Skip to content

github-actions.md

Latest commit

 

History

History
341 lines (235 loc) · 5.28 KB

github-actions.md

File metadata and controls

341 lines (235 loc) · 5.28 KB
Raw

GitHub Actions CI/CD Pipeline

The pipeline follows GitOps principles using ArgoCD and integrates:

  • Security scanning
  • Docker image build automation
  • Amazon ECR image publishing
  • Immutable image versioning
  • Kubernetes manifest automation
  • Automated deployment synchronization

CI/CD Architecture

Developer Push
↓
CI Pipeline (Security → Build → Scan → Push to ECR)
↓
CD Workflow (Kubernetes Manifest Update)
↓
ArgoCD Sync
↓
EKS Deployment

Workflow Files

Workflow Purpose
.github/workflows/ci.yaml Security scanning, Docker build, vulnerability scan, ECR push
.github/workflows/cd-k8s.yaml Updates Kubernetes manifests with immutable image tags

Prerequisites

Before using the CI/CD pipelines, complete:

  • GitHub OIDC configuration
  • GitHub Secrets setup
  • Amazon ECR repository creation

See: prerequisites.md

CI Pipeline (ci.yaml)

The CI pipeline is triggered on pushes to the main branch.

Trigger Conditions

on:
  push:
    branches: [main]

The workflow ignores:

  • Terraform changes
  • Documentation updates
  • Kubernetes manifest-only changes
paths-ignore:
  - 'k8s/**'
  - 'docs/**'
  - '**/*.md'
  - 'terraform/**'

Security Gate Stage

The pipeline starts with security validation before any Docker image build occurs.

Gitleaks

Detects:

  • API keys
  • Secrets
  • Credentials
  • Accidental sensitive commits
uses: gitleaks/gitleaks-action@v2

Hadolint

Validates Dockerfile best practices for:

  • Backend
  • Frontend

Checks:

  • Image layering
  • Package cleanup
  • Pinned versions
  • Security recommendations
uses: hadolint/hadolint-action@v3.1.0

Govulncheck

Scans Go dependencies for known vulnerabilities.

go install golang.org/x/vuln/cmd/govulncheck@latest

Checks:

  • Vulnerable packages
  • Insecure dependencies
  • Known CVEs

Build, Scan & Push Stage

After the security checks pass, the Docker images are built.

Docker Buildx

Uses BuildKit for:

  • Faster builds
  • Layer caching
  • Optimized Docker builds
  • Multi-platform readiness
uses: docker/setup-buildx-action@v3

Amazon ECR Authentication

Authentication uses GitHub OIDC federation. No long-lived AWS credentials are stored in GitHub Secrets.

uses: aws-actions/configure-aws-credentials@v4

Benefits:

  • Short-lived credentials
  • Secure IAM role assumption
  • Improved security posture
  • Least privilege access

Image Tagging Strategy

Images are tagged using:

  • Immutable Git commit SHA
  • latest

Example:

skillpulse-backend:a1b2c3d
skillpulse-backend:latest

This enables:

  • Rollback support
  • Deployment traceability
  • Immutable releases

Trivy Vulnerability Scanning

Every Docker image is scanned before being pushed to Amazon ECR.

Scans:

  • OS packages
  • Application dependencies
  • Critical vulnerabilities
  • High vulnerabilities

Pipeline fails automatically if vulnerabilities are detected.

severity: CRITICAL,HIGH
exit-code: 1
uses: aquasecurity/trivy-action@master

Both backend and frontend images are versioned using Git commit SHA for immutability.

After successful scanning:

  • Backend image pushed
  • Frontend image pushed

Repositories:

  • skillpulse-backend
  • skillpulse-frontend

Images pushed:

  • SHA-tagged image
  • latest image

CD Pipeline (cd-k8s.yaml)

The CD pipeline follows a GitOps workflow. It is triggered automatically after the successful completion of the CI pipeline.

on:
  workflow_run:
    workflows: ["CI Pipeline"]

Deployment Toggle

Automatic deployment is controlled using:

DEPLOY_ENABLED=true

This allows:

  • Disabling deployments temporarily
  • Safe maintenance windows
  • Controlled rollout management

Manifest Bump Strategy

The workflow updates Kubernetes deployment manifests with immutable image tags.

Example:

image: <aws-account>.dkr.ecr.ap-south-1.amazonaws.com/skillpulse-backend:a1b2c3d

Files updated:

  • k8s/08-backend-deployment.yaml
  • k8s/11-frontend-deployment.yaml

Automatic Git Commit

After updating manifests:

  • Changes are committed automatically
  • Commit is pushed to GitHub
  • ArgoCD detects repository changes
  • Deployment sync occurs automatically

Example commit:

deploy: pin images to a1b2c3d

GitOps Deployment Flow

ArgoCD continuously watches the Kubernetes manifests repository.

Once the CD workflow commits updated image tags:

  • ArgoCD detects changes
  • Synchronizes Kubernetes manifests
  • Deploys updated workloads to Amazon EKS

This ensures:

  • Declarative infrastructure
  • Auditability
  • Reproducible deployments
  • Automated synchronization

Verification

Verify CI Workflow

Go to:

GitHub Repository → Actions → CI Pipeline

Verify:

  • Security scans pass
  • Docker builds succeed
  • Trivy scan succeeds
  • Images pushed to ECR

Verify CD Workflow

Go to:

GitHub Repository → Actions → CD (EKS cluster — manifest bump)

Verify:

  • Manifests updated
  • Commit pushed successfully
  • Image tags updated

Verify ArgoCD Sync

Open: ArgoCD Dashboard

Verify:

  • Application synced
  • Healthy status
  • Latest image deployed