Skip to content

Commit 7789cfd

Browse files
manzil-infinity180manzil-infinity180
authored
Merge pull request #31 from manzil-infinity180/ci/cd-helm-release
wip: build, push
2 parents 31479e4 + ea2d2e9 commit 7789cfd

File tree

6 files changed

+269
-2
lines changed

6 files changed

+269
-2
lines changed

‎.github/dependabot.yml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: gomod
4+
directories:
5+
- /
6+
schedule:
7+
interval: weekly
8+
rebase-strategy: disabled
9+
groups:
10+
kubernetes:
11+
patterns:
12+
- k8s.io/*
13+
# sigstore:
14+
# patterns:
15+
# - github.com/sigstore/sigstore/*
16+
- package-ecosystem: github-actions
17+
directories:
18+
- /
19+
- /.github/actions/*/
20+
schedule:
21+
interval: weekly
22+
rebase-strategy: disabled
23+
# - package-ecosystem: docker
24+
# directory: /.devcontainer
25+
# schedule:
26+
# interval: daily
27+
# rebase-strategy: disabled

‎.github/workflows/helm-release.yml

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
name: helm-release
2+
3+
#on:
4+
# pull_request:
5+
6+
on:
7+
push:
8+
tags:
9+
- 'defender-v*'
10+
11+
permissions:
12+
contents: write
13+
packages: write
14+
id-token: write
15+
pages: write
16+
17+
jobs:
18+
helm-release:
19+
runs-on: ubuntu-latest
20+
steps:
21+
- name: Checkout
22+
uses: actions/checkout@v4
23+
- name: Set Release Version
24+
run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
25+
26+
- name: Install Helm
27+
uses: azure/setup-helm@v4
28+
with:
29+
version: v3.14.0
30+
- name: Lint chart
31+
run: helm lint ./chart
32+
- name: Package chart
33+
run: |
34+
mkdir -p .dist
35+
helm package ./chart --destination .dist
36+
37+
- name: Login to GHCR (OCI)
38+
run: |
39+
helm registry login ghcr.io -u ${{ github.actor }} -p ${{ secrets.GITHUB_TOKEN }}
40+
- name: Push to GHCR (OCI)
41+
run: |
42+
helm push .dist/deploydefender-*.tgz oci://ghcr.io/${{ github.repository_owner }}/charts
43+
44+
- name: Upload to GitHub Pages (static Helm repo)
45+
uses: stefanprodan/[email protected]
46+
with:
47+
token: "${{ secrets.GITHUB_TOKEN }}"
48+
linting: off
49+
charts_dir: .dist
50+
51+
# - name: Publish to ArtifactHub
52+
# run: |
53+
# curl -sSfL https://github.com/artifacthub/hub/releases/download/v1.12.0/ah_Linux_x86_64.tar.gz | tar -xz -C /usr/local/bin ah
54+
# ah lint && ah publish

