Skip to content

Commit e6d08d1

Browse files
classicvaluesclassicvalues
authored
Initial commit
0 parents  commit e6d08d1

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

84 files changed

+5533
-0
lines changed

‎.github/workflows/alibabacloud.yml

+123
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
# This workflow will build and push a new container image to Alibaba Cloud Container Registry (ACR),
2+
# and then will deploy it to Alibaba Cloud Container Service for Kubernetes (ACK), when there is a push to the master branch.
3+
#
4+
# To use this workflow, you will need to complete the following set-up steps:
5+
#
6+
# 1. Create an ACR repository to store your container images.
7+
# You can use ACR EE instance for more security and better performance.
8+
# For instructions see https://www.alibabacloud.com/help/doc-detail/142168.htm
9+
#
10+
# 2. Create an ACK cluster to run your containerized application.
11+
# You can use ACK Pro cluster for more security and better performance.
12+
# For instructions see https://www.alibabacloud.com/help/doc-detail/95108.htm
13+
#
14+
# 3. Store your AccessKey pair in GitHub Actions secrets named `ACCESS_KEY_ID` and `ACCESS_KEY_SECRET`.
15+
# For instructions on setting up secrets see: https://developer.github.com/actions/managing-workflows/storing-secrets/
16+
#
17+
# 4. Change the values for the REGION_ID, REGISTRY, NAMESPACE, IMAGE, ACK_CLUSTER_ID, and ACK_DEPLOYMENT_NAME.
18+
#
19+
20+
name: Build and Deploy to ACK
21+
22+
on:
23+
push:
24+
branches:
25+
- master
26+
27+
# Environment variables available to all jobs and steps in this workflow.
28+
env:
29+
REGION_ID: cn-hangzhou
30+
REGISTRY: registry.cn-hangzhou.aliyuncs.com
31+
NAMESPACE: namespace
32+
IMAGE: repo
33+
TAG: ${{ github.sha }}
34+
ACK_CLUSTER_ID: clusterID
35+
ACK_DEPLOYMENT_NAME: nginx-deployment
36+
37+
ACR_EE_REGISTRY: myregistry.cn-hangzhou.cr.aliyuncs.com
38+
ACR_EE_INSTANCE_ID: instanceID
39+
ACR_EE_NAMESPACE: namespace
40+
ACR_EE_IMAGE: repo
41+
ACR_EE_TAG: ${{ github.sha }}
42+
43+
permissions:
44+
contents: read
45+
46+
jobs:
47+
build:
48+
runs-on: ubuntu-latest
49+
environment: production
50+
51+
steps:
52+
- name: Checkout
53+
uses: actions/checkout@v3
54+
55+
# 1.1 Login to ACR
56+
- name: Login to ACR with the AccessKey pair
57+
uses: aliyun/acr-login@v1
58+
with:
59+
region-id: "${{ env.REGION_ID }}"
60+
access-key-id: "${{ secrets.ACCESS_KEY_ID }}"
61+
access-key-secret: "${{ secrets.ACCESS_KEY_SECRET }}"
62+
63+
# 1.2 Buid and push image to ACR
64+
- name: Build and push image to ACR
65+
run: |
66+
docker build --tag "$REGISTRY/$NAMESPACE/$IMAGE:$TAG" .
67+
docker push "$REGISTRY/$NAMESPACE/$IMAGE:$TAG"
68+
69+
# 1.3 Scan image in ACR
70+
- name: Scan image in ACR
71+
uses: aliyun/acr-scan@v1
72+
with:
73+
region-id: "${{ env.REGION_ID }}"
74+
access-key-id: "${{ secrets.ACCESS_KEY_ID }}"
75+
access-key-secret: "${{ secrets.ACCESS_KEY_SECRET }}"
76+
repository: "${{ env.NAMESPACE }}/${{ env.IMAGE }}"
77+
tag: "${{ env.TAG }}"
78+
79+
# 2.1 (Optional) Login to ACR EE
80+
- uses: actions/checkout@v3
81+
- name: Login to ACR EE with the AccessKey pair
82+
uses: aliyun/acr-login@v1
83+
with:
84+
login-server: "https://${{ env.ACR_EE_REGISTRY }}"
85+
region-id: "${{ env.REGION_ID }}"
86+
access-key-id: "${{ secrets.ACCESS_KEY_ID }}"
87+
access-key-secret: "${{ secrets.ACCESS_KEY_SECRET }}"
88+
instance-id: "${{ env.ACR_EE_INSTANCE_ID }}"
89+
90+
# 2.2 (Optional) Build and push image ACR EE
91+
- name: Build and push image to ACR EE
92+
run: |
93+
docker build -t "$ACR_EE_REGISTRY/$ACR_EE_NAMESPACE/$ACR_EE_IMAGE:$TAG" .
94+
docker push "$ACR_EE_REGISTRY/$ACR_EE_NAMESPACE/$ACR_EE_IMAGE:$TAG"
95+
# 2.3 (Optional) Scan image in ACR EE
96+
- name: Scan image in ACR EE
97+
uses: aliyun/acr-scan@v1
98+
with:
99+
region-id: "${{ env.REGION_ID }}"
100+
access-key-id: "${{ secrets.ACCESS_KEY_ID }}"
101+
access-key-secret: "${{ secrets.ACCESS_KEY_SECRET }}"
102+
instance-id: "${{ env.ACR_EE_INSTANCE_ID }}"
103+
repository: "${{ env.ACR_EE_NAMESPACE}}/${{ env.ACR_EE_IMAGE }}"
104+
tag: "${{ env.ACR_EE_TAG }}"
105+
106+
# 3.1 Set ACK context
107+
- name: Set K8s context
108+
uses: aliyun/ack-set-context@v1
109+
with:
110+
access-key-id: "${{ secrets.ACCESS_KEY_ID }}"
111+
access-key-secret: "${{ secrets.ACCESS_KEY_SECRET }}"
112+
cluster-id: "${{ env.ACK_CLUSTER_ID }}"
113+
114+
# 3.2 Deploy the image to the ACK cluster
115+
- name: Set up Kustomize
116+
run: |-
117+
curl -s "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh" | bash /dev/stdin 3.8.6
118+
- name: Deploy
119+
run: |-
120+
./kustomize edit set image REGISTRY/NAMESPACE/IMAGE:TAG=$REGISTRY/$NAMESPACE/$IMAGE:$TAG
121+
./kustomize build . | kubectl apply -f -
122+
kubectl rollout status deployment/$ACK_DEPLOYMENT_NAME
123+
kubectl get services -o wide

