-
Notifications
You must be signed in to change notification settings - Fork 4
102 lines (82 loc) · 3.12 KB
/
ci.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
name: Continuous Integration
on:
push:
permissions:
contents: write
packages: write
security-events: write
jobs:
rel:
name: Build, scan & push Snapshot
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Set up Go
uses: actions/setup-go@v5
with:
go-version-file: go.mod
- name: Build snapshot artifacts
uses: goreleaser/goreleaser-action@v6
with:
version: latest
args: release --snapshot --clean --config .goreleaser-ci.yaml
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Get Version
id: version
run: echo "value=commit-$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: "ghcr.io/${{ github.repository }}:${{ steps.version.outputs.value }}"
format: "sarif"
output: "trivy-results.sarif"
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: "trivy-results.sarif"
- name: GHCR login
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Login to MTR
uses: docker/login-action@v3
with:
registry: mtr.devops.telekom.de
username: ${{ secrets.MTR_USERNAME }}
password: ${{ secrets.MTR_PASSWORD }}
- name: Push snapshot container image
run: |
docker push ghcr.io/${{ github.repository }}:${{ steps.version.outputs.value }}
docker push mtr.devops.telekom.de/sparrow/sparrow:${{ steps.version.outputs.value }}
helm:
runs-on: ubuntu-latest
steps:
- name: Checkout Repo
uses: actions/checkout@v4
with:
fetch-tags: true
- name: Fetch tags explicitly
run: git fetch --tags
- name: Get App Version
id: appVersion
run: echo "value=commit-$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
- name: Get Chart Version
id: chartVersion
# produces a tag like: 0.2.2-commit-asdf3
run: echo "value=$(git tag --sort=taggerdate | tail -1 | cut -c 2-)-commit-$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
- name: Registry login
run: |
helm registry login ghcr.io -u ${{ github.actor }} -p ${{ secrets.GITHUB_TOKEN }}
helm registry login mtr.devops.telekom.de -u ${{ secrets.MTR_USERNAME }} -p ${{ secrets.MTR_PASSWORD }}
- name: Helm lint
run: helm lint ./chart
- name: Helm package
run: helm package ./chart -d ./chart --version ${{ steps.chartVersion.outputs.value }} --app-version ${{ steps.appVersion.outputs.value }}
- name: Push helm package
run: |
helm push $(ls ./chart/*.tgz| head -1) oci://ghcr.io/${{ github.repository_owner }}/charts
helm push $(ls ./chart/*.tgz| head -1) oci://mtr.devops.telekom.de/sparrow/charts