cd: add OIDC permissions for AWS authentication #59
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI Pipeline | |
| on: | |
| push: | |
| branches: [main] | |
| paths-ignore: | |
| - 'k8s/**' | |
| - 'docs/**' | |
| - '**/*.md' | |
| workflow_dispatch: | |
| permissions: | |
| id-token: write | |
| contents: read | |
| env: | |
| REGISTRY: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ secrets.AWS_REGION }}.amazonaws.com | |
| jobs: | |
| security: | |
| name: Security Gate | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Gitleaks | |
| uses: gitleaks/gitleaks-action@v2 | |
| - name: Hadolint Backend | |
| uses: hadolint/hadolint-action@v3.1.0 | |
| with: | |
| dockerfile: backend/Dockerfile | |
| - name: Hadolint Frontend | |
| uses: hadolint/hadolint-action@v3.1.0 | |
| with: | |
| dockerfile: frontend/Dockerfile | |
| - name: Setup Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: backend/go.mod | |
| cache: true | |
| - name: Run govulncheck | |
| run: | | |
| cd backend | |
| go install golang.org/x/vuln/cmd/govulncheck@latest | |
| govulncheck ./... | |
| build-scan-push: | |
| name: Build, Scan & Push | |
| runs-on: ubuntu-latest | |
| needs: security | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| service: [backend, frontend] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: docker/setup-buildx-action@v3 | |
| - name: Set TAG | |
| run: echo "TAG=${GITHUB_SHA:0:7}" >> $GITHUB_ENV | |
| - name: Configure AWS (OIDC) | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| role-to-assume: ${{ secrets.AWS_ROLE_ARN }} | |
| aws-region: ${{ secrets.AWS_REGION }} | |
| - name: Login to ECR | |
| uses: aws-actions/amazon-ecr-login@v2 | |
| - name: Build image | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: ./${{ matrix.service }} | |
| load: true | |
| push: false | |
| tags: | | |
| ${{ env.REGISTRY }}/skillpulse-${{ matrix.service }}:${{ env.TAG }} | |
| ${{ env.REGISTRY }}/skillpulse-${{ matrix.service }}:latest | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Trivy Scan | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: ${{ env.REGISTRY }}/skillpulse-${{ matrix.service }}:${{ env.TAG }} | |
| format: table | |
| severity: CRITICAL,HIGH | |
| exit-code: 1 | |
| ignore-unfixed: true | |
| - name: Push Images | |
| run: | | |
| IMAGE=$REGISTRY/skillpulse-${{ matrix.service }} | |
| docker push $IMAGE:$TAG | |
| docker push $IMAGE:latest |