Skip to content
Enterprise CI/CD Pipeline

dd #196

Sign in to view logs

dd

dd #196

Workflow file for this run

.github/workflows/main.yml at 61a4df8
# =================================================
# Enterprise CI/CD Pipeline
# =================================================
name: Enterprise CI/CD Pipeline
on:
push:
branches: [ "dev"]
jobs:
# ========================
# Build & Lint & Security
# ========================
# build:
# name: Build, Lint & Security
# runs-on: ubuntu-latest
# steps:
# - name: Checkout code
# uses: actions/checkout@v4
# - name: Set up Python
# uses: actions/setup-python@v5
# with:
# python-version: "3.11"
# # Install dependencies
# - name: Install dependencies
# run: |
# python -m pip install --upgrade pip
# pip install -r requirements.txt
# pip install pytest bandit
# # # Lint / static analysis
# # - name: Lint code
# # run: |
# # pip install flake8
# # flake8 .
# # Security scan - Static Analysis
# - name: Bandit Security Scan
# run: |
# bandit -r . -ll
# # # Security scan - Secret scanning
# # - name: Secret Scan with Gitleaks
# # uses: gitleaks/gitleaks-action@v2
# # with:
# # args: detect --source . --no-banner
# # ========================
# # Unit Tests
# # ========================
# test:
# name: Unit Tests
# runs-on: ubuntu-latest
# needs: build
# steps:
# - name: Checkout code
# uses: actions/checkout@v4
# - name: Set up Python
# uses: actions/setup-python@v5
# with:
# python-version: "3.11"
# - name: Install dependencies
# run: |
# python -m pip install --upgrade pip
# pip install -r requirements.txt
# pip install pytest
# - name: Run pytest
# run: |
# python -m pytest tests/ --maxfail=1 --disable-warnings -q
# ========================
# Docker Build & Security
# ========================
docker:
name: Build Docker Image & Scan
runs-on: ubuntu-latest
# needs: test
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Log in to Docker Hub
uses: docker/login-action@v2
with:
username: ${{ secrets.DOCKER_HUB_USERNAME }}
password: ${{ secrets.DOCKER_HUB_PASSWORD }}
# Build all images (tags already defined in compose)
- name: Build Docker images
run: docker compose build
# List all images
- name: List all Docker images
run: docker images
# # Install Trivy
# - name: Install Trivy
# run: |
# sudo apt-get update
# sudo apt-get install -y wget
# wget https://github.com/aquasecurity/trivy/releases/download/v0.49.1/trivy_0.49.1_Linux-64bit.deb
# sudo dpkg -i trivy_0.49.1_Linux-64bit.deb
# # Scan all images exactly as defined in compose
# - name: Scan all Docker images
# run: |
# images=$(docker compose config | grep 'image:' | awk '{print $2}')
# for image in $images; do
# trivy image --severity HIGH,CRITICAL --ignore-unfixed $image
# done
# # Smoke test using compose
# - name: Smoke test using docker compose
# run: |
# docker compose up -d
# sleep 10
# docker compose ps
# docker compose logs
# docker compose down
# Push my docker images, as prebuilt images can't be pushed
- name: Push all Docker images
run: |
images=$(docker compose config | grep 'image:' | awk '{print $2}')
for image in $images; do
if [[ "$image" == "deepdiv"/* ]]; then
echo "Pushing $image"
docker push $image
else
echo "Skipping third-party image $image"
fi
done
# ========================
# Deploy to Azure
# ========================
deploy:
name: Deploy Monitoring & Compose to Azure VM
runs-on: ubuntu-latest
needs: docker
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Copy monitoring folder and docker-compose-prod.yml to VM
uses: appleboy/scp-action@v0.1.7
with:
host: ${{ secrets.VM_PUBLIC_IP }}
username: ${{ secrets.VM_USER }}
key: ${{ secrets.VM_SSH_PRIVATE_KEY }}
port: 22
source: "monitoring/,docker-compose-prod.yml" # only what VM needs
target: "/home/azureuser"
- name: Deploy Docker Compose on VM
uses: appleboy/ssh-action@v0.1.9
with:
host: ${{ secrets.VM_PUBLIC_IP }}
username: ${{ secrets.VM_USER }}
key: ${{ secrets.VM_SSH_PRIVATE_KEY }}
port: 22
script: |
cd /home/azureuser
sudo docker-compose -f docker-compose-prod.yml down --rmi all
sudo docker-compose -f docker-compose-prod.yml pull
sudo docker-compose -f docker-compose-prod.yml up -d