Initial commit
This commit is contained in:
notifier committed
commit
85d261e987
18 files changed
+709
No files matched your search
@@ -0,0 +1,63 @@
|
||||
name: Build & Publish to GHCR via local build
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
|
||||
env:
|
||||
GHCR_ORG: gansejunge
|
||||
IMAGE_NAME: app-notifications-service-GENERIC
|
||||
IMAGE_PATH: ghcr.io/gansejunge/app-notifications-service-GENERIC
|
||||
OPS_ORG: notifier
|
||||
OPS_REPO: ops-deployment
|
||||
OPS_BRANCH_BASE: main
|
||||
OPS_PATH: service-GENERIC/deployment.yaml
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: local
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Log in to GHCR
|
||||
run: echo "${{ secrets.GHCR_TOKEN }}" | docker login ghcr.io -u ${{ secrets.GHCR_USERNAME }} --password-stdin
|
||||
|
||||
- name: Get Latest Tag
|
||||
id: get_tag
|
||||
run: |
|
||||
BASE64_TOKEN=$(echo "${{ secrets.GHCR_TOKEN }}" | base64)
|
||||
LATEST_TAG=$(curl -s -H "Authorization: Bearer $BASE64_TOKEN" \
|
||||
https://ghcr.io/v2/${{ env.GHCR_ORG }}/${{ env.IMAGE_NAME }}/tags/list \
|
||||
| jq -r '.tags | map(select(test("^[0-9]+$"))) | map(tonumber) | max // 0')
|
||||
NEXT_TAG=$((LATEST_TAG + 1))
|
||||
echo "latest=$LATEST_TAG" >> $GITHUB_OUTPUT
|
||||
echo "next=$NEXT_TAG" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Build and Push Docker Image
|
||||
run: |
|
||||
docker build \
|
||||
--build-arg COMMIT_ID=$(echo "${{ github.sha }}" | cut -c1-7) \
|
||||
-t ghcr.io/gansejunge/${{ env.IMAGE_NAME }}:${{ steps.get_tag.outputs.next }} .
|
||||
docker push ghcr.io/gansejunge/${{ env.IMAGE_NAME }}:${{ steps.get_tag.outputs.next }}
|
||||
|
||||
- name: Clone ops-deployment repo
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: notifier/ops-deployment
|
||||
path: ./ops-deployment
|
||||
token: ${{ secrets.BOT_TOKEN }}
|
||||
|
||||
- name: Update GENERIC deployment
|
||||
working-directory: ./ops-deployment
|
||||
run: |
|
||||
NEW_TAG=${{ steps.get_tag.outputs.next }}
|
||||
NEW_IMAGE="${{ env.IMAGE_PATH }}:$NEW_TAG"
|
||||
git config user.name "automation-bot"
|
||||
git config user.email "dev@gansejunge.com"
|
||||
|
||||
sed -i "s|ghcr.io/$GHCR_ORG/$IMAGE_NAME:[0-9]\+|$NEW_IMAGE|g" "$OPS_PATH"
|
||||
|
||||
COMMIT_URL="https://git.gansejunge.com/${GITHUB_REPOSITORY}/commit/${GITHUB_SHA}"
|
||||
git add $OPS_PATH
|
||||
git commit -m "Update GENERIC image to version $NEW_TAG" -m "Linked build commit: $COMMIT_URL"
|
||||
git push origin $OPS_BRANCH_BASE
|
||||
@@ -0,0 +1,63 @@
|
||||
name: Build & Publish to GHCR
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
|
||||
env:
|
||||
GHCR_ORG: gansejunge
|
||||
IMAGE_NAME: app-notifications-service-GENERIC
|
||||
IMAGE_PATH: ghcr.io/gansejunge/app-notifications-service-GENERIC
|
||||
OPS_ORG: notifier
|
||||
OPS_REPO: ops-deployment
|
||||
OPS_BRANCH_BASE: main
|
||||
OPS_PATH: service-GENERIC/deployment.yaml
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Log in to GHCR
|
||||
run: echo "${{ secrets.GHCR_TOKEN }}" | docker login ghcr.io -u ${{ secrets.GHCR_USERNAME }} --password-stdin
|
||||
|
||||
- name: Get Latest Tag
|
||||
id: get_tag
|
||||
run: |
|
||||
BASE64_TOKEN=$(echo "${{ secrets.GHCR_TOKEN }}" | base64)
|
||||
LATEST_TAG=$(curl -s -H "Authorization: Bearer $BASE64_TOKEN" \
|
||||
https://ghcr.io/v2/${{ env.GHCR_ORG }}/${{ env.IMAGE_NAME }}/tags/list \
|
||||
| jq -r '.tags | map(select(test("^[0-9]+$"))) | map(tonumber) | max // 0')
|
||||
NEXT_TAG=$((LATEST_TAG + 1))
|
||||
echo "latest=$LATEST_TAG" >> $GITHUB_OUTPUT
|
||||
echo "next=$NEXT_TAG" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Build and Push Docker Image
|
||||
run: |
|
||||
docker build \
|
||||
--build-arg COMMIT_ID=$(echo "${{ github.sha }}" | cut -c1-7) \
|
||||
-t ghcr.io/gansejunge/${{ env.IMAGE_NAME }}:${{ steps.get_tag.outputs.next }} .
