update image scan action #55
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: java-goof image build and deployment | |
| on: | |
| push: | |
| branches: | |
| - 'master' | |
| pull_request: | |
| branches: | |
| - 'master' | |
| permissions: | |
| id-token: write # This is required for requesting the JWT | |
| contents: read # This is required for actions/checkout | |
| jobs: | |
| build-todolist-image: | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: todolist-goof | |
| steps: | |
| - uses: actions/[email protected] | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v1 | |
| - name: Build | |
| uses: docker/build-push-action@v2 | |
| with: | |
| load: true | |
| context: todolist-goof | |
| push: false | |
| tags: java-goof:latest | |
| - id: auth | |
| uses: google-github-actions/auth@v2 | |
| with: | |
| credentials_json: "${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}" | |
| - name: Set up Cloud SDK | |
| uses: google-github-actions/setup-gcloud@v2 | |
| - name: Install gke-gcloud-auth-plugin | |
| run: gcloud components install kubectl | |
| - name: Check gke-gcloud-auth-plugin | |
| run: kubectl version --client | |
| - name: Use gcloud CLI | |
| run: gcloud info | |
| - name: Docker auth | |
| run: gcloud auth configure-docker us-central-1-docker.pkg.dev --quiet | |
| - name: Set version | |
| id: version | |
| run: echo "VERSION=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT | |
| - name: Docker build & tag image | |
| env: | |
| GOOGLE_PROJECT: ${{ secrets.GOOGLE_PROJECT }} | |
| VERSION: ${{ steps.version.outputs.VERSION }} | |
| run: | | |
| DOCKER_IMAGE="us-central1-docker.pkg.dev/${GOOGLE_PROJECT}/igors-java-goof/java-goof:${VERSION}" | |
| docker build -t $DOCKER_IMAGE -t $DOCKER_IMAGE . | |
| - name: Scan Container Image with CrowdStrike | |
| uses: CrowdStrike/container-image-scan-action@main | |
| with: | |
| container_repository: us-central1-docker.pkg.dev/${{ secrets.GOOGLE_PROJECT }}/igors-java-goof/java-goof:${{ steps.version.outputs.VERSION }} | |
| crowdstrike_region: us-1 | |
| crowdstrike_score: 5000 | |
| retry_count: 30 | |
| env: | |
| FALCON_CLIENT_SECRET: ${{ secrets.FALCON_CLIENT_SECRET }} | |
| FALCON_CLIENT_ID: ${{ secrets.FALCON_CLIENT_ID }} | |
| JSON_REPORT: /tmp/report.json | |
| - name: Print CrowdStrike Full Image Scan Report | |
| if: always() | |
| run: | | |
| jq '.' /tmp/report.json | |
| - name: Push the docker image | |
| env: | |
| GOOGLE_PROJECT: ${{ secrets.GOOGLE_PROJECT }} | |
| VERSION: ${{ steps.version.outputs.VERSION }} | |
| run: | | |
| DOCKER_IMAGE="us-central1-docker.pkg.dev/${GOOGLE_PROJECT}/igors-java-goof/java-goof:${VERSION}" | |
| gcloud auth configure-docker us-central1-docker.pkg.dev | |
| docker push ${DOCKER_IMAGE} | |
| - name: Deploy to GKE | |
| env: | |
| GOOGLE_PROJECT: ${{ secrets.GOOGLE_PROJECT }} | |
| VERSION: ${{ steps.version.outputs.VERSION }} | |
| run: | | |
| gcloud container clusters get-credentials igors-gke-cluster --region us-central1-c | |
| sed -i "s/GOOGLE_PROJECT/$GOOGLE_PROJECT/g; s/VERSION/$VERSION/g" k8s/java-goof.yaml | |
| kubectl apply -f k8s/java-goof.yaml |