Skip to content

Commit e9d2a3c

Browse files
cedricvecedricve
committed
add workflows
1 parent b504708 commit e9d2a3c

File tree

3 files changed

+139
-0
lines changed

3 files changed

+139
-0
lines changed

‎.github/workflows/pr-description.yml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: Autofill PR description
2+
3+
on: pull_request
4+
5+
jobs:
6+
openai-pr-description:
7+
runs-on: ubuntu-22.04
8+
9+
steps:
10+
- uses: actions/checkout@v4
11+
- name: Autofill PR description if empty using OpenAI
12+
uses: cedricve/azureopenai-pr-description@master
13+
with:
14+
github_token: ${{ secrets.TOKEN }}
15+
openai_api_key: ${{ secrets.OPENAI_API_KEY }}
16+
azure_openai_api_key: ${{ secrets.AZURE_OPENAI_API_KEY }}
17+
azure_openai_endpoint: ${{ secrets.AZURE_OPENAI_ENDPOINT }}
18+
azure_openai_version: ${{ secrets.AZURE_OPENAI_VERSION }}
19+
overwrite_description: true

‎.github/workflows/pr-security-scan.yaml

+61
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
name: Security scan
2+
on:
3+
pull_request:
4+
types: [opened, synchronize, reopened]
5+
push:
6+
branches:
7+
- main
8+
jobs:
9+
security-scan:
10+
runs-on: ubuntu-latest
11+
env:
12+
PR_NUMBER: ${{ github.event.number }}
13+
COMMIT_SHA: ${{ github.sha }}
14+
TAG: hub-pipeline-sprite-pr${{ github.event.number }}-${{ github.sha }}
15+
steps:
16+
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
17+
- name: Checkout repository
18+
uses: actions/checkout@v2
19+
- name: Set up Docker Buildx
20+
uses: docker/setup-buildx-action@v1
21+
- name: Log in to Docker Hub
22+
uses: docker/login-action@v1
23+
with:
24+
username: ${{ secrets.DOCKER_USERNAME }}
25+
password: ${{ secrets.DOCKER_PASSWORD }}
26+
27+
# Build the Docker image with the latest tag and the release tag
28+
# Build the Docker image with the latest tag and the release tag
29+
- name: Build Docker image with PR tag
30+
run: |
31+
docker build -t uugai/pullrequests:${{ env.TAG }} \
32+
--build-arg github_username=${{ secrets.USERNAME }} \
33+
--build-arg github_token=${{ secrets.TOKEN }} .
34+
35+
# This is a workaround for the issue with the Trivy DBs not being available due to
36+
# rate limiting. The workaround is to download the DBs and cache them.
37+
- name: Setup oras
38+
uses: oras-project/setup-oras@v1
39+
- name: Download and extract the vulnerability DB
40+
run: |
41+
mkdir -p $GITHUB_WORKSPACE/.cache/trivy/db
42+
oras pull ghcr.io/aquasecurity/trivy-db:2
43+
tar -xzf db.tar.gz -C $GITHUB_WORKSPACE/.cache/trivy/db
44+
45+
# Scan the Docker image for vulnerabilities
46+
- name: Run Trivy vulnerability scanner
47+
uses: aquasecurity/[email protected]
48+
with:
49+
skip-setup-trivy: false
50+
scan-type: "image"
51+
image-ref: "uugai/pullrequests:${{ env.TAG }}"
52+
format: "table"
53+
exit-code: "0"
54+
ignore-unfixed: false
55+
vuln-type: "os,library"
56+
severity: "CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN"
57+
#Below only works on the main branch
58+
#format: "github"
59+
#github-pat: ${{ secrets.TOKEN }}
60+
env:
61+
TRIVY_SKIP_DB_UPDATE: true

‎.github/workflows/release-create.yml

+59
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
name: Create a new release
2+
on:
3+
release:
4+
types: [created]
5+
workflow_dispatch:
6+
inputs:
7+
tag:
8+
description: "Tag for the Docker image"
9+
required: true
10+
default: "test"
11+
jobs:
12+
build-and-push:
13+
runs-on: ubuntu-latest
14+
steps:
15+
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
16+
- name: Checkout repository
17+
uses: actions/checkout@v2
18+
- name: Set up Docker Buildx
19+
uses: docker/setup-buildx-action@v1
20+
- name: Log in to Docker Hub
21+
uses: docker/login-action@v1
22+
with:
23+
username: ${{ secrets.DOCKER_USERNAME }}
24+
password: ${{ secrets.DOCKER_PASSWORD }}
25+
# Build the Docker image with the latest tag and the release tag
26+
- name: Build and push Docker image with latest tag
27+
uses: docker/build-push-action@v2
28+
if: github.event.inputs.tag != 'test'
29+
with:
30+
context: .
31+
push: true
32+
build-args: |
33+
github_username=${{ secrets.USERNAME }}
34+
github_token=${{ secrets.TOKEN }}
35+
tags: uugai/hub-pipeline-Classifier:latest
36+
- name: Build and push Docker image with release tag
37+
uses: docker/build-push-action@v2
38+
if: github.event.inputs.tag != 'test'
39+
with:
40+
context: .
41+
push: true
42+
build-args: |
43+
github_username=${{ secrets.USERNAME }}
44+
github_token=${{ secrets.TOKEN }}
45+
tags: uugai/hub-pipeline-Classifier:${{ github.event.inputs.tag || github.ref_name }}
46+
# After we build the Docker image, we create a pull request to update the GitOps repository
47+
# This will allow us to update the Helm chart with the new Docker image tag.
48+
- name: Create GitOps Pull Request
49+
uses: cedricve/gitops-pullrequest-action@master
50+
with:
51+
github-token: ${{ secrets.TOKEN }}
52+
gitops-repo: "uug-ai/gitops"
53+
gitops-file: "environments/staging/kerberos-hub/hub-pipeline-classifier.yaml"
54+
gitops-pr-branch: "release-hub-pipeline-classifier-${{ github.event.inputs.tag || github.ref_name }}"
55+
gitops-key: "k.spec.template.spec.containers[0].image"
56+
gitops-value: "${{ github.event.inputs.tag || github.ref_name }}"
57+
commit-email: "[email protected]"
58+
commit-name: "GitOps - UUG.AI"
59+
commit-message: "A new release for Kerberos Hub Pipeline Classifier - ${{ github.event.inputs.tag || github.ref_name }}"

0 commit comments

Comments
 (0)