‎.github/workflows/anchore.yml

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
6+
# This workflow checks out code, builds an image, performs a container image
7+
# vulnerability scan with Anchore's Grype tool, and integrates the results with GitHub Advanced Security
8+
# code scanning feature. For more information on the Anchore scan action usage
9+
# and parameters, see https://github.com/anchore/scan-action. For more
10+
# information on Anchore's container image scanning tool Grype, see
11+
# https://github.com/anchore/grype
12+
name: Anchore Container Scan
13+
14+
on:
15+
push:
16+
branches: [ master ]
17+
pull_request:
18+
# The branches below must be a subset of the branches above
19+
branches: [ master ]
20+
schedule:
21+
- cron: '22 9 * * 2'
22+
23+
permissions:
24+
contents: read
25+
26+
jobs:
27+
Anchore-Build-Scan:
28+
permissions:
29+
contents: read # for actions/checkout to fetch code
30+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
31+
runs-on: ubuntu-latest
32+
steps:
33+
- name: Checkout the code
34+
uses: actions/checkout@v3
35+
- name: Build the Docker image
36+
run: docker build . --file Dockerfile --tag localbuild/testimage:latest
37+
- name: Run the Anchore scan action itself with GitHub Advanced Security code scanning integration enabled
38+
uses: anchore/scan-action@487706fd9fc531f35bd6fc1edcdbae6bb79870fa
39+
with:
40+
image: "localbuild/testimage:latest"
41+
acs-report-enable: true
42+
- name: Upload Anchore Scan Report
43+
uses: github/codeql-action/upload-sarif@v2
44+
with:
45+
sarif_file: results.sarif

