Merge branch 'main' into n21-2242-course-sync-add-handling-for-substi… #5200
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: push workflow | |
| on: | |
| push: | |
| branches-ignore: | |
| - dependabot/** | |
| pull_request: | |
| types: [labeled] | |
| permissions: | |
| contents: read | |
| jobs: | |
| build_and_push_docker: | |
| # this basically means do not execute it as dependabot unless it is labeled as ready-for-ci | |
| # because automated processes and pr from forks are dangerous, therefore those prs won't have access to secrets, labeling them acts like allow-listing them | |
| # more details here https://docs.github.com/en/rest/dependabot/secrets?apiVersion=2022-11-28 | |
| # even when re-running an action manually the actor stays the same as of mid 2022, details here https://github.blog/changelog/2022-07-19-differentiating-triggering-actor-from-executing-actor/ | |
| #https://github.com/actions/runner/issues/1173#issuecomment-1354501147 when false equals true, you have to come up with something ... | |
| if: | | |
| (github.actor == 'dependabot[bot]' && | |
| contains(github.event.issue.labels.*.name, 'ready-for-ci') == 'true') || | |
| github.actor != 'dependabot[bot]' | |
| runs-on: ubuntu-latest | |
| needs: | |
| - branch_meta | |
| permissions: | |
| packages: write | |
| strategy: | |
| matrix: | |
| tenants: [default, brb, n21, thr ] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Docker meta Service Name | |
| id: docker_meta_img | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ghcr.io/${{ github.repository }}-${{ matrix.tenants }} | |
| tags: | | |
| type=ref,event=branch,enable=false,priority=600 | |
| type=sha,enable=true,priority=600,prefix= | |
| - name: Log into registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: test image exists | |
| run: | | |
| echo "IMAGE_EXISTS=$(docker manifest inspect ghcr.io/${{ github.repository }}-${{ matrix.tenants }}:${{ needs.branch_meta.outputs.sha }} > /dev/null && echo 1 || echo 0)" >> $GITHUB_ENV | |
| - name: Set up Docker Buildx | |
| if: ${{ env.IMAGE_EXISTS == 0 }} | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Build and push ${{ github.repository }} | |
| if: ${{ env.IMAGE_EXISTS == 0 }} | |
| uses: docker/build-push-action@v5 | |
| with: | |
| build-args: | | |
| SC_THEME_BUILD=${{ matrix.tenants }} | |
| context: . | |
| file: ./Dockerfile | |
| platforms: linux/amd64 | |
| push: true | |
| pull: true | |
| tags: ghcr.io/${{ github.repository }}-${{ matrix.tenants }}:${{ needs.branch_meta.outputs.sha }} | |
| labels: ${{ steps.docker_meta_img.outputs.labels }} | |
| - name: Send Notification to Rocket Chat if docker image build failed | |
| if: ${{ failure() && github.ref == 'refs/heads/main' }} | |
| uses: RocketChat/[email protected] | |
| with: | |
| type: ${{ job.status }} | |
| job_name: "docker image build from ${{ github.repository }} triggered from branch ${{ github.ref_name }}:" | |
| url: ${{ secrets.RC_MAIN_BROKEN_TOKEN }} | |
| channel: "#softwaredevelopment-teams-and-groups" | |
| username: Autodeployment Info | |
| branch_meta: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| branch: ${{ steps.extract_branch_meta.outputs.branch }} | |
| sha: ${{ steps.extract_branch_meta.outputs.sha }} | |
| steps: | |
| - name: Extract branch meta | |
| shell: bash | |
| id: extract_branch_meta | |
| env: | |
| PR_HEAD_REF: ${{ github.event.pull_request.head.ref }} | |
| PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| BRANCH_REF_NAME: ${{ github.ref_name}} | |
| BRANCH_SHA: ${{ github.sha }} | |
| run: | | |
| if [ "${{ github.event_name }}" == 'pull_request' ]; then | |
| echo "branch=$PR_HEAD_REF" >> $GITHUB_OUTPUT | |
| echo "sha=$PR_HEAD_SHA" >> $GITHUB_OUTPUT | |
| else | |
| echo "branch=$BRANCH_REF_NAME" >> $GITHUB_OUTPUT | |
| echo "sha=$BRANCH_SHA" >> $GITHUB_OUTPUT | |
| fi | |
| deploy: | |
| needs: | |
| - build_and_push_docker | |
| - branch_meta | |
| uses: hpi-schul-cloud/dof_app_deploy/.github/workflows/deploy.yml@main | |
| with: | |
| branch: ${{ needs.branch_meta.outputs.branch }} | |
| secrets: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| DEV_VAULT_BRB: ${{ secrets.DEV_VAULT_BRB }} | |
| DEV_VAULT_NBC: ${{ secrets.DEV_VAULT_NBC }} | |
| DEV_VAULT_THR: ${{ secrets.DEV_VAULT_THR }} | |
| DEV_VAULT_DBC: ${{ secrets.DEV_VAULT_DBC }} | |
| DEV_KUBE_CONFIG_BRB: ${{ secrets.DEV_KUBE_CONFIG_BRB }} | |
| DEV_KUBE_CONFIG_NBC: ${{ secrets.DEV_KUBE_CONFIG_NBC }} | |
| DEV_KUBE_CONFIG_THR: ${{ secrets.DEV_KUBE_CONFIG_THR }} | |
| DEV_KUBE_CONFIG_DBC: ${{ secrets.DEV_KUBE_CONFIG_DBC }} | |
| deploy-successful: | |
| needs: | |
| - deploy | |
| runs-on: ubuntu-latest | |
| steps: | |
| - run: echo "deploy was successful" | |
| trivy-vulnerability-scanning: | |
| needs: | |
| - build_and_push_docker | |
| - branch_meta | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: run trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2 | |
| with: | |
| image-ref: 'ghcr.io/${{ github.repository }}-default:${{ needs.branch_meta.outputs.sha }}' | |
| format: 'sarif' | |
| output: 'trivy-results.sarif' | |
| severity: 'CRITICAL,HIGH' | |
| ignore-unfixed: true | |
| scan-type: 'image' | |
| env: | |
| TRIVY_SKIP_DB_UPDATE: true | |
| TRIVY_SKIP_JAVA_DB_UPDATE: true | |
| - name: upload trivy results | |
| if: ${{ always() }} | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: 'trivy-results.sarif' | |
| cy-e2e-tests: | |
| needs: | |
| - branch_meta | |
| - deploy | |
| uses: hpi-schul-cloud/e2e-system-tests/.github/workflows/remote-trigger.yml@main | |
| with: | |
| ref: ${{ needs.branch_meta.outputs.branch }} | |
| secrets: | |
| service-account-token: ${{ secrets.CYPRESS_ONEPWD_SERVICE_ACCOUNT_TOKEN }} | |