Skip to content

Commit 3eec393

Browse files
author
Alfredo Tornero
committed
ajuste final
1 parent 9876eba commit 3eec393

File tree

3 files changed

+99
-36
lines changed

3 files changed

+99
-36
lines changed

‎.github/workflows/deploy-azure-container.yml‎

Lines changed: 26 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ on:
1313
required: true
1414
type: string
1515
image_tag:
16-
default: "latest"
16+
default: "latest" # 👈 se reemplaza dinámicamente desde el workflow principal
1717
type: string
1818
slot:
1919
default: "production"
@@ -26,16 +26,22 @@ on:
2626
AZURE_SUBSCRIPTION_ID:
2727
required: true
2828

29+
permissions:
30+
id-token: write
31+
contents: read
32+
2933
jobs:
3034
deploy-container:
3135
runs-on: ubuntu-latest
36+
name: 🚀 Deploy Container to Azure
3237

3338
env:
3439
APP_NAME: ${{ inputs.app_name }}
3540
SLOT_NAME: ${{ inputs.slot }}
3641
ACR_NAME: ${{ inputs.acr_name }}
3742
IMAGE_NAME: ${{ inputs.image_name }}
3843
IMAGE_TAG: ${{ inputs.image_tag }}
44+
RESOURCE_GROUP: scharff-nsf-dev-rg # 👈 mejor definirlo como variable (fácil de reutilizar)
3945

4046
steps:
4147
- name: 🔐 Login Azure (OIDC)
@@ -46,40 +52,38 @@ jobs:
4652
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
4753
enable-oidc: true
4854

49-
- name: 🧩 Verificar versión Azure CLI
50-
run: az version
51-
52-
- name: 🔄 Actualizar Azure CLI
53-
run: |
54-
echo "🔄 Actualizando Azure CLI a la última versión..."
55-
sudo az upgrade --yes
56-
5755
- name: 🔐 Login a ACR
58-
run: |
59-
az acr login --name $ACR_NAME
56+
run: az acr login --name $ACR_NAME
6057

61-
- name: 🔁 Actualizar App Service para usar nueva imagen
58+
- name: 🔁 Actualizar App Service con nueva imagen
6259
run: |
63-
echo "🔁 Actualizando imagen en $APP_NAME..."
60+
echo "🔁 Actualizando imagen en $APP_NAME con tag: $IMAGE_TAG"
6461
az webapp config container set \
6562
--name $APP_NAME \
66-
--resource-group scharff-nsf-dev-rg \
63+
--resource-group $RESOURCE_GROUP \
64+
--slot $SLOT_NAME \
6765
--container-image-name "$ACR_NAME.azurecr.io/$IMAGE_NAME:$IMAGE_TAG" \
6866
--container-registry-url "https://$ACR_NAME.azurecr.io"
69-
70-
- name: 🔍 Verificar configuración del App Service
67+
68+
- name: 🔍 Verificar configuración del contenedor
7169
run: |
72-
echo "🔍 Verificando imagen aplicada..."
70+
echo "🔍 Configuración actual de contenedor:"
7371
az webapp config show \
7472
--name $APP_NAME \
75-
--resource-group scharff-nsf-dev-rg \
76-
--query "linuxFxVersion"
73+
--resource-group $RESOURCE_GROUP \
74+
--slot $SLOT_NAME \
75+
--query "linuxFxVersion"
7776
7877
- name: 🔄 Reiniciar App Service
7978
run: |
80-
az webapp restart --name $APP_NAME --resource-group scharff-nsf-dev-rg
79+
echo "🔄 Reiniciando $APP_NAME..."
80+
az webapp restart --name $APP_NAME --resource-group $RESOURCE_GROUP --slot $SLOT_NAME
8181
82-
- name: ✅ Verificar estado del despliegue
82+
- name: ✅ Validar despliegue
8383
run: |
84-
az webapp show --name $APP_NAME --resource-group scharff-nsf-dev-rg \
84+
echo "✅ Estado actual:"
85+
az webapp show \
86+
--name $APP_NAME \
87+
--resource-group $RESOURCE_GROUP \
88+
--slot $SLOT_NAME \
8589
--query "state" -o tsv

‎.github/workflows/docker-build-acr.yml‎

Lines changed: 18 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -9,23 +9,31 @@ on:
99
required: true
1010
AZURE_SUBSCRIPTION_ID:
1111
required: true
12+
outputs:
13+
tag:
14+
description: "Tag generado para la imagen Docker"
15+
value: ${{ jobs.build-scan-push.outputs.image_tag }}
1216

1317
permissions:
1418
id-token: write
1519
contents: read
1620

1721
env:
18-
ACR_NAME: nsfacrdev # 👈 reemplaza con tu ACR real
19-
IMAGE_NAME: nsf-backend-util
20-
TAG: ${{ github.run_number }}
22+
ACR_NAME: nsfacrdev # 👈 tu ACR real
23+
IMAGE_NAME: nsf-backend-util # 👈 nombre de tu imagen
24+
TAG: ${{ github.run_number }} # 👈 tag dinámico
2125
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
2226
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
2327
AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
2428

