From f8cc4bd5f6ff408b77a811acd057f6f695b300bf Mon Sep 17 00:00:00 2001 From: JaehongDev Date: Mon, 1 Jul 2024 18:47:28 +0900 Subject: [PATCH 1/4] =?UTF-8?q?chore:=20=EC=98=A4=EB=A5=98=EB=82=9C=20yml?= =?UTF-8?q?=20=EB=B3=80=EA=B2=BD?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/backend-ci-test.yml | 2 +- backend/src/main/resources/application.properties | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) delete mode 100644 backend/src/main/resources/application.properties diff --git a/.github/workflows/backend-ci-test.yml b/.github/workflows/backend-ci-test.yml index 524044c..b4638d1 100644 --- a/.github/workflows/backend-ci-test.yml +++ b/.github/workflows/backend-ci-test.yml @@ -55,4 +55,4 @@ jobs: image: ${{ secrets.REGION }}-docker.pkg.dev/${{ secrets.PROJECT_ID }}/${{ secrets.ARTIFACT_REGISTRY }}/${{ secrets.SERVICE }}:latest - name: Show Output - run: echo ${{ steps.deploy.outputs.url }}un: echo ${{ steps.deploy.outputs.url }} + run: echo ${{ steps.deploy.outputs.url }} diff --git a/backend/src/main/resources/application.properties b/backend/src/main/resources/application.properties deleted file mode 100644 index 16bdb5d..0000000 --- a/backend/src/main/resources/application.properties +++ /dev/null @@ -1 +0,0 @@ -spring.application.name=backend \ No newline at end of file From 1aa9db8db8bf875ab0bb51ac0c0cb72af77f0091 Mon Sep 17 00:00:00 2001 From: JaehongDev Date: Mon, 1 Jul 2024 18:51:01 +0900 Subject: [PATCH 2/4] =?UTF-8?q?chore:=20github=20workflow=20=EC=88=98?= =?UTF-8?q?=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/backend-ci-test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/backend-ci-test.yml b/.github/workflows/backend-ci-test.yml index b4638d1..28d3905 100644 --- a/.github/workflows/backend-ci-test.yml +++ b/.github/workflows/backend-ci-test.yml @@ -5,8 +5,8 @@ on: branches: [ main ] defaults: - run: - working-directory: backend + run: + working-directory: backend permissions: contents: read From 0e587c360652860129f1aaf978fea26ec271ecf9 Mon Sep 17 00:00:00 2001 From: JaehongDev Date: Mon, 1 Jul 2024 18:53:33 +0900 Subject: [PATCH 3/4] =?UTF-8?q?chore:=20github=20workflow=20=EC=88=98?= =?UTF-8?q?=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/backend-ci-test.yml | 75 ++++++++++++++++++++++----- 1 file changed, 63 insertions(+), 12 deletions(-) diff --git a/.github/workflows/backend-ci-test.yml b/.github/workflows/backend-ci-test.yml index 28d3905..6968c5f 100644 --- a/.github/workflows/backend-ci-test.yml +++ b/.github/workflows/backend-ci-test.yml @@ -1,18 +1,62 @@ -name: Build and Deploy to Cloud Run +# This workflow build and push a Docker container to Google Artifact Registry and deploy it on Cloud Run when a commit is pushed to the "master" branch +# +# Overview: +# +# 1. Authenticate to Google Cloud +# 2. Authenticate Docker to Artifact Registry +# 3. Build a docker container +# 4. Publish it to Google Artifact Registry +# 5. Deploy it to Cloud Run +# +# To configure this workflow: +# +# 1. Ensure the required Google Cloud APIs are enabled: +# +# Cloud Run run.googleapis.com +# Artifact Registry artifactregistry.googleapis.com +# +# 2. Create and configure Workload Identity Federation for GitHub (https://github.com/google-github-actions/auth#setting-up-workload-identity-federation) +# +# 3. Ensure the required IAM permissions are granted +# +# Cloud Run +# roles/run.admin +# roles/iam.serviceAccountUser (to act as the Cloud Run runtime service account) +# +# Artifact Registry +# roles/artifactregistry.admin (project or repository level) +# +# NOTE: You should always follow the principle of least privilege when assigning IAM roles +# +# 4. Create GitHub secrets for WIF_PROVIDER and