Security Updates #30

	name: BuildPush_App
	on:
	workflow_dispatch:
	pull_request:
	branches:
	- main
	paths:
	- 'app/**'

	env:
	IMAGE_TAG: $(echo ${{ github.sha }} \| cut -c1-4)
	NODE_VERSION: 20.11.1

	jobs:
	build_apps:
	name: CodeBuild
	permissions:
	contents: read
	issues: read
	checks: write
	pull-requests: write
	runs-on: ubuntu-latest
	environment: Dev
	steps:
	- name: Checkout repository
	uses: actions/checkout@v2

	- name: Set up Node.js
	uses: actions/setup-node@v3
	with:
	node-version: ${{ env.NODE_VERSION }}

	- name: Install dependencies
	run: npm install
	working-directory: ./app/cohere-app

	- name: Build Next.js app
	run: npm run build
	working-directory: ./app/cohere-app

	images:
	name: ImageBuild
	permissions:
	contents: read
	issues: read
	checks: write
	pull-requests: write
	id-token: 'write'
	needs: build_apps
	runs-on: ubuntu-latest
	environment: Dev
	steps:
	- name: Checkout repository
	uses: actions/checkout@v4

	# https://github.com/google-github-actions/auth
	- name: Authenticate with Google Cloud
	uses: 'google-github-actions/auth@v2'
	with:
	workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITYPROVIDER }}
	service_account: ${{ secrets.SERVICE_ACCOUNT }}

	- name: Build and Push Image
	run: \|
	chmod +x ci/scripts/build-and-push-app.sh
	python3 ci/scripts/build-and-push-all.py --config "ci/configs/pipeline-config.json" --gitsha ${{ env.IMAGE_TAG }} --registry gcr.io/${{ secrets.PROJECT_ID }}
	env:
	PROJECT_ID: ${{ secrets.PROJECT_ID }}

Provide feedback