fix(chart): silence GraphItaliaHighWAFBlocks false positives #414
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 🚀 CI/CD Pipeline | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - develop | |
| tags: | |
| - "v*.*.*" | |
| pull_request: | |
| branches: | |
| - main | |
| - develop | |
| workflow_dispatch: | |
| inputs: | |
| no_cache: | |
| description: 'Build without Docker cache' | |
| required: false | |
| default: false | |
| type: boolean | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_OWNER: italia | |
| permissions: | |
| contents: read | |
| packages: write | |
| jobs: | |
| prepare: | |
| name: 📋 Prepare | |
| runs-on: arc-runner-italia | |
| outputs: | |
| version: ${{ steps.version.outputs.version }} | |
| is_production: ${{ steps.version.outputs.is_production }} | |
| build_time: ${{ steps.version.outputs.build_time }} | |
| steps: | |
| - name: 🏷️ Extract version | |
| id: version | |
| run: | | |
| SHORT_SHA="${GITHUB_SHA::7}" | |
| if [[ "${{ github.ref }}" == refs/tags/* ]]; then | |
| VERSION="${GITHUB_REF#refs/tags/v}" | |
| IS_PRODUCTION="true" | |
| elif [[ "${{ github.ref }}" == refs/heads/main ]]; then | |
| VERSION="0.0.0-main.${SHORT_SHA}" | |
| IS_PRODUCTION="false" | |
| else | |
| VERSION="0.0.0-dev.${SHORT_SHA}" | |
| IS_PRODUCTION="false" | |
| fi | |
| BUILD_TIME=$(date -u +"%Y-%m-%dT%H:%M:%SZ") | |
| echo "version=$VERSION" >> $GITHUB_OUTPUT | |
| echo "is_production=$IS_PRODUCTION" >> $GITHUB_OUTPUT | |
| echo "build_time=$BUILD_TIME" >> $GITHUB_OUTPUT | |
| build-images: | |
| name: 🏗️ Build Docker Images | |
| runs-on: arc-runner-italia | |
| needs: prepare | |
| strategy: | |
| matrix: | |
| include: | |
| - component: webapp | |
| dockerfile: packages/webapp/Dockerfile | |
| image: graph-italia-webapp | |
| - component: server | |
| dockerfile: packages/server/Dockerfile.app | |
| image: graph-italia-srv | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: 📥 Checkout | |
| uses: actions/checkout@v5 | |
| - name: 🔧 Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: 🔐 Log in to Container Registry | |
| if: github.event_name != 'pull_request' | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.repository_owner }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: 🏗️ Build and push ${{ matrix.component }} Docker image | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: ./${{ matrix.dockerfile }} | |
| push: ${{ github.event_name != 'pull_request' }} | |
| tags: | | |
| ${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/${{ matrix.image }}:${{ needs.prepare.outputs.version }} | |
| ${{ needs.prepare.outputs.is_production == 'true' && format('{0}/{1}/{2}:latest', env.REGISTRY, env.IMAGE_OWNER, matrix.image) || '' }} | |
| platforms: linux/amd64 | |
| build-args: | | |
| BUILD_SHA=${{ github.sha }} | |
| BUILD_TIME=${{ needs.prepare.outputs.build_time }} | |
| no-cache: ${{ inputs.no_cache || false }} | |
| cache-from: ${{ (!inputs.no_cache && format('type=gha,scope={0}', matrix.component)) || '' }} | |
| cache-to: type=gha,mode=max,scope=${{ matrix.component }} | |
| package-helm: | |
| name: 📦 Package Helm Chart | |
| runs-on: arc-runner-italia | |
| needs: prepare | |
| if: github.event_name != 'pull_request' | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: 📥 Checkout | |
| uses: actions/checkout@v5 | |
| - name: ⚓ Setup Helm | |
| uses: azure/setup-helm@v5 | |
| with: | |
| version: "3.14.0" | |
| - name: 📦 Package and push Helm chart | |
| run: | | |
| helm package ./charts/graph-italia --version ${{ needs.prepare.outputs.version }} | |
| echo ${{ secrets.GITHUB_TOKEN }} | helm registry login ghcr.io -u ${{ github.repository_owner }} --password-stdin | |
| helm push graph-italia-${{ needs.prepare.outputs.version }}.tgz oci://${{ env.REGISTRY }}/${{ github.repository_owner }}/charts | |
| deploy-production: | |
| name: 🚀 Deploy to Production | |
| runs-on: arc-runner-italia | |
| needs: [prepare, build-images, package-helm] | |
| if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/') | |
| permissions: | |
| contents: read | |
| packages: read | |
| environment: | |
| name: production | |
| steps: | |
| - name: ⚓ Setup Helm | |
| uses: azure/setup-helm@v5 | |
| with: | |
| version: "3.14.0" | |
| - name: 🔐 Log in to Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.repository_owner }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: 🔐 Login to Helm Registry | |
| run: | | |
| echo ${{ secrets.GITHUB_TOKEN }} | helm registry login ghcr.io -u ${{ github.repository_owner }} --password-stdin | |
| - name: 🛠️ Setup kubectl | |
| uses: azure/setup-kubectl@v4 | |
| with: | |
| version: 'v1.30.0' | |
| - name: 🔗 Setup Kubernetes credentials | |
| run: | | |
| mkdir -p ~/.kube | |
| echo "${{ secrets.KUBE_CA_CERT }}" | base64 -d > /tmp/ca.crt | |
| kubectl config set-cluster graph-italia-cluster \ | |
| --server=${{ secrets.KUBE_SERVER }} \ | |
| --certificate-authority=/tmp/ca.crt \ | |
| --embed-certs=true | |
| kubectl config set-credentials github-actions \ | |