|
||||
docker push ghcr.io/gansejunge/${{ env.IMAGE_NAME }}:${{ steps.get_tag.outputs.next }}
|
||||
|
||||
- name: Clone ops-deployment repo
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: notifier/ops-deployment
|
||||
path: ./ops-deployment
|
||||
token: ${{ secrets.BOT_TOKEN }}
|
||||
|
||||
- name: Update GENERIC deployment
|
||||
working-directory: ./ops-deployment
|
||||
run: |
|
||||
NEW_TAG=${{ steps.get_tag.outputs.next }}
|
||||
NEW_IMAGE="${{ env.IMAGE_PATH }}:$NEW_TAG"
|
||||
git config user.name "automation-bot"
|
||||
git config user.email "dev@gansejunge.com"
|
||||
|
||||
sed -i "s|ghcr.io/$GHCR_ORG/$IMAGE_NAME:[0-9]\+|$NEW_IMAGE|g" "$OPS_PATH"
|
||||
|
||||
COMMIT_URL="https://git.gansejunge.com/${GITHUB_REPOSITORY}/commit/${GITHUB_SHA}"
|
||||
git add $OPS_PATH
|
||||
git commit -m "Update GENERIC image to version $NEW_TAG" -m "Linked build commit: $COMMIT_URL"
|
||||
git push origin $OPS_BRANCH_BASE
|
||||
@@ -0,0 +1,78 @@
|
||||
name: pip-audit
|
||||
on:
|
||||
schedule:
|
||||
- cron: "35 1 * * *"
|
||||
push:
|
||||
branches: [main]
|
||||
paths: [requirements.txt, scripts/filter_requirements.py]
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
audit:
|
||||
runs-on: ubuntu-latest
|
||||
outputs:
|
||||
report_b64: ${{ steps.audit.outputs.report_b64 }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- uses: actions/setup-python@v5
|
||||
with:
|
||||
python-version: "3.12"
|
||||
|
||||
- name: Audit dependencies
|
||||
id: audit
|
||||
shell: bash
|
||||
run: |
|
||||
pip install pip-audit
|
||||
python3 scripts/filter_requirements.py requirements.txt requirements.audit.txt
|
||||
|
||||
# Don't let a non-zero exit abort the step, so the report is saved first
|
||||
set +e
|
||||
pip-audit -r requirements.audit.txt --no-deps --disable-pip > audit.txt 2>&1
|
||||
echo $? > audit.exit
|
||||
set -e
|
||||
|
||||
cat audit.txt
|
||||
echo "report_b64=$(head -c 100000 audit.txt | base64 -w0)" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Fail if the audit failed
|
||||
shell: bash
|
||||
run: exit "$(cat audit.exit)"
|
||||
|
||||
notify:
|
||||
needs: audit
|
||||
if: ${{ always() && needs.audit.result == 'failure' }}
|
||||
runs-on: host
|
||||
steps:
|
||||
- name: Send mail via local postfix
|
||||
env:
|
||||
MAIL_FROM: ${{ vars.MAIL_FROM }}
|
||||
MAIL_TO: ${{ vars.MAIL_TO }}
|
||||
REPO: ${{ gitea.repository }}
|
||||
RUN_URL: ${{ gitea.server_url }}/${{ gitea.repository }}/actions/runs/${{ gitea.run_number }}
|
||||
REPORT_B64: ${{ needs.audit.outputs.report_b64 }}
|
||||
run: |
|
||||
python3 - <<'EOF'
|
||||
import base64, os, smtplib
|
||||
from email.message import EmailMessage
|
||||
|
||||
b64 = os.environ.get("REPORT_B64", "")
|
||||
report = (
|
||||
base64.b64decode(b64).decode("utf-8", errors="replace")
|
||||
if b64 else
|
||||
"(no audit output, the job failed before pip-audit finished)"
|
||||
)
|
||||
|
||||
msg = EmailMessage()
|
||||
msg["Subject"] = f"[pip-audit] Problem in {os.environ['REPO']}"
|
||||
msg["From"] = os.environ["MAIL_FROM"]
|
||||
msg["To"] = os.environ["MAIL_TO"]
|
||||
msg.set_content(
|
||||
f"pip-audit result for {os.environ['REPO']}:\n\n"
|
||||
f"{report}\n\n"
|
||||
f"Run: {os.environ['RUN_URL']}\n"
|
||||
)
|
||||
|
||||
with smtplib.SMTP("127.0.0.1", 25, timeout=30) as s:
|
||||
s.send_message(msg)
|
||||
EOF
|
||||
Reference in new issue
Block a user