‎.github/workflows/apisec-scan.yml

+69
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
6+
# APIsec addresses the critical need to secure APIs before they reach production.
7+
# APIsec provides the industry’s only automated and continuous API testing platform that uncovers security vulnerabilities and logic flaws in APIs.
8+
# Clients rely on APIsec to evaluate every update and release, ensuring that no APIs go to production with vulnerabilities.
9+
10+
# How to Get Started with APIsec.ai
11+
# 1. Schedule a demo at https://www.apisec.ai/request-a-demo .
12+
#
13+
# 2. Register your account at https://cloud.fxlabs.io/#/signup .
14+
#
15+
# 3. Register your API . See the video (https://www.youtube.com/watch?v=MK3Xo9Dbvac) to get up and running with APIsec quickly.
16+
#
17+
# 4. Get GitHub Actions scan attributes from APIsec Project -> Configurations -> Integrations -> CI-CD -> GitHub Actions
18+
#
19+
# apisec-run-scan
20+
#
21+
# This action triggers the on-demand scans for projects registered in APIsec.
22+
# If your GitHub account allows code scanning alerts, you can then upload the sarif file generated by this action to show the scan findings.
23+
# Else you can view the scan results from the project home page in APIsec Platform.
24+
# The link to view the scan results is also displayed on the console on successful completion of action.
25+
26+
# This is a starter workflow to help you get started with APIsec-Scan Actions
27+
28+
name: APIsec
29+
30+
# Controls when the workflow will run
31+
on:
32+
# Triggers the workflow on push or pull request events but only for the master branch
33+
# Customize trigger events based on your DevSecOps processes.
34+
push:
35+
branches: [ master ]
36+
pull_request:
37+
branches: [ master ]
38+
schedule:
39+
- cron: '32 17 * * 5'
40+
41+
# Allows you to run this workflow manually from the Actions tab
42+
workflow_dispatch:
43+
44+
45+
permissions:
46+
contents: read
47+
48+
jobs:
49+
Trigger APIsec scan:
50+
permissions:
51+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
52+
runs-on: ubuntu-latest
53+
54+
steps:
55+
- name: APIsec scan
56+
uses: apisec-inc/apisec-run-scan@eadaedebb5b8516971299b64cea226dc9d9edb6c
57+
with:
58+
# The APIsec username with which the scans will be executed
59+
apisec-username: ${{ secrets.apisec_username }}
60+
# The Password of the APIsec user with which the scans will be executed
61+
apisec-password: ${{ secrets.apisec_password}}
62+
# The name of the project for security scan
63+
apisec-project: "VAmPI"
64+
# The name of the sarif format result file The file is written only if this property is provided.
65+
sarif-result-file: "apisec-results.sarif"
66+
- name: Import results
67+
uses: github/codeql-action/upload-sarif@v2
68+
with:
69+
sarif_file: ./apisec-results.sarif

