component/access-management #501
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: component/access-management | |
| on: | |
| push: | |
| branches: | |
| - stc-master | |
| paths: | |
| - components/access-management/** | |
| pull_request: | |
| paths: | |
| - components/access-management/** | |
| types: | |
| - 'opened' | |
| - 'synchronize' | |
| - 'reopened' | |
| schedule: | |
| - cron: '0 22 * * *' | |
| # Environment variables available to all jobs and steps in this workflow | |
| env: | |
| REGISTRY_NAME: k8scc01covidacr | |
| DEV_REGISTRY_NAME: k8scc01covidacrdev | |
| CLUSTER_NAME: k8s-cancentral-02-covid-aks | |
| CLUSTER_RESOURCE_GROUP: k8s-cancentral-01-covid-aks | |
| TRIVY_VERSION: "v0.57.0" | |
| TRIVY_DATABASES: '"ghcr.io/aquasecurity/trivy-db:2","public.ecr.aws/aquasecurity/trivy-db"' | |
| TRIVY_JAVA_DATABASES: '"ghcr.io/aquasecurity/trivy-java-db:1","public.ecr.aws/aquasecurity/trivy-java-db"' | |
| TRIVY_MAX_RETRIES: 5 | |
| TRIVY_RETRY_DELAY: 20 | |
| SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} | |
| HADOLINT_VERSION: "2.12.0" | |
| jobs: | |
| build-push: | |
| runs-on: ubuntu-latest | |
| services: | |
| registry: | |
| image: registry:2 | |
| ports: | |
| - 5000:5000 | |
| steps: | |
| - uses: actions/checkout@v2 | |
| # Determine if pushing to Prod or Dev ACR | |
| - name: Set ENV variables for a PR containing the auto-deploy tag | |
| if: github.event_name == 'pull_request' && contains( github.event.pull_request.labels.*.name, 'auto-deploy') | |
| run: echo "REGISTRY=${{env.DEV_REGISTRY_NAME}}.azurecr.io" >> "$GITHUB_ENV" | |
| - name: Set ENV variable for pushes to master | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/stc-master' | |
| run: echo "REGISTRY=${{env.REGISTRY_NAME}}.azurecr.io" >> "$GITHUB_ENV" | |
| # Connect to Azure Container registry (ACR) | |
| - uses: azure/docker-login@v1 | |
| with: | |
| login-server: ${{ env.REGISTRY_NAME }}.azurecr.io | |
| username: ${{ secrets.REGISTRY_USERNAME }} | |
| password: ${{ secrets.REGISTRY_PASSWORD }} | |
| # Connect to DEV Azure Container registry (ACR) | |
| - uses: azure/docker-login@v1 | |
| with: | |
| login-server: ${{ env.DEV_REGISTRY_NAME }}.azurecr.io | |
| username: ${{ secrets.DEV_REGISTRY_USERNAME }} | |
| password: ${{ secrets.DEV_REGISTRY_PASSWORD }} | |
| - name: Run Hadolint | |
| run: | | |
| sudo curl -L https://github.com/hadolint/hadolint/releases/download/v${{ env.HADOLINT_VERSION }}/hadolint-Linux-x86_64 --output hadolint | |
| sudo chmod +x hadolint | |
| ./hadolint ./components/access-management/Dockerfile --no-fail | |
| # Container build to a Azure Container registry (ACR) | |
| - name: Docker build | |
| run: | | |
| docker build \ | |
| -t localhost:5000/kubeflow/kfam:${{ github.sha }} \ | |
| components/access-management/ | |
| docker push localhost:5000/kubeflow/kfam:${{ github.sha }} | |
| docker image prune | |
| # Scan image for vulnerabilities | |
| - name: Aqua Security Trivy image scan | |
| run: | | |
| curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin ${{ env.TRIVY_VERSION }} | |
| set +e # Lets trivy return an error without it being fatal | |
| for ((i=0; i<${{ env.TRIVY_MAX_RETRIES }}; i++)); do | |
| echo "Attempt $((i + 1)) of ${{ env.TRIVY_MAX_RETRIES }}..." | |
| trivy image \ | |
| --db-repository ${{ env.TRIVY_DATABASES }} \ | |
| --java-db-repository ${{ env.TRIVY_JAVA_DATABASES }} \ | |
| localhost:5000/kubeflow/kfam:${{ github.sha }} \ | |
| --exit-code 10 --timeout=20m --scanners vuln --severity CRITICAL \ | |
| EXIT_CODE=$? | |
| if [[ $EXIT_CODE -eq 0 ]]; then | |
| echo "Trivy scan completed successfully." | |
| exit 0 | |
| elif [[ $EXIT_CODE -eq 10 ]]; then | |
| echo "Trivy scan completed successfully. Some vulnerabilities were found." | |
| exit 10 | |
| elif [[ $i -lt $(( ${{ env.TRIVY_MAX_RETRIES }} - 1)) ]]; then | |
| echo "Encountered unexpected error. Retrying in ${{ env.TRIVY_RETRY_DELAY }} seconds..." | |
| sleep ${{ env.TRIVY_RETRY_DELAY }} | |
| else | |
| echo "Unexpected error persists after ${{ env.TRIVY_MAX_RETRIES }} attempts. Exiting." | |
| exit 1 | |
| fi | |
| done | |
| # Pushes if this is a push to master or an update to a PR that has auto-deploy label | |
| - name: Test if we should push to ACR | |
| id: should-i-push | |
| if: | | |
| github.event_name == 'push' || | |
| ( | |
| github.event_name == 'pull_request' && | |
| contains( github.event.pull_request.labels.*.name, 'auto-deploy') | |
| ) | |
| run: echo "::set-output name=boolean::true" | |
| - name: Docker push | |
| if: steps.should-i-push.outputs.boolean == 'true' | |
| run: | | |
| docker pull localhost:5000/kubeflow/kfam:${{ github.sha }} | |
| docker tag localhost:5000/kubeflow/kfam:${{ github.sha }} ${{ env.REGISTRY }}/kubeflow/kfam:${{ github.sha }} | |
| docker push ${{ env.REGISTRY }}/kubeflow/kfam:${{ github.sha }} | |
| - name: Slack Notification | |
| if: failure() && github.event_name=='schedule' | |
| uses: act10ns/slack@v1 | |
| with: | |
| status: failure | |
| message: kubeflow build failed. https://github.com/StatCan/kubeflow/actions/runs/${{github.run_id}} |