Dockerfile - Automated base-image update #791
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Main | |
| on: | |
| push: | |
| env: | |
| KOSLI_API_TOKEN: ${{ secrets.KOSLI_API_TOKEN }} | |
| KOSLI_AWS_BETA: ${{ vars.KOSLI_AWS_BETA }} # aws-beta | |
| KOSLI_DEBUG: ${{ vars.KOSLI_DEBUG }} # true/false | |
| KOSLI_DRY_RUN: ${{ vars.KOSLI_DRY_RUN }} # true/false | |
| KOSLI_HOST: ${{ vars.KOSLI_HOST }} # https://app.kosli.com | |
| KOSLI_ORG: ${{ vars.KOSLI_ORG }} # cyber-dojo | |
| KOSLI_FLOW: ${{ vars.KOSLI_FLOW }} # differ-ci | |
| KOSLI_TRAIL: ${{ github.sha }} | |
| AWS_ECR_ID: ${{ vars.AWS_ECR_ID }} | |
| AWS_REGION: ${{ vars.AWS_REGION }} | |
| AWS_ACCOUNT_ID_BETA: ${{ vars.AWS_ACCOUNT_ID_BETA }} | |
| SERVICE_NAME: ${{ github.event.repository.name }} # differ | |
| SONARCLOUD_PROJECT_KEY: ${{ github.repository_owner }}_${{ github.event.repository.name }} # cyber-dojo_differ | |
| jobs: | |
| setup: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| aws_account_id_beta: ${{ steps.vars.outputs.aws_account_id_beta }} | |
| ecr_registry: ${{ steps.vars.outputs.ecr_registry }} | |
| aws_region: ${{ steps.vars.outputs.aws_region }} | |
| gh_actions_iam_role_name: ${{ steps.vars.outputs.gh_actions_iam_role_name }} | |
| service_name: ${{ steps.vars.outputs.service_name }} | |
| image_tag: ${{ steps.vars.outputs.image_tag }} | |
| image_name: ${{ steps.vars.outputs.image_name }} | |
| kosli_flow: ${{ steps.vars.outputs.kosli_flow }} | |
| kosli_trail: ${{ steps.vars.outputs.kosli_trail }} | |
| steps: | |
| - uses: cyber-dojo/harden-runner@main | |
| - uses: cyber-dojo/pinned-checkout@main | |
| - name: Prepare outputs for workflow jobs | |
| id: vars | |
| run: | | |
| ECR_REGISTRY="${AWS_ECR_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com" | |
| IMAGE_TAG=${GITHUB_SHA:0:7} | |
| IMAGE_NAME="${ECR_REGISTRY}/${{ env.SERVICE_NAME }}:${IMAGE_TAG}" | |
| { | |
| echo "aws_account_id_beta=${AWS_ACCOUNT_ID_BETA}" | |
| echo "ecr_registry=${ECR_REGISTRY}" | |
| echo "aws_region=${AWS_REGION}" | |
| echo "gh_actions_iam_role_name=gh_actions_services" | |
| echo "service_name=${{ env.SERVICE_NAME }}" | |
| echo "image_tag=${IMAGE_TAG}" | |
| echo "image_name=${IMAGE_NAME}" | |
| echo "kosli_flow=${KOSLI_FLOW}" | |
| echo "kosli_trail=${KOSLI_TRAIL}" | |
| } > ${GITHUB_OUTPUT} | |
| - name: Begin Kosli Trail | |
| uses: cyber-dojo/kosli-begin-trail@main | |
| with: | |
| flow_description: "Diff files from two traffic-lights" | |
| flow_tags: | | |
| env=${{ env.KOSLI_AWS_BETA }} | |
| pull-request: | |
| if: ${{ github.ref == 'refs/heads/main' }} | |
| runs-on: ubuntu-latest | |
| needs: [setup] | |
| permissions: | |
| id-token: write | |
| contents: read | |
| pull-requests: read | |
| steps: | |
| - uses: cyber-dojo/harden-runner@main | |
| - uses: cyber-dojo/pinned-checkout@main | |
| - uses: cyber-dojo/setup-kosli-cli@main | |
| - name: Attest pull-request evidence to Kosli | |
| run: | |
| kosli attest pullrequest github | |
| --github-token=${{ secrets.GITHUB_TOKEN }} | |
| --name=pull-request | |
| rubocop-lint: | |
| runs-on: ubuntu-latest | |
| needs: [setup] | |
| steps: | |
| - uses: cyber-dojo/harden-runner@main | |
| - uses: cyber-dojo/pinned-checkout@main | |
| - uses: cyber-dojo/setup-kosli-cli@main | |
| - name: Run Rubocop linter on source | |
| run: | |
