is ${GHCR} - no registry password required`);  | 
 | 100 | +          }  | 
 | 101 | +          else {  | 
 | 102 | +            core.info("A registry password is required");  | 
 | 103 | +            secrets["IMAGE_REGISTRY_PASSWORD"] = `${{ secrets.IMAGE_REGISTRY_PASSWORD }}`;  | 
 | 104 | +          }  | 
 | 105 | +
  | 
 | 106 | +          const missingSecrets = Object.entries(secrets).filter(([ name, value ]) => {  | 
 | 107 | +            if (value.length === 0) {  | 
 | 108 | +              core.error(`Secret "${name}" is not set`);  | 
 | 109 | +              return true;  | 
 | 110 | +            }  | 
 | 111 | +            core.info(`✔️ Secret "${name}" is set`);  | 
 | 112 | +            return false;  | 
 | 113 | +          });  | 
 | 114 | +
  | 
 | 115 | +          if (missingSecrets.length > 0) {  | 
 | 116 | +            core.setFailed(`❌ At least one required secret is not set in the repository. \n` +  | 
 | 117 | +              "You can add it using:\n" +  | 
 | 118 | +              "GitHub UI: https://docs.github.com/en/actions/reference/encrypted-secrets#creating-encrypted-secrets-for-a-repository \n" +  | 
 | 119 | +              "GitHub CLI: https://cli.github.com/manual/gh_secret_set \n" +  | 
 | 120 | +              "Also, refer to https://github.com/redhat-actions/oc-login#getting-started-with-the-action-or-see-example");  | 
 | 121 | +          }  | 
 | 122 | +          else {  | 
 | 123 | +            core.info(`✅ All the required secrets are set`);  | 
 | 124 | +          }  | 
 | 125 | +
  | 
 | 126 | +    - name: Check out repository  | 
 | 127 | +      uses: actions/checkout@v3  | 
 | 128 | + | 
 | 129 | +    - name: Determine app name  | 
 | 130 | +      if: env.APP_NAME == ''  | 
 | 131 | +      run: |  | 
 | 132 | +        echo "APP_NAME=$(basename $PWD)" | tee -a $GITHUB_ENV  | 
 | 133 | +
  | 
 | 134 | +    - name: Determine image tags  | 
 | 135 | +      if: env.IMAGE_TAGS == ''  | 
 | 136 | +      run: |  | 
 | 137 | +        echo "IMAGE_TAGS=latest ${GITHUB_SHA::12}" | tee -a $GITHUB_ENV  | 
 | 138 | +
  | 
 | 139 | +    # https://github.com/redhat-actions/buildah-build#readme  | 
 | 140 | +    - name: Build from Dockerfile  | 
 | 141 | +      id: build-image  | 
 | 142 | +      uses: redhat-actions/buildah-build@v2  | 
 | 143 | +      with:  | 
 | 144 | +        image: ${{ env.APP_NAME }}  | 
 | 145 | +        tags: ${{ env.IMAGE_TAGS }}  | 
 | 146 | + | 
 | 147 | +        # If you don't have a Dockerfile/Containerfile, refer to https://github.com/redhat-actions/buildah-build#scratch-build-inputs  | 
 | 148 | +        # Or, perform a source-to-image build using https://github.com/redhat-actions/s2i-build  | 
 | 149 | +        # Otherwise, point this to your Dockerfile/Containerfile relative to the repository root.  | 
 | 150 | +        dockerfiles: |  | 
 | 151 | +          ./Dockerfile  | 
 | 152 | +
  | 
 | 153 | +    # https://github.com/redhat-actions/push-to-registry#readme  | 
 | 154 | +    - name: Push to registry  | 
 | 155 | +      id: push-image  | 
 | 156 | +      uses: redhat-actions/push-to-registry@v2  | 
 | 157 | +      with:  | 
 | 158 | +        image: ${{ steps.build-image.outputs.image }}  | 
 | 159 | +        tags: ${{ steps.build-image.outputs.tags }}  | 
 | 160 | +        registry: ${{ env.IMAGE_REGISTRY }}  | 
 | 161 | +        username: ${{ env.IMAGE_REGISTRY_USER }}  | 
 | 162 | +        password: ${{ env.IMAGE_REGISTRY_PASSWORD }}  | 
 | 163 | + | 
 | 164 | +    # The path the image was pushed to is now stored in ${{ steps.push-image.outputs.registry-path }}  | 
 | 165 | + | 
 | 166 | +    - name: Install oc  | 
 | 167 | +      uses: redhat-actions/openshift-tools-installer@v1  | 
 | 168 | +      with:  | 
 | 169 | +        oc: 4  | 
 | 170 | + | 
 | 171 | +    # https://github.com/redhat-actions/oc-login#readme  | 
 | 172 | +    - name: Log in to OpenShift  | 
 | 173 | +      uses: redhat-actions/oc-login@v1  | 
 | 174 | +      with:  | 
 | 175 | +        openshift_server_url: ${{ env.OPENSHIFT_SERVER }}  | 
 | 176 | +        openshift_token: ${{ env.OPENSHIFT_TOKEN }}  | 
 | 177 | +        insecure_skip_tls_verify: true  | 
 | 178 | +        namespace: ${{ env.OPENSHIFT_NAMESPACE }}  | 
 | 179 | + | 
 | 180 | +    # This step should create a deployment, service, and route to run your app and expose it to the internet.  | 
 | 181 | +    # https://github.com/redhat-actions/oc-new-app#readme  | 
 | 182 | +    - name: Create and expose app  | 
 | 183 | +      id: deploy-and-expose  | 
 | 184 | +      uses: redhat-actions/oc-new-app@v1  | 
 | 185 | +      with:  | 
 | 186 | +        app_name: ${{ env.APP_NAME }}  | 
 | 187 | +        image: ${{ steps.push-image.outputs.registry-path }}  | 
 | 188 | +        namespace: ${{ env.OPENSHIFT_NAMESPACE }}  | 
 | 189 | +        port: ${{ env.APP_PORT }}  | 
 | 190 | + | 
 | 191 | +    - name: Print application URL  | 
 | 192 | +      env:  | 
 | 193 | +        ROUTE: ${{ steps.deploy-and-expose.outputs.route }}  | 
 | 194 | +        SELECTOR: ${{ steps.deploy-and-expose.outputs.selector }}  | 
 | 195 | +      run: |  | 
 | 196 | +        [[ -n ${{ env.ROUTE }} ]] || (echo "Determining application route failed in previous step"; exit 1)  | 
 | 197 | +        echo  | 
 | 198 | +        echo "======================== Your application is available at: ========================"  | 
 | 199 | +        echo ${{ env.ROUTE }}  | 
 | 200 | +        echo "==================================================================================="  | 
 | 201 | +        echo  | 
 | 202 | +        echo "Your app can be taken down with: \"oc delete all --selector='${{ env.SELECTOR }}'\""  | 
0 commit comments