‎.github/workflows/release-security.yml

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
name: Secure Supply Chain Pipeline
2+
3+
on:
4+
workflow_dispatch:
5+
6+
#on:
7+
# push:
8+
# branches: [main]
9+
# tags: ['v*']
10+
11+
env:
12+
REGISTRY: ghcr.io
13+
IMAGE_NAME: ${{ github.repository }}
14+
15+
jobs:
16+
security-scan-and-build:
17+
runs-on: ubuntu-latest
18+
permissions:
19+
contents: read
20+
packages: write
21+
id-token: write # For cosign keyless signing
22+
23+
steps:
24+
- name: Checkout
25+
uses: actions/checkout@v4
26+
27+
- name: Setup Go
28+
uses: actions/setup-go@v4
29+
with:
30+
go-version: 1.21
31+
32+
# Static analysis and security scanning
33+
- name: Run Gosec Security Scanner
34+
uses: securecodewarrior/github-action-gosec@master
35+
with:
36+
args: './...'
37+
38+
- name: Run Nancy (dependency vulnerability scanner)
39+
run: |
40+
go list -json -deps ./... | nancy sleuth
41+
42+
# Ko setup for Go builds
43+
- name: Setup Ko
44+
uses: ko-build/[email protected]
45+
with:
46+
version: v0.15.1
47+
48+
# Cosign setup
49+
- name: Install Cosign
50+
uses: sigstore/[email protected]
51+
with:
52+
cosign-release: 'v2.2.0'
53+
54+
# Syft for SBOM generation
55+
- name: Install Syft
56+
uses: anchore/sbom-action/[email protected]
57+
58+
- name: Login to Container Registry
59+
uses: docker/login-action@v3
60+
with:
61+
registry: ${{ env.REGISTRY }}
62+
username: ${{ github.actor }}
63+
password: ${{ secrets.GITHUB_TOKEN }}
64+
65+
# Build with Ko
66+
- name: Build and Push with Ko
67+
run: |
68+
export KO_DOCKER_REPO=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
69+
IMAGE=$(ko build ./cmd/myapp --bare)
70+
echo "IMAGE=$IMAGE" >> $GITHUB_ENV
71+
72+
# Generate SBOM
73+
- name: Generate SBOM
74+
run: |
75+
syft ${{ env.IMAGE }} -o spdx-json > sbom.spdx.json
76+
77+
# Sign image and attach SBOM attestation
78+
- name: Sign Image and Create SBOM Attestation
79+
run: |
80+
# Keyless signing
81+
cosign sign --yes ${{ env.IMAGE }}
82+
83+
# Create SBOM attestation
84+
cosign attest --yes --predicate sbom.spdx.json --type spdx ${{ env.IMAGE }}
85+
86+
# Vulnerability scan of final image
87+
- name: Run Trivy vulnerability scanner
88+
uses: aquasecurity/trivy-action@master
89+
with:
90+
image-ref: ${{ env.IMAGE }}
91+
format: 'sarif'
92+
output: 'trivy-results.sarif'
93+
94+
- name: Upload Trivy scan results
95+
uses: github/codeql-action/upload-sarif@v2
96+
with:
97+
sarif_file: 'trivy-results.sarif'
98+
99+
# Deployment job with verification
100+
deploy:
101+
needs: security-scan-and-build
102+
runs-on: ubuntu-latest
103+
if: github.ref == 'refs/heads/main'
104+
105+
steps:
106+
- name: Checkout K8s manifests
107+
uses: actions/checkout@v4
108+
109+
- name: Setup kubectl
110+
uses: azure/setup-kubectl@v3
111+
112+
- name: Install Cosign
113+
uses: sigstore/[email protected]
114+
115+
# Verify signatures before deployment
116+
- name: Verify Image Signatures
117+
run: |
118+
cosign verify \
119+
--certificate-identity-regexp="${{ github.server_url }}/${{ github.repository }}" \
120+
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
121+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
122+
123+
# Verify SBOM attestation
124+
cosign verify-attestation \
125+
--certificate-identity-regexp="${{ github.server_url }}/${{ github.repository }}" \
126+
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
127+
--type=spdx \
128+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
129+
130+
- name: Deploy to Kubernetes
131+
run: |
132+
# Update image in manifests and deploy
133+
sed -i 's|IMAGE_PLACEHOLDER|${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest|g' k8s/*.yaml
134+
kubectl apply -f k8s/

‎.github/workflows/release.yml

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: DeployDefender
2+
3+
#on:
4+
# pull_request:
5+
6+
on:
7+
push:
8+
tags:
9+
- v*
10+
11+
permissions:
12+
contents: read
13+
packages: write
14+
15+
16+
env:
17+
REGISTRY: ghcr.io
18+
IMAGE_NAME: deploydefender
19+
20+
jobs:
21+
build-push:
22+
runs-on: ubuntu-latest
23+
24+
steps:
25+
- name: Checkout repo
26+
uses: actions/checkout@v4
27+
28+
- name: Login to GitHub Container Registry
29+
uses: docker/login-action@v3
30+
with:
31+
registry: ghcr.io
32+
username: ${{ github.repository_owner }}
33+
password: ${{ secrets.GITHUB_TOKEN }}
34+
35+
- name: Set up QEMU
36+
uses: docker/setup-qemu-action@v3
37+
38+
- name: Set up Docker Buildx
39+
uses: docker/setup-buildx-action@v3
40+
41+
- name: Build and Push image
42+
uses: docker/build-push-action@v6
43+
with:
44+
context: .
45+
file: Dockerfile
46+
push: true
47+
# ${{ github.event_name != 'pull_request' }}
48+
platforms: linux/amd64,linux/arm64
49+
tags: |
50+
${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
51+
provenance: false
52+

‎.nojekyll

Whitespace-only changes.

‎chart/Chart.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
apiVersion: v2
2-
name: chart
2+
name: deploydefender
33
description: A Helm chart for Kubernetes
44

55
# A chart can be either an 'application' or a 'library' chart.
@@ -15,7 +15,7 @@ type: application
1515
# This is the chart version. This version number should be incremented each time you make changes
1616
# to the chart and its templates, including the app version.
1717
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18-
version: 0.1.0
18+
version: 0.1.1
1919

2020
# This is the version number of the application being deployed. This version number should be
2121
# incremented each time you make changes to the application. Versions are not expected to

0 commit comments

Comments
 (0)