| make rubocop_lint | |
| - name: Attest evidence to Kosli | |
| if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }} | |
| run: | |
| kosli attest junit | |
| --name=differ.rubocop-lint | |
| --results-dir=./reports/rubocop | |
| build-image: | |
| needs: [setup] | |
| uses: cyber-dojo/reusable-actions-workflows/.github/workflows/secure-docker-build.yml@main | |
| with: | |
| checkout_repository: cyber-dojo/differ | |
| checkout_ref: ${{ github.sha }} | |
| checkout_fetch_depth: 1 | |
| image_name: ${{ needs.setup.outputs.ecr_registry }}/${{ needs.setup.outputs.service_name }} | |
| image_tag: ${{ needs.setup.outputs.image_tag }} | |
| image_build_args: | | |
| COMMIT_SHA=${{ github.sha }} | |
| kosli_flow: ${{ needs.setup.outputs.kosli_flow }} | |
| kosli_trail: ${{ needs.setup.outputs.kosli_trail }} | |
| kosli_reference_name: ${{ needs.setup.outputs.service_name }} | |
| attest_to_kosli: ${{ github.ref == 'refs/heads/main' }} | |
| secrets: | |
| kosli_api_token: ${{ secrets.KOSLI_API_TOKEN }} | |
| snyk-container-scan: | |
| if: ${{ github.ref == 'refs/heads/main' }} | |
| needs: [setup, build-image] | |
| uses: cyber-dojo/snyk-scanning/.github/workflows/artifact_snyk_test.yml@main | |
| with: | |
| artifact_name: ${{ needs.build-image.outputs.tagged_image_name }} | |
| kosli_flow: ${{ needs.setup.outputs.kosli_flow }} | |
| kosli_trail: ${{ needs.setup.outputs.kosli_trail }} | |
| kosli_attestation_name: differ.snyk-container-scan | |
| secrets: | |
| snyk_token: ${{ secrets.SNYK_TOKEN }} | |
| kosli_api_token: ${{ secrets.KOSLI_API_TOKEN }} | |
| unit-tests: | |
| runs-on: ubuntu-latest | |
| needs: [build-image] | |
| env: | |
| KOSLI_FINGERPRINT: ${{ needs.build-image.outputs.digest }} | |
| steps: | |
| - uses: cyber-dojo/harden-runner@main | |
| - uses: cyber-dojo/pinned-checkout@main | |
| - uses: cyber-dojo/setup-kosli-cli@main | |
| - name: Download docker image | |
| uses: cyber-dojo/download-artifact@main | |
| with: | |
| image_digest: ${{ needs.build-image.outputs.digest }} | |
| - name: Run unit tests with metrics checks | |
| run: | |
| make test_server metrics_test_server metrics_coverage_server | |
| - name: Attest junit test evidence to Kosli | |
| if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }} | |
| run: | |
| kosli attest junit | |
| --name=differ.unit-test | |
| --results-dir=./reports/server/junit | |
| - name: Attest test metrics to Kosli | |
| if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }} | |
| run: | |
| kosli attest custom | |
| --attestation-data=./reports/server/test_metrics.json | |
| --name=differ.unit-test-metrics | |
| --type=test-metrics | |
| - name: Attest coverage metrics to Kosli | |
| if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }} | |
| run: | |
| kosli attest custom | |
| --attestation-data=./reports/server/coverage_metrics.json | |
| --name=differ.unit-test-coverage-metrics | |
| --type=coverage-metrics | |
| integration-tests: | |
| runs-on: ubuntu-latest | |
| needs: [build-image] | |
| env: | |
| KOSLI_FINGERPRINT: ${{ needs.build-image.outputs.digest }} | |
| steps: | |
| - uses: cyber-dojo/harden-runner@main | |
| - uses: cyber-dojo/pinned-checkout@main | |
| - uses: cyber-dojo/setup-kosli-cli@main | |
| - name: Download docker image | |
| uses: cyber-dojo/download-artifact@main | |
