Skip to content

Commit 01a4a72

Browse files
author
Maxim Konovalenko
committed
fix variables
1 parent 0514f35 commit 01a4a72

File tree

2 files changed

+124
-2
lines changed

2 files changed

+124
-2
lines changed

‎.examples/use_from_branch.yml‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
# Пример использования actions из ветки feat/signing_images
2+
# Этот файл нужно поместить в другой репозиторий в .github/workflows/
3+
4+
name: "Сборка модуля с подписью (dev версия)"
5+
6+
on:
7+
push:
8+
branches: [main, develop]
9+
pull_request:
10+
branches: [main]
11+
workflow_dispatch:
12+
13+
jobs:
14+
build:
15+
runs-on: ubuntu-latest
16+
name: "Сборка и подпись модуля"
17+
18+
steps:
19+
# Шаг 1: Получить код репозитория
20+
- name: "📥 Checkout код"
21+
uses: actions/checkout@v4
22+
23+
# Шаг 2: Настройка окружения (из ветки feat/signing_images)
24+
- name: "⚙️ Настройка окружения"
25+
uses: deckhouse/modules-actions/setup@feat/signing_images
26+
with:
27+
registry: registry.deckhouse.io
28+
registry_login: ${{ secrets.REGISTRY_LOGIN }}
29+
registry_password: ${{ secrets.REGISTRY_PASSWORD }}
30+
werf_version: "2.14.3"
31+
32+
# Шаг 3: Сборка модуля с подписью (из ветки feat/signing_images)
33+
- name: "🏗️ Сборка модуля с подписью"
34+
uses: deckhouse/modules-actions/build@feat/signing_images
35+
with:
36+
# Основные параметры модуля
37+
module_source: registry.deckhouse.io/deckhouse/ce/modules
38+
module_name: ${{ vars.MODULE_NAME || 'my-module' }}
39+
module_tag: ${{ github.ref_name }}
40+
41+
# Параметры для подписи (новые в вашей ветке)
42+
werf_sign_cert: ${{ secrets.WERF_SIGN_CERT }}
43+
werf_sign_intermediates: ${{ secrets.WERF_SIGN_INTERMEDIATES }}
44+
werf_sign_key: ${{ secrets.WERF_SIGN_KEY }}
45+
46+
# Параметры Vault (новые в вашей ветке)
47+
vault_addr: ${{ secrets.VAULT_ADDR }}
48+
vault_role_id: ${{ secrets.VAULT_ROLE_ID }}
49+
vault_secret_id: ${{ secrets.VAULT_SECRET_ID }}
50+
transit_secret_engine_path: ${{ secrets.TRANSIT_SECRET_ENGINE_PATH }}
51+
52+
# Дополнительные параметры
53+
secondary_repo: ${{ vars.SECONDARY_REPO }}
54+
source_repo_ssh_key: ${{ secrets.SOURCE_REPO_SSH_KEY }}
55+
56+
# Параметры Svace
57+
svace_enabled: ${{ github.event.inputs.svace_enabled || 'false' }}
58+
svace_analyze_host: ${{ secrets.SVACE_ANALYZE_HOST }}
59+
svace_analyze_ssh_user: ${{ secrets.SVACE_ANALYZE_SSH_USER }}
60+
svace_analyze_ssh_key: ${{ secrets.SVACE_ANALYZE_SSH_PRIVATE_KEY }}
61+
62+
# Шаг 4: CVE сканирование (опционально, из ветки feat/signing_images)
63+
- name: "🔍 CVE сканирование"
64+
if: github.event_name != 'pull_request' # Пропускать для PR
65+
uses: deckhouse/modules-actions/cve_scan@feat/signing_images
66+
with:
67+
tag: ${{ github.ref_name }}
68+
tag_type: dev
69+
module_name: ${{ vars.MODULE_NAME || 'my-module' }}
70+
dd_url: ${{ secrets.DEFECTDOJO_HOST }}
71+
dd_token: ${{ secrets.DEFECTDOJO_API_TOKEN }}
72+
prod_registry: ${{ secrets.PROD_READ_REGISTRY }}
73+
prod_registry_user: ${{ secrets.PROD_READ_REGISTRY_LOGIN }}
74+
prod_registry_password: ${{ secrets.PROD_READ_REGISTRY_PASSWORD }}
75+
dev_registry: ${{ secrets.DEV_REGISTRY }}
76+
dev_registry_user: ${{ secrets.DEV_REGISTRY_LOGIN }}
77+
dev_registry_password: ${{ secrets.DEV_REGISTRY_PASSWORD }}
78+
deckhouse_private_repo: ${{ secrets.DECKHOUSE_PRIVATE_REPO }}
79+
80+
# ВАЖНО: Необходимые secrets в целевом репозитории
81+
#
82+
# Secrets для registry:
83+
# - REGISTRY_LOGIN
84+
# - REGISTRY_PASSWORD
85+
#
86+
# Secrets для подписи (новые):
87+
# - WERF_SIGN_CERT
88+
# - WERF_SIGN_INTERMEDIATES
89+
# - WERF_SIGN_KEY
90+
#
91+
# Secrets для Vault (новые):
92+
# - VAULT_ADDR
93+
# - VAULT_ROLE_ID
94+
# - VAULT_SECRET_ID
95+
# - TRANSIT_SECRET_ENGINE_PATH
96+
#
97+
# Secrets для SSH:
98+
# - SOURCE_REPO_SSH_KEY
99+
# - SVACE_ANALYZE_SSH_PRIVATE_KEY
100+
#
101+
# Secrets для CVE сканирования:
102+
# - DEFECTDOJO_HOST
103+
# - DEFECTDOJO_API_TOKEN
104+
# - PROD_READ_REGISTRY
105+
# - PROD_READ_REGISTRY_LOGIN
106+
# - PROD_READ_REGISTRY_PASSWORD
107+
# - DEV_REGISTRY
108+
# - DEV_REGISTRY_LOGIN
109+
# - DEV_REGISTRY_PASSWORD
110+
# - DECKHOUSE_PRIVATE_REPO
111+
# - SVACE_ANALYZE_HOST
112+
# - SVACE_ANALYZE_SSH_USER
113+
#
114+
# Variables:
115+
# - MODULE_NAME
116+
# - SECONDARY_REPO

‎build/action.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,12 @@ inputs:
3131
transit_secret_engine_path:
3232
description: "Vault namespace, e.g., dh-signer-dev"
3333
required: true
34+
werf_sign_elf_files:
35+
description: "ELF files to sign 1 or 0"
36+
required: true
37+
werf_bsign_elf_files:
38+
description: "ELF files to bsign 1 or 0"
39+
required: true
3440
secondary_repo:
3541
description: 'Secondary repository address for module, e.g., registry.example.com/module-source/module_name'
3642
required: false
@@ -154,8 +160,8 @@ runs:
154160
TRANSIT_SECRET_ENGINE_PATH: "${{ inputs.transit_secret_engine_path }}"
155161
WERF_SIGN_MANIFEST: "1"
156162
WERF_ANNOTATE_LAYERS_WITH_DM_VERITY_ROOT_HASH: "1"
157-
WERF_SIGN_ELF_FILES: "1"
158-
WERF_BSIGN_ELF_FILES: "1"
163+
WERF_SIGN_ELF_FILES: "${{ inputs.werf_sign_elf_files }}"
164+
WERF_BSIGN_ELF_FILES: "${{ inputs.werf_bsign_elf_files }}"
159165

160166
- name: Cleanup ssh-agent
161167
if: ${{ steps.ssh_agent.outcome != 'skipped' && always() }}

0 commit comments

Comments
 (0)