Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
147 changes: 147 additions & 0 deletions .github/workflows/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,147 @@
# GitHub Actions Workflows

This directory contains automated workflows for the Support Tools website.

## Workflows

### 1. cloudflare-workers.yml - Cloudflare Workers Deployment

**Purpose**: Deploy the Hugo static site to Cloudflare Workers

**Triggers**:
- **Push to main**: Deploys to staging, then production
- **Pull Request**: Deploys to development for preview
- **Manual dispatch**: Deploy to any specific environment
- **Schedule**: Daily at midnight UTC (content refresh)

**Deployment Flow**:

```mermaid
graph TD
A[Trigger] --> B[Test/Build Hugo]
B --> C{Branch?}
C -->|PR| D[Deploy to Dev]
C -->|main| E[Deploy to Staging]
E --> F[Deploy to Production]
C -->|manual| G[Deploy to Selected Env]
```

**Environments**:
- `development` - https://dev.support.tools
- `mst` - https://mst.support.tools
- `qas` - https://qas.support.tools
- `tst` - https://tst.support.tools
- `staging` - https://stg.support.tools
- `production` - https://support.tools

**Environment Protection**:
- Production requires manual approval
- Staging auto-deploys from main branch
- Development auto-deploys for PRs

### 2. pipeline.yml - Legacy Kubernetes Deployment (Deprecated)

**Status**: DEPRECATED - Use cloudflare-workers.yml instead

**Purpose**: Previously deployed to Kubernetes clusters via ArgoCD

## Required Secrets

Configure these in Settings β†’ Secrets β†’ Actions:

- `CLOUDFLARE_API_TOKEN` - API token with Workers:Edit permissions

## Usage Examples

### Manual Deployment

1. Go to Actions tab
2. Select "Deploy to Cloudflare Workers"
3. Click "Run workflow"
4. Select environment
5. Click "Run workflow"

### Automatic Deployments

- **Production**: Push to `main` branch
- **Development**: Create a pull request
- **Daily refresh**: Automatic at midnight UTC

## Monitoring Deployments

### View Logs
```bash
# Real-time logs
wrangler tail --env production

# GitHub Actions logs
gh run list --workflow=cloudflare-workers.yml
gh run view <run-id>
```

### Check Status
```bash
# Check all environments
for env in dev mst qas tst stg ""; do
url="https://${env}${env:+.}support.tools"
echo -n "$url: "
curl -s -o /dev/null -w "%{http_code}\n" $url
done
```

## Rollback Procedure

1. **Via GitHub**:
```bash
# List recent deployments
gh run list --workflow=cloudflare-workers.yml --limit 10

# Re-run a previous successful deployment
gh run rerun <run-id>
```

2. **Via Wrangler**:
```bash
# List versions
wrangler deployments list

# Rollback to previous version
wrangler rollback --env production
```

## Troubleshooting

### Deployment Fails

1. Check GitHub Actions logs
2. Verify CLOUDFLARE_API_TOKEN is set
3. Check Hugo build output
4. Verify DNS is pointing to Cloudflare

### Site Not Updating

1. Clear Cloudflare cache
2. Check if deployment completed
3. Verify correct environment deployed
4. Check Workers logs: `wrangler tail`

### Performance Issues

1. Check Workers analytics in Cloudflare Dashboard
2. Monitor request duration in logs
3. Verify static assets are cached
4. Check for large unoptimized images

## Migration from Kubernetes

The site has been migrated from Kubernetes to Cloudflare Workers:

- **Old**: Docker β†’ Kubernetes β†’ ArgoCD β†’ Nginx
- **New**: Hugo β†’ Cloudflare Workers β†’ Global CDN

Benefits:
- βœ… Free hosting for static assets
- βœ… Global edge deployment
- βœ… No infrastructure to manage
- βœ… Faster deployment times
- βœ… Better performance
97 changes: 97 additions & 0 deletions .github/workflows/cloudflare-workers-notifications.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,97 @@
name: Deployment Notifications

on:
workflow_run:
workflows: ["Deploy to Cloudflare Workers"]
types:
- completed

jobs:
notify:
runs-on: ubuntu-latest
if: ${{ github.event.workflow_run.conclusion == 'success' || github.event.workflow_run.conclusion == 'failure' }}

steps:
- name: Get workflow details
id: workflow-details
run: |
echo "status=${{ github.event.workflow_run.conclusion }}" >> $GITHUB_OUTPUT
echo "run_id=${{ github.event.workflow_run.id }}" >> $GITHUB_OUTPUT
echo "actor=${{ github.event.workflow_run.actor.login }}" >> $GITHUB_OUTPUT
echo "branch=${{ github.event.workflow_run.head_branch }}" >> $GITHUB_OUTPUT

Check failure

Code scanning / CodeQL

Code injection Critical

Potential code injection in
${ github.event.workflow_run.head_branch }
, which may be controlled by an external user (
workflow_run
).

