fix: Update Docker Compose configuration for production environment a… #12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI/CD Pipeline | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main] | |
| env: | |
| REGISTRY: ghcr.io | |
| BACKEND_IMAGE_NAME: ${{ github.repository }}/backend | |
| FRONTEND_IMAGE_NAME: ${{ github.repository }}/frontend | |
| jobs: | |
| # Backend Lint & Test | |
| backend-test: | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: backend | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup PHP | |
| uses: shivammathur/setup-php@v2 | |
| with: | |
| php-version: '8.4' | |
| extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite, bcmath | |
| coverage: xdebug | |
| - name: Install Composer | |
| run: | | |
| mkdir -p bootstrap/cache | |
| chmod -R 775 bootstrap/cache | |
| composer install --prefer-dist --no-progress | |
| - name: Setup Environment | |
| run: | | |
| cp .env.example .env | |
| php artisan key:generate | |
| mkdir -p storage/framework/views storage/framework/cache storage/framework/sessions storage/logs | |
| chmod -R 775 storage | |
| - name: Setup SQLite Database | |
| run: | | |
| touch database/database.sqlite | |
| php artisan migrate --force | |
| - name: Run Pint (Laravel Code Style) | |
| run: ./vendor/bin/pint | |
| - name: Execute tests | |
| run: php artisan test | |
| # Frontend Lint & Test | |
| frontend-test: | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: frontend | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| cache: 'npm' | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: Install dependencies | |
| run: | | |
| rm -rf node_modules package-lock.json | |
| npm install | |
| - name: Run ESLint | |
| run: npm run lint | |
| - name: Run tests | |
| run: npm run test -- --run | |
| # Security Scan with Trivy | |
| security-scan: | |
| runs-on: ubuntu-latest | |
| needs: [backend-test, frontend-test] | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Run Trivy vulnerability scanner (Backend) | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| scan-type: 'fs' | |
| scan-ref: 'backend' | |
| format: 'sarif' | |
| output: 'trivy-backend.sarif' | |
| severity: 'CRITICAL,HIGH' | |
| - name: Upload Trivy scan results (Backend) | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: 'trivy-backend.sarif' | |
| category: 'backend' | |
| - name: Run Trivy vulnerability scanner (Frontend) | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| scan-type: 'fs' | |
| scan-ref: 'frontend' | |
| format: 'sarif' | |
| output: 'trivy-frontend.sarif' | |
| severity: 'CRITICAL,HIGH' | |
| - name: Upload Trivy scan results (Frontend) | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: 'trivy-frontend.sarif' | |
| category: 'frontend' | |
| # Build and Push Docker Images | |
| build-push: | |
| runs-on: ubuntu-latest | |
| needs: [backend-test, frontend-test, security-scan] | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata for Backend | |
| id: meta-backend | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE_NAME }} | |
| tags: | | |
| type=sha | |
| type=ref,event=branch | |
| type=semver,pattern={{version}} | |
| - name: Build and push Backend image | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: ./backend | |
| push: true | |
| tags: ${{ steps.meta-backend.outputs.tags }} | |
| labels: ${{ steps.meta-backend.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| target: production | |
| - name: Extract metadata for Frontend | |
| id: meta-frontend | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE_NAME }} | |
| tags: | | |
| type=sha | |
| type=ref,event=branch | |
| type=semver,pattern={{version}} | |
| - name: Build and push Frontend image | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: ./frontend | |
| push: true | |
| tags: ${{ steps.meta-frontend.outputs.tags }} | |
| labels: ${{ steps.meta-frontend.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| target: production | |
| # Deploy to Production (Optional - requires VPS setup) | |
| deploy: | |
| runs-on: ubuntu-latest | |
| needs: build-push | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| environment: production | |
| steps: | |
| - name: Deploy to VPS | |
| uses: appleboy/[email protected] | |
| with: | |
| host: ${{ secrets.VPS_HOST }} | |
| username: ${{ secrets.VPS_USER }} | |
| key: ${{ secrets.VPS_SSH_KEY }} | |
| script: | | |
| cd /opt/secure-drop | |
| docker-compose -f docker-compose.yml -f docker-compose.prod.yml pull | |
| docker-compose -f docker-compose.yml -f docker-compose.prod.yml up -d | |
| docker system prune -f |