| --token=${{ secrets.KUBE_TOKEN }} | |
| kubectl config set-context graph-italia \ | |
| --cluster=graph-italia-cluster \ | |
| --user=github-actions \ | |
| --namespace=graph-italia | |
| kubectl config use-context graph-italia | |
| - name: 🎯 Deploy to Kubernetes | |
| run: | | |
| helm upgrade --install graph-italia \ | |
| oci://${{ env.REGISTRY }}/${{ github.repository_owner }}/charts/graph-italia \ | |
| --version ${{ needs.prepare.outputs.version }} \ | |
| --namespace graph-italia \ | |
| --reuse-values \ | |
| --set webapp.image.tag="${{ needs.prepare.outputs.version }}" \ | |
| --set server.image.tag="${{ needs.prepare.outputs.version }}" \ | |
| --wait \ | |
| --timeout=10m \ | |
| --atomic | |
| - name: ✅ Verify deployment | |
| run: | | |
| kubectl rollout status deployment/graph-italia-webapp -n graph-italia | |
| kubectl rollout status deployment/graph-italia-server -n graph-italia | |
| echo "✅ Deployed version ${{ needs.prepare.outputs.version }} to graph-italia" | |
| publish-npm: | |
| name: 📦 Publish npm package | |
| runs-on: arc-runner-italia | |
| needs: [prepare] | |
| if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/') | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: 📥 Checkout | |
| uses: actions/checkout@v5 | |
| - name: 🔧 Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| registry-url: 'https://registry.npmjs.org' | |
| - name: 🔧 Setup Bun | |
| uses: oven-sh/setup-bun@v2 | |
| - name: 📦 Install dependencies | |
| working-directory: packages/components | |
| run: bun install --frozen-lockfile || bun install | |
| - name: 🏗️ Build library | |
| working-directory: packages/components | |
| run: bun run build | |
| - name: 🔍 Check if version already published | |
| id: check | |
| working-directory: packages/components | |
| run: | | |
| PACKAGE_NAME=$(node -p "require('./package.json').name") | |
| PACKAGE_VERSION=$(node -p "require('./package.json').version") | |
| echo "name=$PACKAGE_NAME" >> $GITHUB_OUTPUT | |
| echo "version=$PACKAGE_VERSION" >> $GITHUB_OUTPUT | |
| if npm view "${PACKAGE_NAME}@${PACKAGE_VERSION}" version 2>/dev/null; then | |
| echo "already_published=true" >> $GITHUB_OUTPUT | |
| echo "⚠️ ${PACKAGE_NAME}@${PACKAGE_VERSION} is already published, skipping." | |
| else | |
| echo "already_published=false" >> $GITHUB_OUTPUT | |
| echo "📦 ${PACKAGE_NAME}@${PACKAGE_VERSION} will be published." | |
| fi | |
| - name: 🚀 Publish to npm | |
| if: steps.check.outputs.already_published == 'false' | |
| working-directory: packages/components | |
| run: npm publish --access public | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| - name: ✅ Published | |
| if: steps.check.outputs.already_published == 'false' | |
| run: echo "✅ Published ${{ steps.check.outputs.name }}@${{ steps.check.outputs.version }} to npm" | |
| deploy-test: | |
| name: 🧪 Deploy to Test Environment | |
| runs-on: arc-runner-italia | |
| needs: [prepare, build-images, package-helm] | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/develop' | |
| environment: | |
| name: test | |
| permissions: | |
| contents: read | |
| packages: read | |
| steps: | |
| - name: ⚓ Setup Helm | |
| uses: azure/setup-helm@v5 | |
| with: | |
| version: "3.14.0" | |
| - name: 🔐 Log in to Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.repository_owner }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: 🔐 Login to Helm Registry | |
| run: | | |
| echo ${{ secrets.GITHUB_TOKEN }} | helm registry login ghcr.io -u ${{ github.repository_owner }} --password-stdin | |
| - name: 🛠️ Setup kubectl | |
| uses: azure/setup-kubectl@v4 | |
| with: | |
| version: 'v1.30.0' | |
| - name: 🔗 Setup Kubernetes credentials | |
| run: | | |
| mkdir -p ~/.kube | |
| echo "${{ secrets.KUBE_CA_CERT }}" | base64 -d > /tmp/ca.crt | |
| kubectl config set-cluster graph-italia-cluster \ | |
| --server=${{ secrets.KUBE_SERVER }} \ | |
| --certificate-authority=/tmp/ca.crt \ | |
| --embed-certs=true | |
| kubectl config set-credentials github-actions \ | |
| --token=${{ secrets.KUBE_TOKEN }} | |
| kubectl config set-context graph-italia-test \ | |
| --cluster=graph-italia-cluster \ | |
| --user=github-actions \ | |
| --namespace=graph-italia-test | |
| kubectl config use-context graph-italia-test | |
| - name: 🎯 Deploy to graph-italia-test | |
| run: | | |
| helm upgrade --install graph-italia-test \ | |
| oci://${{ env.REGISTRY }}/${{ github.repository_owner }}/charts/graph-italia \ | |
| --version ${{ needs.prepare.outputs.version }} \ | |
| --namespace graph-italia-test \ | |
| --reuse-values \ | |
| --set webapp.image.tag="${{ needs.prepare.outputs.version }}" \ | |
| --set server.image.tag="${{ needs.prepare.outputs.version }}" \ | |
| --wait \ | |
| --timeout=10m \ | |
| --atomic | |
| - name: ✅ Verify deployment | |
| run: | | |
| kubectl rollout status deployment/graph-italia-test-webapp -n graph-italia-test | |
| kubectl rollout status deployment/graph-italia-test-server -n graph-italia-test | |
| echo "✅ Deployed version ${{ needs.prepare.outputs.version }} to graph-italia-test" |