2529
jobs:
2630
build-scan-push:
27-
runs-on: ubuntu-latest
2831
name: 🏗️ Build + Scan + Push ACR
32+
runs-on: ubuntu-latest
33+
34+
# 👇 exportamos el TAG para que lo use el workflow principal
35+
outputs:
36+
image_tag: ${{ env.TAG }}
2937

3038
steps:
3139
- name: 🧰 Checkout del código
@@ -43,33 +51,31 @@ jobs:
4351
enable-oidc: true
4452

4553
- name: 🔐 Login al ACR
46-
run: |
47-
az acr login --name $ACR_NAME
54+
run: az acr login --name $ACR_NAME
4855

4956
- name: 🏗️ Build de la imagen Docker
5057
run: |
58+
echo "🏷️ Tag actual: $TAG"
5159
docker build -t $ACR_NAME.azurecr.io/$IMAGE_NAME:$TAG .
5260
53-
# 🚨 Si hay vulnerabilidades HIGH o CRITICAL, falla el pipeline
5461
- name: 🧪 Escaneo de vulnerabilidades con Trivy (bloqueante)
5562
uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8
5663
with:
5764
image-ref: ${{ env.ACR_NAME }}.azurecr.io/${{ env.IMAGE_NAME }}:${{ env.TAG }}
5865
format: 'table'
5966
vuln-type: 'os,library'
6067
severity: 'HIGH,CRITICAL'
61-
exit-code: '1' # ⚠️ Falla el job si encuentra HIGH/CRITICAL
68+
exit-code: '1' # ❌ falla si hay HIGH o CRITICAL
6269
ignore-unfixed: true
6370
output: 'trivy-report.txt'
6471

6572
- name: 📊 Subir reporte Trivy como artefacto
66-
if: always() # 📁 se sube aunque falle
73+
if: always() # 📁 se sube aunque falle
6774
uses: actions/upload-artifact@v4
6875
with:
6976
name: trivy-report
7077
path: trivy-report.txt
7178

7279
- name: 🚀 Push de la imagen al ACR
73-
if: success() # 🚫 Solo si no hubo vulnerabilidades graves
74-
run: |
75-
docker push $ACR_NAME.azurecr.io/$IMAGE_NAME:$TAG
80+
if: success()
81+
run: docker push $ACR_NAME.azurecr.io/$IMAGE_NAME:$TAG

‎.github/workflows/master_nsf-backend-ga.yml‎

Lines changed: 55 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,19 +13,72 @@ permissions:
1313
security-events: write
1414

1515
jobs:
16+
# -------------------------------
17+
# 🧪 CI: Build + Test
18+
# -------------------------------
19+
ci:
20+
uses: ./.github/workflows/dotnet-ci.yml
21+
with:
22+
solution: "nsf-backend-util.sln"
23+
test_project: "./Scharff.UnitTest/Scharff.UnitTest.csproj"
24+
25+
# -------------------------------
26+
# 🔍 Análisis de seguridad
27+
# -------------------------------
28+
analyze:
29+
needs: ci
30+
uses: ./.github/workflows/analyze-security.yml
31+
with:
32+
solution: "nsf-backend-util.sln"
33+
sonar_project_key: "atorneroc_NSF-BACKEND-UTIL-GA"
34+
sonar_org: "atorneroc"
35+
secrets:
36+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
37+
permissions:
38+
actions: read
39+
contents: read
40+
security-events: write
1641

42+
# -------------------------------
43+
# 🐳 Build + Scan + Push a ACR
44+
# -------------------------------
45+
docker:
46+
if: github.event_name == 'push'
47+
needs: [ci, analyze]
48+
uses: ./.github/workflows/docker-build-acr.yml
49+
id: docker-job # 👈 importante para referenciar outputs
50+
secrets:
51+
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
52+
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
53+
AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
54+
55+
# -------------------------------
56+
# 🚀 Despliegue 1: App Service por Código
57+
# -------------------------------
58+
deploy:
59+
if: ${{ success() && github.event_name == 'push' }}
60+
needs: docker
61+
uses: ./.github/workflows/deploy-azure.yml
62+
with:
63+
app_name: "nsf-backend-ga"
64+
slot: "production"
65+
secrets:
66+
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
67+
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
68+
AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
1769

1870
# -------------------------------
1971
# 🚀 Despliegue 2: App Service por Contenedor
2072
# -------------------------------
2173
deploy-container:
22-
if: ${{ github.event_name == 'push' }}
74+
if: ${{ success() && github.event_name == 'push' }}
75+
needs: docker
2376
uses: ./.github/workflows/deploy-azure-container.yml
2477
with:
2578
app_name: "nsf-backend-ga-cont" # 👈 tu App Service basado en ACR
2679
acr_name: "nsfacrdev"
2780
image_name: "nsf-backend-util"
28-
image_tag: "99"
81+
image_tag: ${{ needs.docker.outputs.tag }}
2982
slot: "production"
3083
secrets:
3184
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}

0 commit comments

Comments
 (0)