diff --git a/.github/workflows/deploy-k8s.yml b/.github/workflows/deploy-k8s.yml index e3351ae58f..59058ebc87 100644 --- a/.github/workflows/deploy-k8s.yml +++ b/.github/workflows/deploy-k8s.yml @@ -27,6 +27,7 @@ env: GITHUB_TOKEN: ${{ secrets.GIT_TOKEN }} BUILD_BASE: ${{ (contains(github.event.pull_request.body, 'ci:build-base') || github.event_name == 'schedule') && '1' || '0' }} BASE_IMAGE: ${{ secrets.REGISTRY_HOST }}/processmaker/processmaker:base + K8S_BRANCH: bugfix/FOUR-12410 concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: true @@ -44,7 +45,7 @@ jobs: run: | # TODO: Change branch when pm4 k8s distribution is released echo "IMAGE: ${{ env.IMAGE }}" - git clone --depth 1 -b bugfix/FOUR-12410 "https://$GITHUB_TOKEN@github.com/ProcessMaker/pm4-k8s-distribution.git" pm4-k8s-distribution + git clone --depth 1 -b "$K8S_BRANCH" "https://$GITHUB_TOKEN@github.com/ProcessMaker/pm4-k8s-distribution.git" pm4-k8s-distribution - name: Generate image EKS run: | cd pm4-k8s-distribution/images @@ -52,6 +53,18 @@ jobs: - name: List Images run: | docker images + - name: Run Trivy vulnerability scanner + uses: aquasecurity/trivy-action@master + with: + image-ref: processmaker/enterprise:${{env.IMAGE_TAG}} + format: 'table' + exit-code: '0' + ignore-unfixed: false + vuln-type: 'os,library' + scanners: 'vuln,secret' + severity: 'MEDIUM,HIGH,CRITICAL' + env: + TRIVY_TIMEOUT: 30m - name: Login to Harbor uses: docker/login-action@v2 with: @@ -59,16 +72,12 @@ jobs: username: ${{ secrets.REGISTRY_USERNAME }} password: ${{ secrets.REGISTRY_PASSWORD }} - name: Push Enterprise Image to Harbor - run: | - #if [[ "$BUILD_BASE" == "1" ]]; then - # docker push ${{ env.BASE_IMAGE }} - #fi - #docker push ${{ env.IMAGE }} + run: | docker tag processmaker/enterprise:${{env.IMAGE_TAG}} ${{ secrets.REGISTRY_HOST }}/processmaker/enterprise:${{env.IMAGE_TAG}} docker push ${{ secrets.REGISTRY_HOST }}/processmaker/enterprise:${{env.IMAGE_TAG}} deployEKS: name: build-deploy-EKS - #if: contains(github.event.pull_request.body, 'ci:deploy') + if: contains(github.event.pull_request.body, 'ci:deploy') needs: imageEKS runs-on: self-hosted steps: @@ -83,6 +92,12 @@ jobs: kubectl get namespace ci-processmaker-ns-pm4 namespace=$(kubectl get namespace $deploy-ns-pm4|grep $deploy|awk '{print $1}') kubectl apply -f template-db.yaml + - name: Install pm4-tools + run: | + git clone --depth 1 -b "$K8S_BRANCH" "https://$GITHUB_TOKEN@github.com/ProcessMaker/pm4-k8s-distribution.git" pm4-k8s-distribution + cd pm4-k8s-distribution/images/pm4-tools + composer install --no-interaction + cd .. - name: Deploy instance EKS run: | cd argocd @@ -103,6 +118,7 @@ jobs: fi export INSTANCE_URL=https://ci-$deploy$DOM_EKS echo "INSTANCE_URL=${INSTANCE_URL}" >> "$GITHUB_ENV" + ../pm4-k8s-distribution/images/pm4-tools/pm wait-for-instance-ready - name: Comment Instance run: | echo "Instance URL: '${INSTANCE_URL}'"