From a5743a3e288d4dc2142e5fb04e0322e3c19a05c4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20K=C3=B6berl?= Date: Mon, 31 May 2021 11:22:49 +0200 Subject: [PATCH] chore: unite repos (internal, external) - make from/to images configurable - add GitHub actions - fix Renovate config --- .github/workflows/build-test-deploy.yml | 60 +++++++++++++++++++++++++ .github/workflows/codeql-analysis.yml | 54 ++++++++++++++++++++++ .gitlab-ci.yml | 2 +- heroes-webapp/pom.xml | 2 +- pom.xml | 1 + renovate.json | 2 +- 6 files changed, 118 insertions(+), 3 deletions(-) create mode 100644 .github/workflows/build-test-deploy.yml create mode 100644 .github/workflows/codeql-analysis.yml diff --git a/.github/workflows/build-test-deploy.yml b/.github/workflows/build-test-deploy.yml new file mode 100644 index 00000000..f446aba1 --- /dev/null +++ b/.github/workflows/build-test-deploy.yml @@ -0,0 +1,60 @@ +name: Build, Test and Deploy + +on: + push: + branches: + - main + pull_request: + branches: + - main + +jobs: + + build-test-and-push: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v2 + - name: Set up JDK 11 + uses: actions/setup-java@v2 + with: + java-version: 11 + distribution: adopt + - name: Docker Login + uses: Azure/docker-login@v1 + with: + username: ${{ secrets.REGISTRY_USERNAME }} + password: ${{ secrets.REGISTRY_PASSWORD }} + - name: Build application + run: mvn -B package jib:dockerBuild + - name: Build acceptance tests + run: docker build -t heroes-acceptence-tests heroes-acceptence-tests + - name: Run app for tests + run: | + docker run --name ash -d --rm -p 8080:8080 porscheinformatik/angular-spring-heroes + sleep 30 + docker run -i --rm --link ash heroes-acceptence-tests --config baseUrl=http://ash:8080 + - name: Push image to Docker Hub + if: github.ref == 'refs/heads/main' && github.event_name == 'push' + run: docker push porscheinformatik/angular-spring-heroes + - name: Push image to ghcr.io + if: github.ref == 'refs/heads/main' && github.event_name == 'push' + run: | + echo ${{ secrets.GHCR_PASSWORD }} | docker login ghcr.io -u ${{ secrets.GHCR_USERNAME }} --password-stdin + docker tag porscheinformatik/angular-spring-heroes ghcr.io/porscheinformatik/angular-spring-heroes + docker push ghcr.io/porscheinformatik/angular-spring-heroes + + deploy: + if: github.ref == 'refs/heads/main' && github.event_name == 'push' + needs: build-test-and-push + runs-on: ubuntu-latest + environment: + name: production + url: https://ash.k8s.derkoe.dev + steps: + - uses: actions/checkout@v2 + - uses: Azure/setup-helm@v1 + - name: Deploy to Kubernetes + run: | + echo "${{ secrets.KUBECONFIG_BASE64 }}" | base64 --decode > /tmp/kubeconfig + helm ls --kubeconfig /tmp/kubeconfig + helm upgrade --kubeconfig /tmp/kubeconfig --install --atomic --set ingress.enabled=true --set ingress.host=ash.k8s.derkoe.dev --set postgresql.enabled=true --set postgresql.postgresPassword=${{ secrets.POSTGRESQL_PASSWORD }} ash charts/angular-spring-heroes diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml new file mode 100644 index 00000000..a05a691c --- /dev/null +++ b/.github/workflows/codeql-analysis.yml @@ -0,0 +1,54 @@ +name: "CodeQL" + +on: + push: + branches: + - main + pull_request: + branches: + - main + schedule: + - cron: '41 21 * * 6' + +jobs: + analyze: + name: Analyze + runs-on: ubuntu-latest + + strategy: + fail-fast: false + matrix: + language: [ 'java', 'javascript' ] + + steps: + - name: Checkout repository + uses: actions/checkout@v2 + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@v1 + with: + languages: ${{ matrix.language }} + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. + # queries: ./path/to/local/query, your-org/your-repo/queries@main + + # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). + # If this step fails, then you should remove it and run the build manually (see below) + - name: Autobuild + uses: github/codeql-action/autobuild@v1 + + # ℹī¸ Command-line programs to run using the OS shell. + # 📚 https://git.io/JvXDl + + # ✏ī¸ If the Autobuild fails above, remove it and uncomment the following three lines + # and modify them (or add more) to build your code if your project + # uses a compiled language + + #- run: | + # make bootstrap + # make release + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v1 diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 752d66f0..6d3e2bf6 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -16,7 +16,7 @@ build: variables: MAVEN_CLI_OPTS: "--batch-mode --errors --fail-at-end --show-version -Djib.from.auth.username=$DOCKER_REGISTRY_USER -Djib.from.auth.password=$DOCKER_REGISTRY_PASSWORD -Djib.to.auth.username=$DOCKER_REGISTRY_USER -Djib.to.auth.password=$DOCKER_REGISTRY_PASSWORD" script: - - mvn $MAVEN_CLI_OPTS package jib:build -Djib.container.creationTime=`git show -s --format=%cI $CI_COMMIT_SHA` -DimageTag=$CI_COMMIT_REF_SLUG + - mvn $MAVEN_CLI_OPTS package jib:build -DfromImage=docker.porscheinformatik.com/eenv/openjdk:11-jre -Djib.container.creationTime=`git show -s --format=%cI $CI_COMMIT_SHA` -DimageTag=$CI_COMMIT_REF_SLUG only: - merge_requests - master diff --git a/heroes-webapp/pom.xml b/heroes-webapp/pom.xml index a607dc5e..c5f2e189 100644 --- a/heroes-webapp/pom.xml +++ b/heroes-webapp/pom.xml @@ -80,7 +80,7 @@ jib-maven-plugin - docker.porscheinformatik.com/eenv/openjdk:11-jre + ${fromImage} docker.porscheinformatik.com/koc/angular-spring-heroes:${imageTag} diff --git a/pom.xml b/pom.xml index bdb0bf93..020db63e 100644 --- a/pom.xml +++ b/pom.xml @@ -17,6 +17,7 @@ true 1.12.0 2.31.861 + gcr.io/distroless/java:11 latest diff --git a/renovate.json b/renovate.json index ffbc06c9..e34d6ba4 100644 --- a/renovate.json +++ b/renovate.json @@ -1,6 +1,6 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", - "extends": ["local>eenv/renovate/renovate-config", "group:allNonMajor"], + "extends": ["github>porscheinformatik/renovate-config", "group:allNonMajor"], "packageRules": [ { "matchPackageNames": ["rxjs"],