Skip to content

Changed github actions to used OIDC #519

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rmgpinto merged 1 commit into from
Apr 14, 2025
Merged

Changed github actions to used OIDC #519

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 36 additions & 18 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,10 @@ on:
branches:
- main

permissions:
id-token: write
contents: read

jobs:
lint:
name: Lint
Expand Down Expand Up @@ -48,7 +52,7 @@ jobs:
- name: "Checkout"
uses: actions/checkout@v4

- name: ActivityPub Docker meta
- name: "ActivityPub Docker meta"
id: activitypub-docker-metadata
uses: docker/metadata-action@v5
with:
Expand All @@ -63,7 +67,7 @@ jobs:
type=semver,pattern={{major}}
type=sha,priority=1100

- name: Migrations Docker meta
- name: "Migrations Docker meta"
id: migrations-docker-metadata
uses: docker/metadata-action@v5
with:
Expand Down Expand Up @@ -95,12 +99,20 @@ jobs:
- name: "Run Tests"
run: yarn test

- name: "Authenticate with GCP"
id: gcp-auth
uses: google-github-actions/auth@v2
with:
token_format: access_token
workload_identity_provider: projects/687476608778/locations/global/workloadIdentityPools/github-oidc-activitypub/providers/github-provider-activitypub
service_account: stg-activitypub-github-cicd@ghost-activitypub.iam.gserviceaccount.com

- name: "Login to GCP Artifact Registry"
uses: docker/login-action@v3
with:
registry: europe-docker.pkg.dev
username: _json_key
password: ${{ secrets.GCP_DEPLOYER_SERVICE_ACCOUNT_KEY }}
username: oauth2accesstoken
password: ${{ steps.gcp-auth.outputs.access_token }}

- name: "Push ActivityPub Docker Image"
uses: docker/build-push-action@v6
Expand Down Expand Up @@ -138,25 +150,28 @@ jobs:
- region: europe-west3
region_name: frankfurt
steps:
- name: "Auth with Google Cloud"
uses: "google-github-actions/auth@v2"
- name: "Authenticate with GCP"
id: gcp-auth
uses: google-github-actions/auth@v2
with:
credentials_json: ${{ secrets.GCP_DEPLOYER_SERVICE_ACCOUNT_KEY }}
token_format: access_token
workload_identity_provider: projects/687476608778/locations/global/workloadIdentityPools/github-oidc-activitypub/providers/github-provider-activitypub
service_account: stg-activitypub-github-cicd@ghost-activitypub.iam.gserviceaccount.com

- name: "Deploy Migrations to Cloud Run"
if: ${{ matrix.region == 'europe-west4' }}
uses: "google-github-actions/deploy-cloudrun@v2"
uses: google-github-actions/deploy-cloudrun@v2
with:
image: europe-docker.pkg.dev/ghost-activitypub/activitypub/migrations:${{ needs.build-test-push.outputs.migrations_docker_version }}
region: ${{ matrix.region }}
job: stg-${{ matrix.region_name }}-activitypub-migrations
flags: "--wait --execute-now"
flags: --wait --execute-now
skip_default_labels: true
labels: |-
commit-sha=${{ github.sha }}

- name: "Deploy ActivityPub Queue to Cloud Run"
uses: "google-github-actions/deploy-cloudrun@v2"
uses: google-github-actions/deploy-cloudrun@v2
with:
image: europe-docker.pkg.dev/ghost-activitypub/activitypub/activitypub:${{ needs.build-test-push.outputs.activitypub_docker_version }}
region: ${{ matrix.region }}
Expand All @@ -166,7 +181,7 @@ jobs:
commit-sha=${{ github.sha }}

- name: "Deploy ActivityPub API to Cloud Run"
uses: "google-github-actions/deploy-cloudrun@v2"
uses: google-github-actions/deploy-cloudrun@v2
with:
image: europe-docker.pkg.dev/ghost-activitypub/activitypub/activitypub:${{ needs.build-test-push.outputs.activitypub_docker_version }}
region: ${{ matrix.region }}
Expand All @@ -190,25 +205,28 @@ jobs:
- region: europe-west3
region_name: frankfurt
steps:
- name: "Auth with Google Cloud"
uses: "google-github-actions/auth@v2"
- name: "Authenticate with GCP"
id: gcp-auth
uses: google-github-actions/auth@v2
with:
credentials_json: ${{ secrets.GCP_DEPLOYER_SERVICE_ACCOUNT_KEY }}
token_format: access_token
workload_identity_provider: projects/687476608778/locations/global/workloadIdentityPools/github-oidc-activitypub/providers/github-provider-activitypub
service_account: prd-activitypub-github-cicd@ghost-activitypub.iam.gserviceaccount.com

- name: "Deploy Migrations to Cloud Run"
if: ${{ matrix.region == 'europe-west4' }}
uses: "google-github-actions/deploy-cloudrun@v2"
uses: google-github-actions/deploy-cloudrun@v2
with:
image: europe-docker.pkg.dev/ghost-activitypub/activitypub/migrations:${{ needs.build-test-push.outputs.migrations_docker_version }}
region: ${{ matrix.region }}
job: prd-${{ matrix.region_name }}-activitypub-migrations
flags: "--wait --execute-now"
flags: --wait --execute-now
skip_default_labels: true
labels: |-
commit-sha=${{ github.sha }}

- name: "Deploy ActivityPub Queue to Cloud Run"
uses: "google-github-actions/deploy-cloudrun@v2"
uses: google-github-actions/deploy-cloudrun@v2
with:
image: europe-docker.pkg.dev/ghost-activitypub/activitypub/activitypub:${{ needs.build-test-push.outputs.activitypub_docker_version }}
region: ${{ matrix.region }}
Expand All @@ -218,7 +236,7 @@ jobs:
commit-sha=${{ github.sha }}

- name: "Deploy ActivityPub API to Cloud Run"
uses: "google-github-actions/deploy-cloudrun@v2"
uses: google-github-actions/deploy-cloudrun@v2
with:
image: europe-docker.pkg.dev/ghost-activitypub/activitypub/activitypub:${{ needs.build-test-push.outputs.activitypub_docker_version }}
region: ${{ matrix.region }}
Expand Down