Copilot Autofix

AI 6 months ago

To fix the issue, the untrusted input (${{ github.event.workflow_run.head_branch }}) should be safely passed through an intermediate environment variable, and the shell should use its native syntax to access the variable. This approach avoids direct interpolation and eliminates the risk of code injection. Specifically:

  1. Replace ${{ github.event.workflow_run.head_branch }} in the echo command with the environment variable syntax ($BRANCH).
  2. Define the environment variable BRANCH using ${{ github.event.workflow_run.head_branch }}.
Suggested changeset 1
.github/workflows/cloudflare-workers-notifications.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/cloudflare-workers-notifications.yml b/.github/workflows/cloudflare-workers-notifications.yml
--- a/.github/workflows/cloudflare-workers-notifications.yml
+++ b/.github/workflows/cloudflare-workers-notifications.yml
@@ -18,7 +18,9 @@
           echo "status=${{ github.event.workflow_run.conclusion }}" >> $GITHUB_OUTPUT
           echo "run_id=${{ github.event.workflow_run.id }}" >> $GITHUB_OUTPUT
           echo "actor=${{ github.event.workflow_run.actor.login }}" >> $GITHUB_OUTPUT
-          echo "branch=${{ github.event.workflow_run.head_branch }}" >> $GITHUB_OUTPUT
+          echo "branch=$BRANCH" >> $GITHUB_OUTPUT
+        env:
+          BRANCH: ${{ github.event.workflow_run.head_branch }}
           
       # Uncomment and configure for Slack notifications
       # - name: Slack Notification
EOF
@@ -18,7 +18,9 @@
echo "status=${{ github.event.workflow_run.conclusion }}" >> $GITHUB_OUTPUT
echo "run_id=${{ github.event.workflow_run.id }}" >> $GITHUB_OUTPUT
echo "actor=${{ github.event.workflow_run.actor.login }}" >> $GITHUB_OUTPUT
echo "branch=${{ github.event.workflow_run.head_branch }}" >> $GITHUB_OUTPUT
echo "branch=$BRANCH" >> $GITHUB_OUTPUT
env:
BRANCH: ${{ github.event.workflow_run.head_branch }}

# Uncomment and configure for Slack notifications
# - name: Slack Notification
Copilot is powered by AI and may make mistakes. Always verify output.

# Uncomment and configure for Slack notifications
# - name: Slack Notification
# if: ${{ vars.SLACK_WEBHOOK_URL != '' }}
# uses: 8398a7/action-slack@v3
# with:
# status: ${{ github.event.workflow_run.conclusion }}
# webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }}
# text: |
# Deployment ${{ github.event.workflow_run.conclusion == 'success' && 'βœ… succeeded' || '❌ failed' }}
# Branch: ${{ steps.workflow-details.outputs.branch }}
# Actor: ${{ steps.workflow-details.outputs.actor }}
# Run: https://github.com/${{ github.repository }}/actions/runs/${{ steps.workflow-details.outputs.run_id }}

# Uncomment and configure for Discord notifications
# - name: Discord Notification
# if: ${{ vars.DISCORD_WEBHOOK_URL != '' }}
# uses: sarisia/actions-status-discord@v1
# with:
# webhook: ${{ secrets.DISCORD_WEBHOOK_URL }}
# status: ${{ github.event.workflow_run.conclusion }}
# title: "Support Tools Deployment"
# description: |
# **Status**: ${{ github.event.workflow_run.conclusion == 'success' && 'βœ… Success' || '❌ Failed' }}
# **Branch**: ${{ steps.workflow-details.outputs.branch }}
# **Triggered by**: ${{ steps.workflow-details.outputs.actor }}
# url: "https://github.com/${{ github.repository }}/actions/runs/${{ steps.workflow-details.outputs.run_id }}"

# Uncomment and configure for email notifications
# - name: Send email notification
# if: ${{ github.event.workflow_run.conclusion == 'failure' }}
# uses: dawidd6/action-send-mail@v3
# with:
# server_address: smtp.gmail.com
# server_port: 587
# username: ${{ secrets.MAIL_USERNAME }}
# password: ${{ secrets.MAIL_PASSWORD }}
# subject: "❌ Support Tools Deployment Failed"
# to: [email protected]
# from: GitHub Actions
# body: |
# Deployment to Cloudflare Workers has failed.
#
# Branch: ${{ steps.workflow-details.outputs.branch }}
# Actor: ${{ steps.workflow-details.outputs.actor }}
#
# View details: https://github.com/${{ github.repository }}/actions/runs/${{ steps.workflow-details.outputs.run_id }}

- name: Create GitHub Issue on Failure
if: ${{ github.event.workflow_run.conclusion == 'failure' }}
uses: actions/github-script@v7
with:
script: |
const issue = await github.rest.issues.create({
owner: context.repo.owner,
repo: context.repo.repo,
title: `🚨 Deployment Failed - ${new Date().toISOString().split('T')[0]}`,
body: `## Deployment Failure

The Cloudflare Workers deployment has failed.

**Details:**
- Branch: \`${{ steps.workflow-details.outputs.branch }}\`
- Triggered by: @${{ steps.workflow-details.outputs.actor }}
- Workflow Run: [View Details](https://github.com/${{ github.repository }}/actions/runs/${{ steps.workflow-details.outputs.run_id }})

**Action Required:**
1. Check the workflow logs
2. Fix the issue
3. Re-run the deployment

cc: @${{ steps.workflow-details.outputs.actor }}`,
labels: ['deployment-failure', 'urgent']
});

console.log(`Created issue #${issue.data.number}`);
Comment on lines +11 to +97

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 6 months ago

To address the issue, we will add a permissions block to the workflow file. Since the workflow primarily interacts with GitHub issues (issues: write) and reads repository contents (contents: read), we will explicitly define these permissions at the root level, applying them to all jobs in the workflow unless overridden. This ensures that the GITHUB_TOKEN has the least privilege necessary to perform the intended actions.


Suggested changeset 1
.github/workflows/cloudflare-workers-notifications.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/cloudflare-workers-notifications.yml b/.github/workflows/cloudflare-workers-notifications.yml
--- a/.github/workflows/cloudflare-workers-notifications.yml
+++ b/.github/workflows/cloudflare-workers-notifications.yml
@@ -1,3 +1,6 @@
+permissions:
+  contents: read
+  issues: write
 name: Deployment Notifications
 
 on:
EOF
@@ -1,3 +1,6 @@
permissions:
contents: read
issues: write
name: Deployment Notifications

on:
Copilot is powered by AI and may make mistakes. Always verify output.
Loading
Loading