| with: | |
| image_digest: ${{ needs.build-image.outputs.digest }} | |
| - name: Run integration tests with metrics checks | |
| run: | |
| make image_client test_client metrics_test_client metrics_coverage_client | |
| - name: Attest junit test evidence to Kosli | |
| if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }} | |
| run: | |
| kosli attest junit | |
| --name=differ.integration-test | |
| --results-dir=./reports/client/junit | |
| - name: Attest test metrics to Kosli | |
| if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }} | |
| run: | |
| kosli attest custom | |
| --attestation-data=./reports/client/test_metrics.json | |
| --name=differ.integration-test-metrics | |
| --type=test-metrics | |
| - name: Attest coverage metrics to Kosli | |
| if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }} | |
| run: | |
| kosli attest custom | |
| --attestation-data=./reports/client/coverage_metrics.json | |
| --name=differ.integration-test-coverage-metrics | |
| --type=coverage-metrics | |
| sonarcloud-scan: | |
| runs-on: ubuntu-latest | |
| needs: [build-image] | |
| env: | |
| KOSLI_FINGERPRINT: ${{ needs.build-image.outputs.digest }} | |
| steps: | |
| - uses: cyber-dojo/harden-runner@main | |
| - uses: cyber-dojo/pinned-checkout@main | |
| - name: Run SonarCloud scan - report results to Kosli (in Kosli webhook) | |
| env: | |
| SONAR_TOKEN: ${{ secrets.SONARCLOUD_TOKEN }} | |
| uses: SonarSource/[email protected] | |
| with: | |
| args: > | |
| -Dsonar.analysis.kosli_flow=${{ env.KOSLI_FLOW }} | |
| -Dsonar.analysis.kosli_trail=${{ env.KOSLI_TRAIL }} | |
| -Dsonar.analysis.kosli_artifact_fingerprint=${{ env.KOSLI_FINGERPRINT }} | |
| -Dsonar.analysis.kosli_attestation=differ.sonarcloud-scan | |
| sdlc-control-gate: | |
| if: ${{ github.ref == 'refs/heads/main' }} | |
| runs-on: ubuntu-latest | |
| needs: | |
| - pull-request | |
| - rubocop-lint | |
| - build-image | |
| - unit-tests | |
| - integration-tests | |
| - sonarcloud-scan | |
| - snyk-container-scan | |
| steps: | |
| - uses: cyber-dojo/harden-runner@main | |
| - uses: cyber-dojo/setup-kosli-cli@main | |
| - name: Display current compliance | |
| run: | |
| kosli get trail "${KOSLI_TRAIL}" | |
| - name: Kosli SDLC gate to short-circuit the workflow | |
| env: | |
| KOSLI_FINGERPRINT: ${{ needs.build-image.outputs.digest }} | |
| run: | |
| kosli assert artifact | |
| --environment=${KOSLI_AWS_BETA} | |
| deploy-to-beta: | |
| needs: [setup, build-image, sdlc-control-gate] | |
| permissions: | |
| id-token: write | |
| contents: write | |
| uses: fivexl/gh-workflow-tf-plan-apply/.github/workflows/[email protected] | |
| with: | |
| aws_region: ${{ needs.setup.outputs.aws_region }} | |
| aws_role_arn: arn:aws:iam::${{ needs.setup.outputs.aws_account_id_beta }}:role/${{ needs.setup.outputs.gh_actions_iam_role_name }} | |
| aws_default_region: ${{ needs.setup.outputs.aws_region }} | |
| aws_role_duration: 900 | |
| working_directory: deployment/terraform/ | |
| tf_apply: true | |
| tf_version: v1.9.1 | |
| tf_additional_env_vars: '{"TF_VAR_TAGGED_IMAGE": "${{ needs.build-image.outputs.tagged_image_name }}@sha256:${{ needs.build-image.outputs.digest }}"}' | |
| # Deployment to aws-prod Environment is done with a Release/Promotion workflow. | |
| # See https://github.com/cyber-dojo/aws-prod-co-promotion |