generated from mrsimonemms/new
-
Notifications
You must be signed in to change notification settings - Fork 0
120 lines (104 loc) · 3.32 KB
/
build.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
name: Build
on:
push:
branches:
- main
pull_request:
branches:
- main
workflow_dispatch:
permissions:
pull-requests: write
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN }}
KUBECONFIG: ${{ github.workspace }}/.kubeconfig
TF_TOKEN_app_terraform_io: ${{ secrets.TERRAFORM_CLOUD_SECRET }}
TF_VAR_hcloud_token: ${{ secrets.HCLOUD_TOKEN }}
TF_VAR_kubeconfig_output_path: ${{ github.workspace }}/.kubeconfig
TF_VAR_infisical_client_id: ${{ secrets.INFISICAL_CLIENT_ID }}
TF_VAR_infisical_client_secret: ${{ secrets.INFISICAL_CLIENT_SECRET }}
TF_VAR_ssh_key: ${{ secrets.SSH_KEY_PRIVATE }}
TF_VAR_ssh_key_public: ${{ secrets.SSH_KEY_PUBLIC }}
TF_VERSION: '1.9.3'
TG_VERSION: '0.66.1'
WORKING_DIR: stacks/prod
jobs:
commitlint:
runs-on: ubuntu-latest
env:
GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0 # fetch-depth is required
- uses: wagoid/commitlint-github-action@v6
pre-commit:
runs-on: ubuntu-latest
env:
TF_TOKEN_app_terraform_io: ${{ secrets.TERRAFORM_CLOUD_SECRET }}
HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN }}
TF_VAR_hcloud_token: ${{ secrets.HCLOUD_TOKEN }}
TF_VAR_infisical_client_id: ${{ secrets.INFISICAL_CLIENT_ID }}
TF_VAR_infisical_client_secret: ${{ secrets.INFISICAL_CLIENT_SECRET }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0 # fetch-depth is required
- uses: actions/setup-python@v5
with:
python-version: 3.x
- name: Set up Go
uses: actions/setup-go@v5
with:
go-version: '>=1.20.0'
- name: Setup TFLint
uses: terraform-linters/setup-tflint@v4
- name: Install Trivy
run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin
- name: Install Terragrunt
uses: jaxxstorm/[email protected]
with:
repo: gruntwork-io/terragrunt
extension-matching: disable
rename-to: terragrunt
chmod: 0755
- name: Init Terragrunt
run: terragrunt run-all init
- uses: pre-commit/[email protected]
plan:
runs-on: ubuntu-latest
needs:
- commitlint
- pre-commit
environment: prod
steps:
- uses: actions/checkout@v4
- name: Plan
uses: gruntwork-io/terragrunt-action@v2
with:
tf_version: ${{ env.TF_VERSION }}
tg_version: ${{ env.TG_VERSION }}
tg_dir: ${{ env.WORKING_DIR }}
tg_command: run-all plan
tg_comment: 1
deploy:
runs-on: ubuntu-latest
needs:
- plan
environment: prod
if: github.ref == 'refs/heads/main'
steps:
- uses: actions/checkout@v4
- uses: azure/setup-kubectl@v4
- name: Deploy
uses: gruntwork-io/terragrunt-action@v2
with:
tf_version: ${{ env.TF_VERSION }}
tg_version: ${{ env.TG_VERSION }}
tg_dir: ${{ env.WORKING_DIR }}
tg_command: run-all apply
- name: Change kubeconfig owner to runner
run: sudo chown $(whoami):$(whoami) $KUBECONFIG
- name: ArgoCD registry
run: kubectl apply -f registry/clusters/prod/registry.yaml