WIF_SERVICE_ACCOUNT +# +# 5. Change the values for the GAR_LOCATION, SERVICE and REGION environment variables (below). +# +# NOTE: To use Google Container Registry instead, replace ${{ env.GAR_LOCATION }}-docker.pkg.dev with gcr.io +# +# For more support on how to run this workflow, please visit https://github.com/marketplace/actions/deploy-to-cloud-run +# +# Further reading: +# Cloud Run IAM permissions - https://cloud.google.com/run/docs/deploying +# Artifact Registry IAM permissions - https://cloud.google.com/artifact-registry/docs/access-control#roles +# Container Registry vs Artifact Registry - https://cloud.google.com/blog/products/application-development/understanding-artifact-registry-vs-container-registry +# Principle of least privilege - https://cloud.google.com/blog/products/identity-security/dont-get-pwned-practicing-the-principle-of-least-privilege + +name: Deploy GCP Cloud Run to Dev Server on: pull_request: branches: [ main ] -defaults: - run: - working-directory: backend - -permissions: - contents: read +env: + PROJECT_ID: ${{secrets.PROJECT_ID}} + SERVICE: ${{secrets.SERVICE}} + REGION: ${{secrets.REGION}} + ARTIFACT_REGISTRY: ${{secrets.ARTIFACT_REGISTRY}} jobs: deploy: + # Add 'id-token' with the intended permissions for workload identity federation permissions: contents: 'read' id-token: 'write' @@ -32,7 +76,7 @@ jobs: token_format: 'access_token' workload_identity_provider: '${{ secrets.WIF_PROVIDER }}' # e.g. - projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider service_account: '${{ secrets.WIF_SERVICE_ACCOUNT }}' # e.g. - my-service-account@my-project.iam.gserviceaccount.com - project_id: '${{secrets.PROJECT_ID}}' + project_id: '${{env.PROJECT_ID}}' - uses: actions/setup-java@v4 @@ -40,19 +84,26 @@ jobs: distribution: 'temurin' java-version: 21 + # BEGIN - Docker auth and build (NOTE: If you already have a container image, these Docker steps can be omitted) + + # Authenticate Docker to Google Cloud Artifact Registry + # Authenticate JIB to Google Cloud Run - name: Build and Push Container using Jib env: GOOGLE_AR_CLIENT_SECRET: ${{ secrets.GOOGLE_AR_CLIENT_SECRET }} SPRING_PROFILES_ACTIVE: dev run: ./gradlew jib + # END - Docker auth and build - name: Deploy to Cloud Run id: deploy uses: google-github-actions/deploy-cloudrun@v2 with: - service: ${{ secrets.SERVICE }} - region: ${{ secrets.REGION }} - image: ${{ secrets.REGION }}-docker.pkg.dev/${{ secrets.PROJECT_ID }}/${{ secrets.ARTIFACT_REGISTRY }}/${{ secrets.SERVICE }}:latest + service: ${{ env.SERVICE }} + region: ${{ env.REGION }} + # NOTE: If using a pre-built image, update the image name here + image: ${{ env.REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.ARTIFACT_REGISTRY }}/${{ env.SERVICE }}:latest + # If required, use the Cloud Run url output in later steps - name: Show Output - run: echo ${{ steps.deploy.outputs.url }} + run: echo ${{ steps.deploy.outputs.url }} \ No newline at end of file From 3b289f1e1ba4cc1688f313ce4b5af2af506f2887 Mon Sep 17 00:00:00 2001 From: JaehongDev Date: Mon, 1 Jul 2024 20:59:09 +0900 Subject: [PATCH 4/4] =?UTF-8?q?chore:=20github=20workflow=20=EC=88=98?= =?UTF-8?q?=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/backend-ci-test.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/backend-ci-test.yml b/.github/workflows/backend-ci-test.yml index 6968c5f..62238a6 100644 --- a/.github/workflows/backend-ci-test.yml +++ b/.github/workflows/backend-ci-test.yml @@ -54,6 +54,10 @@ env: REGION: ${{secrets.REGION}} ARTIFACT_REGISTRY: ${{secrets.ARTIFACT_REGISTRY}} +defaults: + run: + working-directory: backend + jobs: deploy: # Add 'id-token' with the intended permissions for workload identity federation