Per Hoener
0d45331f5c
Deploy / validate-dispatch (push) Successful in 43s
Deploy / scheduled-rebuild-dev (push) Skipped
Deploy / scheduled-rebuild-master (push) Skipped
Deploy / rollback-dev (push) Skipped
Deploy / rollback-master (push) Skipped
Deploy / changes (push) Successful in 13s
Deploy / secret-scan (push) Successful in 9s
Deploy / app-quality (push) Successful in 11m21s
Deploy / security-deps (push) Successful in 14s
Deploy / context (push) Failing after 1s
Deploy / app-image (push) Skipped
Deploy / deploy-dev (push) Skipped
Deploy / deploy-master (push) Skipped
104 lines
3.3 KiB
Bash
104 lines
3.3 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
require_value() {
|
|
key="$1"
|
|
value="$2"
|
|
if [ -z "$value" ]; then
|
|
echo "Missing required workflow configuration: $key" >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
require_value "DEPLOY_TARGET" "${DEPLOY_TARGET:-}"
|
|
require_value "CALENDAR_URL" "${CALENDAR_URL:-}"
|
|
require_value "PRIMARY_DOMAIN" "${PRIMARY_DOMAIN:-}"
|
|
require_value "TRAEFIK_CERTRESOLVER" "${TRAEFIK_CERTRESOLVER:-}"
|
|
require_value "REGISTRY" "${REGISTRY:-}"
|
|
require_value "APP_IMAGE_REPOSITORY" "${APP_IMAGE_REPOSITORY:-}"
|
|
require_value "REGISTRY_USERNAME" "${REGISTRY_USERNAME:-}"
|
|
require_value "REGISTRY_TOKEN" "${REGISTRY_TOKEN:-}"
|
|
|
|
APP_URL="${APP_URL:-https://$PRIMARY_DOMAIN}"
|
|
CORS_ORIGIN="${CORS_ORIGIN:-$APP_URL}"
|
|
|
|
case "$DEPLOY_TARGET" in
|
|
dev)
|
|
default_stack_name="website-starter-dev"
|
|
default_traefik_network="traefik-external"
|
|
;;
|
|
master|production)
|
|
default_stack_name="website-starter-prod"
|
|
default_traefik_network="traefik"
|
|
;;
|
|
*)
|
|
echo "Unsupported deployment target: $DEPLOY_TARGET" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
COMPOSE_PROJECT_NAME="${COMPOSE_PROJECT_NAME:-$default_stack_name}"
|
|
TRAEFIK_STACK_NAME="${TRAEFIK_STACK_NAME:-$COMPOSE_PROJECT_NAME}"
|
|
TRAEFIK_NETWORK_NAME="${TRAEFIK_NETWORK_NAME:-$default_traefik_network}"
|
|
TRIVY_IMAGE="${TRIVY_IMAGE:-aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969}"
|
|
BUILD_DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
|
DOCKER_BUILDKIT="${DOCKER_BUILDKIT:-1}"
|
|
|
|
revision="$(git rev-parse --short=12 HEAD)"
|
|
build_timestamp="$(date -u +%Y%m%dT%H%M%SZ)"
|
|
APP_IMAGE_TAG="scheduled-$DEPLOY_TARGET-$revision-$build_timestamp"
|
|
APP_IMAGE_NAME="$APP_IMAGE_REPOSITORY:$APP_IMAGE_TAG"
|
|
|
|
export CALENDAR_URL
|
|
export PRIMARY_DOMAIN
|
|
export APP_URL
|
|
export CORS_ORIGIN
|
|
export COMPOSE_PROJECT_NAME
|
|
export TRAEFIK_STACK_NAME
|
|
export TRAEFIK_CERTRESOLVER
|
|
export TRAEFIK_NETWORK_NAME
|
|
export APP_IMAGE_NAME
|
|
export TRIVY_IMAGE
|
|
export DOCKER_BUILDKIT
|
|
export DEPLOY_MODE=app
|
|
|
|
echo "Scheduled rebuild target: $DEPLOY_TARGET"
|
|
echo "Git revision: $revision"
|
|
echo "App image: $APP_IMAGE_NAME"
|
|
|
|
docker build --pull \
|
|
--build-arg BUILD_DATE="$BUILD_DATE" \
|
|
--build-arg VCS_REF="$revision" \
|
|
--build-arg APP_URL="$APP_URL" \
|
|
--build-arg APP_NAME="${APP_NAME:-Example Website}" \
|
|
--build-arg COMPANY_NAME="${COMPANY_NAME:-Example Company}" \
|
|
--build-arg CONTACT_EMAIL="${CONTACT_EMAIL:-info@example.com}" \
|
|
--build-arg CONTACT_PHONE="${CONTACT_PHONE:-+49 000 000000}" \
|
|
--build-arg CONTACT_ADDRESS="${CONTACT_ADDRESS:-Example Street 1, 12345 Example City}" \
|
|
-f Dockerfile \
|
|
-t "$APP_IMAGE_NAME" \
|
|
.
|
|
|
|
echo "Reporting app runtime image vulnerabilities..."
|
|
sh scripts/trivy-scan.sh vuln-image "$APP_IMAGE_NAME"
|
|
|
|
echo "Blocking app critical runtime vulnerabilities..."
|
|
TRIVY_SEVERITY=CRITICAL TRIVY_EXIT_CODE=1 sh scripts/trivy-scan.sh vuln-image "$APP_IMAGE_NAME"
|
|
|
|
docker_config="$(mktemp -d)"
|
|
cleanup_registry_credentials() {
|
|
DOCKER_CONFIG="$docker_config" docker logout "$REGISTRY" >/dev/null 2>&1 || true
|
|
rm -rf "$docker_config"
|
|
}
|
|
trap cleanup_registry_credentials EXIT
|
|
trap 'exit 1' HUP INT TERM
|
|
export DOCKER_CONFIG="$docker_config"
|
|
echo "$REGISTRY_TOKEN" | docker login "$REGISTRY" -u "$REGISTRY_USERNAME" --password-stdin
|
|
docker push "$APP_IMAGE_NAME"
|
|
docker logout "$REGISTRY" >/dev/null
|
|
rm -rf "$docker_config"
|
|
trap - EXIT HUP INT TERM
|
|
unset DOCKER_CONFIG REGISTRY_USERNAME REGISTRY_TOKEN
|
|
|
|
sh scripts/deploy-and-verify.sh
|