actions/telemetry: explain why we collect telemetry data (#3887) #2965
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy to Cloud Run | |
| on: | |
| push: | |
| branches: [ "main" ] | |
| workflow_dispatch: | |
| concurrency: | |
| group: deploy-${{ github.ref }} | |
| cancel-in-progress: false | |
| permissions: {} | |
| jobs: | |
| deploy: | |
| runs-on: ubuntu-latest | |
| if: github.repository == 'chainguard-dev/edu' | |
| permissions: | |
| contents: read | |
| id-token: write # federates with GCP | |
| steps: | |
| - name: 'Github Actions Runner' | |
| uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 | |
| with: | |
| egress-policy: audit | |
| - name: 'Checkout default branch to $GITHUB_WORKSPACE dir' | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| # zizmor: ignore[cache-poisoning] - no cache input is set, so setup-node creates no cache to poison | |
| with: | |
| node-version-file: .nvmrc | |
| - name: Update themes | |
| run: git submodule update --init --recursive | |
| - name: npm ci | |
| run: npm ci | |
| - name: Fetch latest package mappings | |
| run: | | |
| echo "Fetching latest package mappings from dfc repository..." | |
| curl -sL https://raw.githubusercontent.com/chainguard-dev/dfc/main/pkg/dfc/builtin-mappings.yaml \ | |
| -o data/package-mappings.yaml | |
| echo "Package mappings updated successfully" | |
| ls -lh data/package-mappings.yaml | |
| - name: npm run build | |
| run: npm run build | |
| - name: Authenticate to Google Cloud | |
| id: auth | |
| uses: step-security/google-github-auth@775fc4c80760272ef389c9f9f8d98de7db0c170d # v3.0.2 | |
| with: | |
| token_format: 'access_token' | |
| project_id: '${{ secrets.PROJECT_ID }}' | |
| workload_identity_provider: '${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}' | |
| service_account: '${{ secrets.GCP_SERVICE_ACCOUNT }}' | |
| - name: Docker Auth | |
| id: docker-auth | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 | |
| with: | |
| username: 'oauth2accesstoken' | |
| password: '${{ steps.auth.outputs.access_token }}' | |
| registry: '${{ secrets.REGISTRY_URL }}' | |
| - name: Build and push | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| with: | |
| context: . | |
| push: true | |
| tags: '${{ secrets.REGISTRY_URL }}/${{ secrets.PROJECT_ID }}/${{ secrets.REPOSITORY }}/${{ secrets.SERVICE }}:${{ github.sha }}' | |
| # Attempt to deploy the terraform configuration | |
| - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1 | |
| with: | |
| terraform_version: '1.10.x' | |
| - env: | |
| TF_VAR_image: '${{ secrets.REGISTRY_URL }}/${{ secrets.PROJECT_ID }}/${{ secrets.REPOSITORY }}/${{ secrets.SERVICE }}:${{ github.sha }}' | |
| TF_VAR_project_id: ${{ secrets.PROJECT_ID }} | |
| working-directory: ./iac | |
| run: | | |
| terraform init | |
| terraform plan | |
| terraform apply -auto-approve | |
| - name: Post failure notice to Slack | |
| uses: step-security/action-slack-notify@e4cdee14a905d9da46ba47ad9309704407d8cd79 # v2.4.0 | |
| if: ${{ failure() }} | |
| env: | |
| SLACK_ICON: http://github.com/chainguard-dev.png?size=48 | |
| SLACK_USERNAME: guardian | |
| # This is the webhook for #alerts-edu channel | |
| # in the chainguard-dev Slack workspace | |
| SLACK_WEBHOOK: ${{ secrets.SLACK_ALERTS_EDU_WEBHOOK }} | |
| SLACK_CHANNEL: 'alerts-edu' | |
| SLACK_COLOR: '#8E1600' | |
| MSG_MINIMAL: 'true' | |
| SLACK_TITLE: 'Deploy to cloud run failed - ${{ github.repository }}' | |
| SLACK_MESSAGE: | | |
| For detailed logs: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }} |