chore(deps): update aquasecurity/trivy-action digest to 595be6a #13
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This workflow will build a docker container, publish it to Google Container Registry, and deploy it to GKE when a release is created | ||
| # | ||
| # To configure this workflow: | ||
| # | ||
| # 1. Ensure that your repository contains the necessary configuration for your Google Kubernetes Engine cluster, including deployment.yml, kustomization.yml, service.yml, etc. | ||
| # | ||
| # 2. Set up secrets in your workspace: GKE_PROJECT with the name of the project and GKE_SA_KEY with the Base64 encoded JSON service account key (https://github.com/GoogleCloudPlatform/github-actions/tree/docs/service-account-key/setup-gcloud#inputs). | ||
| # | ||
| # 3. Change the values for the GKE_ZONE, GKE_CLUSTER, IMAGE, and DEPLOYMENT_NAME environment variables (below). | ||
| # | ||
| # For more support on how to run the workflow, please visit https://github.com/google-github-actions/setup-gcloud/tree/master/example-workflows/gke | ||
| name: Build and Deploy to GKE | ||
| on: | ||
| release: | ||
| types: [created] | ||
| env: | ||
| PROJECT_ID: ${{ secrets.GKE_PROJECT }} | ||
| GKE_CLUSTER: cluster-1 # TODO: update to cluster name | ||
| GKE_ZONE: us-central1-c # TODO: update to cluster zone | ||
| DEPLOYMENT_NAME: gke-test # TODO: update to deployment name | ||
| IMAGE: static-site | ||
| jobs: | ||
| setup-build-publish-deploy: | ||
| name: Setup, Build, Publish, and Deploy | ||
| runs-on: ubuntu-latest | ||
| environment: production | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v3 | ||
| # Setup gcloud CLI | ||
| - uses: google-github-actions/[email protected] | ||
| with: | ||
| service_account_key: ${{ secrets.GKE_SA_KEY }} | ||
| project_id: ${{ secrets.GKE_PROJECT }} | ||
| # Configure Docker to use the gcloud command-line tool as a credential | ||
| # helper for authentication | ||
| - run: |- | ||
| gcloud --quiet auth configure-docker | ||
| - name: DefenseCode ThunderScan Action | ||
| uses: defensecode/[email protected] | ||
| # Get the GKE credentials so we can deploy to the cluster | ||
| - uses: google-github-actions/[email protected] | ||
| with: | ||
| cluster_name: ${{ env.GKE_CLUSTER }} | ||
| location: ${{ env.GKE_ZONE }} | ||
| credentials: ${{ secrets.GKE_SA_KEY }} | ||
| # Build the Docker image | ||
| - name: Build | ||
| run: |- | ||
| docker build \ | ||
| --tag "gcr.io/$PROJECT_ID/$IMAGE:$GITHUB_SHA" \ | ||
| --build-arg GITHUB_SHA="$GITHUB_SHA" \ | ||
| --build-arg GITHUB_REF="$GITHUB_REF" \ | ||
| . | ||
| # Push the Docker image to Google Container Registry | ||
| - name: Publish | ||
| run: |- | ||
| docker push "gcr.io/$PROJECT_ID/$IMAGE:$GITHUB_SHA" | ||
| # Set up kustomize | ||
| - name: Set up Kustomize | ||
| run: |- | ||
| curl -sfLo kustomize https://github.com/kubernetes-sigs/kustomize/releases/download/v3.1.0/kustomize_3.1.0_linux_amd64 | ||
| chmod u+x ./kustomize | ||
| # Deploy the Docker image to the GKE cluster | ||
| - name: Deploy | ||
| run: |- | ||
| ./kustomize edit set image gcr.io/PROJECT_ID/IMAGE:TAG=gcr.io/$PROJECT_ID/$IMAGE:$GITHUB_SHA | ||
| ./kustomize build . | kubectl apply -f - | ||
| kubectl rollout status deployment/$DEPLOYMENT_NAME | ||
| kubectl get services -o wide | ||
