-
Notifications
You must be signed in to change notification settings - Fork 3
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
ref(workflows): align workflows with
zfnd standards (#42)
* ref(workflows): align workflows with `zfnd` standards * imp(workflows): just build and push images if a PR is ready for review
- Loading branch information
1 parent
2dbab2b
commit 548a624
Showing
8 changed files
with
98 additions
and
42 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,30 +4,32 @@ on: | |
| delete: | ||
| pull_request: | ||
| branches: | ||
| - master | ||
| - main | ||
| types: | ||
| - closed | ||
|
|
||
| permissions: read-all | ||
|
|
||
| jobs: | ||
| delete: | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| id-token: write | ||
| contents: 'read' | ||
| id-token: 'write' | ||
| steps: | ||
| - name: Inject slug/short variables | ||
| uses: rlespinasse/[email protected] | ||
|
|
||
| - name: Authenticate to Google Cloud | ||
| id: auth | ||
| uses: google-github-actions/[email protected].2 | ||
| uses: google-github-actions/[email protected].3 | ||
| with: | ||
| workload_identity_provider: '${{ vars.GCP_WIF }}' | ||
| service_account: '${{ vars.GCP_DEPLOYMENTS_SA }}' | ||
| project_id: '${{ vars.GCP_PROJECT }}' | ||
|
|
||
| - name: Set up Cloud SDK | ||
| uses: google-github-actions/setup-gcloud@v1.1.1 | ||
| uses: google-github-actions/setup-gcloud@v2.1.0 | ||
|
|
||
| - name: Removing CR service | ||
| run: | | ||
| gcloud run services delete ${{ vars.APP_NAME }}-${{ env.GITHUB_HEAD_REF_SLUG || env.GITHUB_REF_SLUG }} --region=${{ vars.GOOGLE_CLOUD_REGION }} --quiet | ||
| gcloud run services delete ${{ vars.APP_NAME }}-${{ env.GITHUB_HEAD_REF_SLUG || env.GITHUB_REF_SLUG }} --region=${{ vars.GCP_REGION }} --quiet | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -23,6 +23,8 @@ on: | |
| description: The image digest to be used on a caller workflow | ||
| value: ${{ jobs.build.outputs.image_digest }} | ||
|
|
||
| permissions: read-all | ||
|
|
||
| jobs: | ||
| build: | ||
| name: Build images | ||
|
|
@@ -46,7 +48,7 @@ jobs: | |
| # Automatic tag management and OCI Image Format Specification for labels | ||
| - name: Docker meta | ||
| id: meta | ||
| uses: docker/[email protected].0 | ||
| uses: docker/[email protected].1 | ||
| with: | ||
| # list of Docker images to use as base name for tags | ||
| images: | | ||
|
|
@@ -68,11 +70,11 @@ jobs: | |
| # Setup Docker Buildx to allow use of docker cache layers from GH | ||
| - name: Set up Docker Buildx | ||
| id: buildx | ||
| uses: docker/setup-buildx-action@v3.0.0 | ||
| uses: docker/setup-buildx-action@v3.4.0 | ||
|
|
||
| - name: Authenticate to Google Cloud | ||
| id: auth | ||
| uses: google-github-actions/[email protected].2 | ||
| uses: google-github-actions/[email protected].3 | ||
| with: | ||
| workload_identity_provider: '${{ vars.GCP_WIF }}' | ||
| service_account: '${{ vars.GCP_ARTIFACTS_SA }}' | ||
|
|
@@ -83,7 +85,7 @@ jobs: | |
| access_token_lifetime: 10800s | ||
|
|
||
| - name: Login to Google Artifact Registry | ||
| uses: docker/login-action@v3.0.0 | ||
| uses: docker/login-action@v3.2.0 | ||
| with: | ||
| registry: us-docker.pkg.dev | ||
| username: oauth2accesstoken | ||
|
|
@@ -92,7 +94,7 @@ jobs: | |
| # Build and push image to Google Artifact Registry, and possibly DockerHub | ||
| - name: Build & push | ||
| id: docker_build | ||
| uses: docker/build-push-action@v5.1.0 | ||
| uses: docker/build-push-action@v6.3.0 | ||
| with: | ||
| target: ${{ inputs.dockerfile_target }} | ||
| context: . | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -14,7 +14,7 @@ on: | |
| type: string | ||
| description: The image digest to deploy | ||
| project_id: | ||
| required: true | ||
| required: false | ||
| type: string | ||
| description: The project to deploy to | ||
| region: | ||
|
|
@@ -42,6 +42,8 @@ on: | |
| type: string | ||
| description: The amount of memory to use for the service | ||
|
|
||
| permissions: read-all | ||
|
|
||
| jobs: | ||
| versioning: | ||
| runs-on: ubuntu-latest | ||
|
|
@@ -75,19 +77,23 @@ jobs: | |
| - name: Inject slug/short variables | ||
| uses: rlespinasse/[email protected] | ||
|
|
||
| - uses: actions/[email protected] | ||
| with: | ||
| persist-credentials: false | ||
|
|
||
| - name: Authenticate to Google Cloud | ||
| id: auth | ||
| uses: google-github-actions/[email protected].2 | ||
| uses: google-github-actions/[email protected].3 | ||
| with: | ||
| workload_identity_provider: '${{ vars.GCP_WIF }}' | ||
| service_account: '${{ vars.GCP_DEPLOYMENTS_SA }}' | ||
| project_id: '${{ vars.GCP_PROJECT }}' | ||
|
|
||
| - name: Set up Cloud SDK | ||
| uses: google-github-actions/[email protected] | ||
|
|
||
| - name: Deploy to cloud run | ||
| id: deploy | ||
| uses: google-github-actions/deploy-cloudrun@v2.2.0 | ||
| uses: google-github-actions/deploy-cloudrun@v2.6.0 | ||
| with: | ||
| service: ${{ inputs.app_name }}-${{ needs.versioning.outputs.version || env.GITHUB_HEAD_REF_SLUG || inputs.environment }} | ||
| image: ${{ inputs.registry }}/${{ inputs.app_name }}@${{ inputs.image_digest }} | ||
|
|
@@ -101,10 +107,11 @@ jobs: | |
| --cpu=${{ inputs.cpu }} | ||
| --memory=${{ inputs.memory }} | ||
| --port=53 | ||
| --network=projects/zfnd-dev-net-spoke-0/global/networks/dev-spoke-0 | ||
| --subnet=projects/zfnd-dev-net-spoke-0/regions/us-east1/subnetworks/dev-default-ue1 | ||
| --network=${{ vars.GCP_NETWORK }} | ||
| --subnet=${{ vars.GCP_SUBNETWORK }} | ||
| - name: Allow unauthenticated calls to the service | ||
| if: ${{ inputs.environment != 'prod' }} | ||
| run: | | ||
| gcloud run services add-iam-policy-binding ${{ inputs.app_name }}-${{ needs.versioning.outputs.version || env.GITHUB_HEAD_REF_SLUG || inputs.environment }} \ | ||
| --region=${{ inputs.region }} --member=allUsers --role=roles/run.invoker --quiet | ||
|
|
||