component/access-management #33
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: component/access-management | |
| on: | |
| push: | |
| branches: | |
| - stc-master | |
| paths: | |
| - components/access-management/** | |
| pull_request: | |
| paths: | |
| - components/access-management/** | |
| types: | |
| - 'opened' | |
| - 'synchronize' | |
| - 'reopened' | |
| schedule: | |
| - cron: '0 22 * * *' | |
| # Environment variables available to all jobs and steps in this workflow | |
| env: | |
| REGISTRY_NAME: k8scc01covidacr | |
| DEV_REGISTRY_NAME: k8scc01covidacrdev | |
| CLUSTER_NAME: k8s-cancentral-02-covid-aks | |
| CLUSTER_RESOURCE_GROUP: k8s-cancentral-01-covid-aks | |
| TRIVY_VERSION: "v0.43.1" | |
| SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} | |
| jobs: | |
| build-push: | |
| runs-on: ubuntu-latest | |
| services: | |
| registry: | |
| image: registry:2 | |
| ports: | |
| - 5000:5000 | |
| steps: | |
| - uses: actions/checkout@v2 | |
| # Determine if pushing to Prod or Dev ACR | |
| - name: Set ENV variables for a PR containing the auto-deploy tag | |
| if: github.event_name == 'pull_request' && contains( github.event.pull_request.labels.*.name, 'auto-deploy') | |
| run: echo "REGISTRY=${{env.DEV_REGISTRY_NAME}}.azurecr.io" >> "$GITHUB_ENV" | |
| - name: Set ENV variable for pushes to master | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/stc-master' | |
| run: echo "REGISTRY=${{env.REGISTRY_NAME}}.azurecr.io" >> "$GITHUB_ENV" | |
| # Connect to Azure Container registry (ACR) | |
| - uses: azure/docker-login@v1 | |
| with: | |
| login-server: ${{ env.REGISTRY_NAME }}.azurecr.io | |
| username: ${{ secrets.REGISTRY_USERNAME }} | |
| password: ${{ secrets.REGISTRY_PASSWORD }} | |
| # Connect to DEV Azure Container registry (ACR) | |
| - uses: azure/docker-login@v1 | |
| with: | |
| login-server: ${{ env.DEV_REGISTRY_NAME }}.azurecr.io | |
| username: ${{ secrets.DEV_REGISTRY_USERNAME }} | |
| password: ${{ secrets.DEV_REGISTRY_PASSWORD }} | |
| # Container build to a Azure Container registry (ACR) | |
| - name: Docker build | |
| run: | | |
| docker build \ | |
| -t localhost:5000/kubeflow/kfam:${{ github.sha }} \ | |
| components/access-management/ | |
| docker push localhost:5000/kubeflow/kfam:${{ github.sha }} | |
| docker image prune | |
| # Scan image for vulnerabilities | |
| - name: Aqua Security Trivy image scan | |
| run: | | |
| curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin ${{ env.TRIVY_VERSION }} | |
| trivy image localhost:5000/kubeflow/kfam:${{ github.sha }} --exit-code 1 --timeout=20m --security-checks vuln --severity CRITICAL | |
| # Run Dockle | |
| - name: Run dockle | |
| uses: goodwithtech/dockle-action@main | |
| with: | |
| image: localhost:5000/kubeflow/kfam:${{ github.sha }} | |
| format: 'list' | |
| exit-code: '0' | |
| exit-level: 'fatal' | |
| ignore: 'DKL-DI-0006' | |
| # Pushes if this is a push to master or an update to a PR that has auto-deploy label | |
| - name: Test if we should push to ACR | |
| id: should-i-push | |
| if: | | |
| github.event_name == 'push' || | |
| ( | |
| github.event_name == 'pull_request' && | |
| contains( github.event.pull_request.labels.*.name, 'auto-deploy') | |
| ) | |
| run: echo "::set-output name=boolean::true" | |
| - name: Docker push | |
| if: steps.should-i-push.outputs.boolean == 'true' | |
| run: | | |
| docker pull localhost:5000/kubeflow/kfam:${{ github.sha }} | |
| docker tag localhost:5000/kubeflow/kfam:${{ github.sha }} ${{ env.REGISTRY }}/kubeflow/kfam:${{ github.sha }} | |
| docker push ${{ env.REGISTRY }}/kubeflow/kfam:${{ github.sha }} | |
| - name: Slack Notification | |
| if: failure() && github.event_name=='schedule' | |
| uses: act10ns/slack@v1 | |
| with: | |
| status: failure | |
| message: kubeflow build failed. https://github.com/StatCan/kubeflow/actions/runs/${{github.run_id}} |