Skip to content

Migrate to Managed Identity instead of AR for Github Workflow #97

Migrate to Managed Identity instead of AR for Github Workflow

Migrate to Managed Identity instead of AR for Github Workflow #97

Workflow file for this run

name: Pull request
on:
pull_request:
branches:
- main
jobs:
build:
name: Build
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Build docker image
env:
REF: ${{ github. sha }}
run: make build
lint:
name: Lint
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 2
- uses: actions/setup-go@v4
with:
go-version: '1.21'
- name: Install dependencies
run: go mod download
- name: Install GolangCI Lint
run: curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.55.2
- name: golangci-lint
run: golangci-lint run --timeout=30m --max-same-issues=0 --out-format=github-actions
test:
name: Unit Test
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-go@v4
with:
go-version: '1.21'
- name: Install dependencies
run: go mod download
- name: Run Tests
run: go test -cover `go list ./... | grep -v 'pkg/client'`
test-acr-build:
runs-on: ubuntu-latest
name: Test ACR Build
permissions:
id-token: write
contents: read
steps:
- uses: actions/checkout@v4
- uses: azure/login@v1
with:
client-id: "846345fd-f1aa-417d-8e9b-9c71ccba6346"
tenant-id: "3aa4a235-b6e2-48d5-9195-7fcf05b459b0"
subscription-id: "16ede44b-1f74-40a5-b428-46cca9a5741b"
- name: Get GitHub Public IP
id: github_public_ip
run: echo "ipv4=$(curl 'https://ifconfig.me/ip')" >> $GITHUB_OUTPUT
- name: Add GitHub IP to ACR
id: update_firewall
run: az acr network-rule add
--name "radixdev"
--subscription "16ede44b-1f74-40a5-b428-46cca9a5741b"
--ip-address ${{ steps.github_public_ip.outputs.ipv4 }}
- name: Generate image tag
id: tag
run: |
sha=${GITHUB_SHA::8}
ts=$(date +%s)
echo "tag=${GITHUB_REF_NAME}-${sha}-${ts}" >> $GITHUB_OUTPUT
- name: Build
env:
AZURE_SUBSCRIPTION_ID: "16ede44b-1f74-40a5-b428-46cca9a5741b"
ACR_NAME: radixdev
IMAGE_NAME: radix-vulnerability-scanner
TAG: ${{steps.tag.outputs.tag}}
run: az acr task run
--subscription ${AZURE_SUBSCRIPTION_ID}
--name radix-image-builder-internal
--registry ${ACR_NAME}
--context ${GITHUB_WORKSPACE}
--file ${GITHUB_WORKSPACE}/Dockerfile
--set DOCKER_REGISTRY=${ACR_NAME}
--set BRANCH=${GITHUB_REF_NAME}
--set TAGS="--tag ${ACR_NAME}.azurecr.io/${IMAGE_NAME}:${TAG}"
--set DOCKER_FILE_NAME=Dockerfile
--set PUSH="--push"
--set REPOSITORY_NAME=${IMAGE_NAME}
--set CACHE=""
--set CACHE_TO_OPTIONS="--cache-to=type=registry,ref=${ACR_NAME}.azurecr.io/${IMAGE_NAME}:radix-cache-dev,mode=max"
- name: Revoke GitHub IP on ACR
if: ${{ steps.update_firewall.outcome == 'success' && !cancelled()}} # Always run this step even if previous step failed
run: az acr network-rule remove
--name radixdev
--subscription "16ede44b-1f74-40a5-b428-46cca9a5741b"
--ip-address ${{ steps.github_public_ip.outputs.ipv4 }}