‎.github/workflows/aws.yml

+95
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
# This workflow will build and push a new container image to Amazon ECR,
2+
# and then will deploy a new task definition to Amazon ECS, when there is a push to the master branch.
3+
#
4+
# To use this workflow, you will need to complete the following set-up steps:
5+
#
6+
# 1. Create an ECR repository to store your images.
7+
# For example: `aws ecr create-repository --repository-name my-ecr-repo --region us-east-2`.
8+
# Replace the value of the `ECR_REPOSITORY` environment variable in the workflow below with your repository's name.
9+
# Replace the value of the `AWS_REGION` environment variable in the workflow below with your repository's region.
10+
#
11+
# 2. Create an ECS task definition, an ECS cluster, and an ECS service.
12+
# For example, follow the Getting Started guide on the ECS console:
13+
# https://us-east-2.console.aws.amazon.com/ecs/home?region=us-east-2#/firstRun
14+
# Replace the value of the `ECS_SERVICE` environment variable in the workflow below with the name you set for the Amazon ECS service.
15+
# Replace the value of the `ECS_CLUSTER` environment variable in the workflow below with the name you set for the cluster.
16+
#
17+
# 3. Store your ECS task definition as a JSON file in your repository.
18+
# The format should follow the output of `aws ecs register-task-definition --generate-cli-skeleton`.
19+
# Replace the value of the `ECS_TASK_DEFINITION` environment variable in the workflow below with the path to the JSON file.
20+
# Replace the value of the `CONTAINER_NAME` environment variable in the workflow below with the name of the container
21+
# in the `containerDefinitions` section of the task definition.
22+
#
23+
# 4. Store an IAM user access key in GitHub Actions secrets named `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`.
24+
# See the documentation for each action used below for the recommended IAM policies for this IAM user,
25+
# and best practices on handling the access key credentials.
26+
27+
name: Deploy to Amazon ECS
28+
29+
on:
30+
push:
31+
branches:
32+
- master
33+
34+
env:
35+
AWS_REGION: MY_AWS_REGION # set this to your preferred AWS region, e.g. us-west-1
36+
ECR_REPOSITORY: MY_ECR_REPOSITORY # set this to your Amazon ECR repository name
37+
ECS_SERVICE: MY_ECS_SERVICE # set this to your Amazon ECS service name
38+
ECS_CLUSTER: MY_ECS_CLUSTER # set this to your Amazon ECS cluster name
39+
ECS_TASK_DEFINITION: MY_ECS_TASK_DEFINITION # set this to the path to your Amazon ECS task definition
40+
# file, e.g. .aws/task-definition.json
41+
CONTAINER_NAME: MY_CONTAINER_NAME # set this to the name of the container in the
42+
# containerDefinitions section of your task definition
43+
44+
permissions:
45+
contents: read
46+
47+
jobs:
48+
deploy:
49+
name: Deploy
50+
runs-on: ubuntu-latest
51+
environment: production
52+
53+
steps:
54+
- name: Checkout
55+
uses: actions/checkout@v3
56+
57+
- name: Configure AWS credentials
58+
uses: aws-actions/configure-aws-credentials@v2
59+
with:
60+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
61+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
62+
aws-region: ${{ env.AWS_REGION }}
63+
64+
- name: Login to Amazon ECR
65+
id: login-ecr
66+
uses: aws-actions/amazon-ecr-login@v1
67+
68+
- name: Build, tag, and push image to Amazon ECR
69+
id: build-image
70+
env:
71+
ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
72+
IMAGE_TAG: ${{ github.sha }}
73+
run: |
74+
# Build a docker container and
75+
# push it to ECR so that it can
76+
# be deployed to ECS.
77+
docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
78+
docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
79+
echo "::set-output name=image::$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG"
80+
81+
- name: Fill in the new image ID in the Amazon ECS task definition
82+
id: task-def
83+
uses: aws-actions/amazon-ecs-render-task-definition@v1
84+
with:
85+
task-definition: ${{ env.ECS_TASK_DEFINITION }}
86+
container-name: ${{ env.CONTAINER_NAME }}
87+
image: ${{ steps.build-image.outputs.image }}
88+
89+
- name: Deploy Amazon ECS task definition
90+
uses: aws-actions/amazon-ecs-deploy-task-definition@v1
91+
with:
92+
task-definition: ${{ steps.task-def.outputs.task-definition }}
93+
service: ${{ env.ECS_SERVICE }}
94+
cluster: ${{ env.ECS_CLUSTER }}
95+
wait-for-service-stability: true

0 commit comments

Comments
 (0)