Skip to content

Commit 7cd17fe

Browse files
RedjiJBRedjiJB
committed
ci: add production CI, release, and security scan workflows
1 parent fdd2fbe commit 7cd17fe

File tree

3 files changed

+150
-25
lines changed

3 files changed

+150
-25
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 74 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -2,44 +2,98 @@ name: CI
22

33
on:
44
push:
5-
branches: [main, develop]
5+
branches: [main, develop, 'feature/**', 'bugfix/**']
66
pull_request:
77
branches: [main, develop]
88

9+
permissions:
10+
contents: read
11+
security-events: write
12+
913
jobs:
10-
lint:
11-
name: Lint
14+
validate:
15+
name: Validate Configuration
1216
runs-on: ubuntu-latest
1317
steps:
1418
- uses: actions/checkout@v4
15-
- name: Validate docker-compose files
19+
20+
- name: Validate Docker Compose files
1621
run: |
1722
for f in docker/docker-compose.*.yml; do
18-
echo "Validating \..."
19-
docker compose -f "\" config -q
23+
echo "Validating: $f"
24+
docker compose -f "$f" config -q
2025
done
21-
- name: Lint shell scripts
26+
27+
- name: ShellCheck — lab test scripts
2228
run: |
23-
sudo apt-get install -y shellcheck
24-
shellcheck tests/labs/*.sh docker/entrypoint.sh
29+
sudo apt-get install -y shellcheck -qq
30+
shellcheck tests/labs/*.sh
2531
26-
test-lab-01:
27-
name: Lab 01 — Standalone
28-
runs-on: ubuntu-latest
29-
needs: lint
30-
steps:
31-
- uses: actions/checkout@v4
32-
- name: Run Lab 01
33-
run: bash tests/labs/test-lab-03-01.sh
32+
- name: Validate module manifest
33+
run: |
34+
python3 -c "
35+
import sys, re
36+
with open('it-stack-postgresql.yml') as f:
37+
content = f.read()
38+
required = ['module:', 'version:', 'phase:', 'category:', 'ports:']
39+
missing = [k for k in required if k not in content]
40+
if missing:
41+
print('Missing fields:', missing); sys.exit(1)
42+
print('Manifest valid')
43+
"
3444
3545
security-scan:
3646
name: Security Scan
3747
runs-on: ubuntu-latest
38-
needs: lint
48+
needs: validate
3949
steps:
4050
- uses: actions/checkout@v4
41-
- name: Run Trivy on Dockerfile
42-
uses: aquasecurity/trivy-action@master
51+
52+
- name: Trivy — scan Dockerfile
53+
uses: aquasecurity/trivy-action@0.28.0
54+
with:
55+
scan-type: config
56+
scan-ref: .
57+
exit-code: '0'
58+
severity: CRITICAL,HIGH
59+
60+
- name: Trivy — SARIF output
61+
uses: aquasecurity/trivy-action@0.28.0
4362
with:
4463
scan-type: config
4564
scan-ref: .
65+
format: sarif
66+
output: trivy-results.sarif
67+
68+
- name: Upload SARIF to GitHub Security
69+
uses: github/codeql-action/upload-sarif@v3
70+
if: always()
71+
with:
72+
sarif_file: trivy-results.sarif
73+
74+
lab-01-smoke:
75+
name: Lab 01 — Smoke Test
76+
runs-on: ubuntu-latest
77+
needs: validate
78+
steps:
79+
- uses: actions/checkout@v4
80+
81+
- name: Start standalone stack
82+
run: docker compose -f docker/docker-compose.standalone.yml up -d
83+
84+
- name: Wait for health
85+
run: |
86+
echo "Waiting for services to be healthy..."
87+
sleep 30
88+
docker compose -f docker/docker-compose.standalone.yml ps
89+
90+
- name: Run Lab 01 test script
91+
run: bash tests/labs/test-lab-01.sh
92+
93+
- name: Collect logs on failure
94+
if: failure()
95+
run: docker compose -f docker/docker-compose.standalone.yml logs
96+
97+
- name: Cleanup
98+
if: always()
99+
run: docker compose -f docker/docker-compose.standalone.yml down -v

‎.github/workflows/release.yml‎

Lines changed: 36 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,32 +2,63 @@ name: Release
22

33
on:
44
push:
5-
tags: ['v*.*.*']
5+
tags:
6+
- 'v*.*.*'
7+
8+
permissions:
9+
contents: write
10+
packages: write
611

712
jobs:
813
build-and-push:
914
name: Build and Push Docker Image
1015
runs-on: ubuntu-latest
11-
permissions:
12-
contents: read
13-
packages: write
1416
steps:
1517
- uses: actions/checkout@v4
18+
19+
- name: Set up Docker Buildx
20+
uses: docker/setup-buildx-action@v3
21+
1622
- name: Log in to GHCR
1723
uses: docker/login-action@v3
1824
with:
1925
registry: ghcr.io
2026
username: ${{ github.actor }}
2127
password: ${{ secrets.GITHUB_TOKEN }}
28+
2229
- name: Extract metadata
2330
id: meta
2431
uses: docker/metadata-action@v5
2532
with:
2633
images: ghcr.io/it-stack-dev/it-stack-postgresql
34+
tags: |
35+
type=semver,pattern={{version}}
36+
type=semver,pattern={{major}}.{{minor}}
37+
type=semver,pattern={{major}}
38+
type=sha,prefix=sha-,format=short
39+
2740
- name: Build and push
28-
uses: docker/build-push-action@v5
41+
uses: docker/build-push-action@v6
2942
with:
3043
context: .
3144
push: true
3245
tags: ${{ steps.meta.outputs.tags }}
3346
labels: ${{ steps.meta.outputs.labels }}
47+
cache-from: type=gha
48+
cache-to: type=gha,mode=max
49+
50+
- name: Trivy — scan released image
51+
uses: aquasecurity/trivy-action@0.28.0
52+
with:
53+
image-ref: ghcr.io/it-stack-dev/it-stack-postgresql:${{ steps.meta.outputs.version }}
54+
scan-type: image
55+
exit-code: '0'
56+
severity: CRITICAL,HIGH
57+
format: table
58+
59+
- name: Create GitHub Release
60+
uses: softprops/action-gh-release@v2
61+
with:
62+
generate_release_notes: true
63+
files: |
64+
it-stack-postgresql.yml

‎.github/workflows/security.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
name: Security Scan (Scheduled)
2+
3+
on:
4+
schedule:
5+
- cron: '0 2 * * 1' # Every Monday at 02:00 UTC
6+
workflow_dispatch:
7+
8+
permissions:
9+
contents: read
10+
security-events: write
11+
12+
jobs:
13+
trivy-scan:
14+
name: Trivy Full Scan
15+
runs-on: ubuntu-latest
16+
steps:
17+
- uses: actions/checkout@v4
18+
19+
- name: Trivy — filesystem scan
20+
uses: aquasecurity/trivy-action@0.28.0
21+
with:
22+
scan-type: fs
23+
scan-ref: .
24+
format: sarif
25+
output: trivy-fs.sarif
26+
severity: CRITICAL,HIGH,MEDIUM
27+
28+
- name: Upload SARIF
29+
uses: github/codeql-action/upload-sarif@v3
30+
if: always()
31+
with:
32+
sarif_file: trivy-fs.sarif
33+
34+
- name: Trivy — config scan
35+
uses: aquasecurity/trivy-action@0.28.0
36+
with:
37+
scan-type: config
38+
scan-ref: .
39+
format: table
40+
severity: CRITICAL,HIGH

0 commit comments

Comments
 (0)