Initial commit

scripts/scheduled-rebuild-deploy.sh

@@ -0,0 +1,103 @@
+#!/bin/sh
+set -eu
+
+require_value() {
+  key="$1"
+  value="$2"
+  if [ -z "$value" ]; then
+    echo "Missing required workflow configuration: $key" >&2
+    exit 1
+  fi
+}
+
+require_value "DEPLOY_TARGET" "${DEPLOY_TARGET:-}"
+require_value "CALENDAR_URL" "${CALENDAR_URL:-}"
+require_value "PRIMARY_DOMAIN" "${PRIMARY_DOMAIN:-}"
+require_value "TRAEFIK_CERTRESOLVER" "${TRAEFIK_CERTRESOLVER:-}"
+require_value "REGISTRY" "${REGISTRY:-}"
+require_value "APP_IMAGE_REPOSITORY" "${APP_IMAGE_REPOSITORY:-}"
+require_value "REGISTRY_USERNAME" "${REGISTRY_USERNAME:-}"
+require_value "REGISTRY_TOKEN" "${REGISTRY_TOKEN:-}"
+
+APP_URL="${APP_URL:-https://$PRIMARY_DOMAIN}"
+CORS_ORIGIN="${CORS_ORIGIN:-$APP_URL}"
+
+case "$DEPLOY_TARGET" in
+  dev)
+    default_stack_name="website-starter-dev"
+    default_traefik_network="traefik-external"
+    ;;
+  master|production)
+    default_stack_name="website-starter-prod"
+    default_traefik_network="traefik"
+    ;;
+  *)
+    echo "Unsupported deployment target: $DEPLOY_TARGET" >&2
+    exit 1
+    ;;
+esac
+
+COMPOSE_PROJECT_NAME="${COMPOSE_PROJECT_NAME:-$default_stack_name}"
+TRAEFIK_STACK_NAME="${TRAEFIK_STACK_NAME:-$COMPOSE_PROJECT_NAME}"
+TRAEFIK_NETWORK_NAME="${TRAEFIK_NETWORK_NAME:-$default_traefik_network}"
+TRIVY_IMAGE="${TRIVY_IMAGE:-aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969}"
+BUILD_DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+DOCKER_BUILDKIT="${DOCKER_BUILDKIT:-1}"
+
+revision="$(git rev-parse --short=12 HEAD)"
+build_timestamp="$(date -u +%Y%m%dT%H%M%SZ)"
+APP_IMAGE_TAG="scheduled-$DEPLOY_TARGET-$revision-$build_timestamp"
+APP_IMAGE_NAME="$APP_IMAGE_REPOSITORY:$APP_IMAGE_TAG"
+
+export CALENDAR_URL
+export PRIMARY_DOMAIN
+export APP_URL
+export CORS_ORIGIN
+export COMPOSE_PROJECT_NAME
+export TRAEFIK_STACK_NAME
+export TRAEFIK_CERTRESOLVER
+export TRAEFIK_NETWORK_NAME
+export APP_IMAGE_NAME
+export TRIVY_IMAGE
+export DOCKER_BUILDKIT
+export DEPLOY_MODE=app
+
+echo "Scheduled rebuild target: $DEPLOY_TARGET"
+echo "Git revision: $revision"
+echo "App image: $APP_IMAGE_NAME"
+
+docker build --pull \
+  --build-arg BUILD_DATE="$BUILD_DATE" \
+  --build-arg VCS_REF="$revision" \
+  --build-arg APP_URL="$APP_URL" \
+  --build-arg APP_NAME="${APP_NAME:-Example Website}" \
+  --build-arg COMPANY_NAME="${COMPANY_NAME:-Example Company}" \
+  --build-arg CONTACT_EMAIL="${CONTACT_EMAIL:-info@example.com}" \
+  --build-arg CONTACT_PHONE="${CONTACT_PHONE:-+49 000 000000}" \
+  --build-arg CONTACT_ADDRESS="${CONTACT_ADDRESS:-Example Street 1, 12345 Example City}" \
+  -f Dockerfile \
+  -t "$APP_IMAGE_NAME" \
+  .
+
+echo "Reporting app runtime image vulnerabilities..."
+sh scripts/trivy-scan.sh vuln-image "$APP_IMAGE_NAME"
+
+echo "Blocking app critical runtime vulnerabilities..."
+TRIVY_SEVERITY=CRITICAL TRIVY_EXIT_CODE=1 sh scripts/trivy-scan.sh vuln-image "$APP_IMAGE_NAME"
+
+docker_config="$(mktemp -d)"
+cleanup_registry_credentials() {
+  DOCKER_CONFIG="$docker_config" docker logout "$REGISTRY" >/dev/null 2>&1 || true
+  rm -rf "$docker_config"
+}
+trap cleanup_registry_credentials EXIT
+trap 'exit 1' HUP INT TERM
+export DOCKER_CONFIG="$docker_config"
+echo "$REGISTRY_TOKEN" | docker login "$REGISTRY" -u "$REGISTRY_USERNAME" --password-stdin
+docker push "$APP_IMAGE_NAME"
+docker logout "$REGISTRY" >/dev/null
+rm -rf "$docker_config"
+trap - EXIT HUP INT TERM
+unset DOCKER_CONFIG REGISTRY_USERNAME REGISTRY_TOKEN
+
+sh scripts/deploy-and-verify.sh