[Snyk] Security upgrade amazoncorretto from 17.0.10-alpine to 17.0.18-alpine #107
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Push Image | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: [ "main", "release" ] | |
| pull_request: | |
| env: | |
| AWS_ACCESS_KEY_ID: ${{ secrets.ECR_PUSH_USER_AWS_ACCESS_KEY_ID }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.ECR_PUSH_USER_AWS_SECRET_ACCESS_KEY }} | |
| AWS_REGION: ${{ secrets.ECR_PUSH_USER_AWS_REGION }} | |
| jobs: | |
| start-runner: | |
| name: Start self-hosted EC2 runner | |
| runs-on: ubuntu-latest | |
| outputs: | |
| label: ${{ steps.start-ec2-runner.outputs.label }} | |
| ec2-instance-id: ${{ steps.start-ec2-runner.outputs.ec2-instance-id }} | |
| steps: | |
| - name: Configure AWS credentials | |
| uses: aws-actions/configure-aws-credentials@v3 | |
| with: | |
| aws-access-key-id: ${{ secrets.RUNNER_MANAGER_AWS_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ secrets.RUNNER_MANAGER_AWS_SECRET_ACCESS_KEY }} | |
| aws-region: ${{ secrets.RUNNER_MANAGER_AWS_REGION }} | |
| - name: Start EC2 runner | |
| id: start-ec2-runner | |
| uses: TogaiHQ/ec2-github-runner@main | |
| with: | |
| mode: start | |
| github-token: ${{ secrets.RUNNER_MANAGER_GH_PERSONAL_ACCESS_TOKEN }} | |
| ec2-image-id: ami-0b7130cf8d331f3df # AMI architecure is arm64 | |
| ec2-instance-type: 't4g.large' | |
| subnet-id: ${{ secrets.RUNNER_MANAGER_SUBNET_ID }} | |
| security-group-id: ${{ secrets.RUNNER_MANAGER_SECURITY_GROUP_ID }} | |
| runner-home-dir: /home/ubuntu/actions-runner | |
| assign-public-ip-to-instance: "true" | |
| is-spot-instance: "false" | |
| key-name: github-runner-keypair | |
| aws-resource-tags: '[{"Key":"Feature", "Value":"Continuous Integration"},{"Key":"Repository", "Value":"${{ github.repository }}"}]' | |
| build: | |
| needs: start-runner # required to start the main job when the runner is ready | |
| runs-on: ${{ needs.start-runner.outputs.label }} # run the job on the newly created runner | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v3 | |
| - name: Set up JDK 17 | |
| uses: actions/setup-java@v3 | |
| with: | |
| java-version: '17' | |
| distribution: 'temurin' | |
| - name: Run Postgres | |
| run: | | |
| docker compose -f docker-compose.yml up -d pg | |
| - name: Build with Gradle | |
| uses: gradle/gradle-build-action@v2.4.2 | |
| with: | |
| gradle-version: '8.5' | |
| arguments: build | |
| - name: Upload JaCoCo coverage report as a workflow artifact | |
| uses: actions/upload-artifact@v3 | |
| with: | |
| name: jacoco-report | |
| path: build/jacoco/test/jacocoTestReport.csv | |
| - name: Install and configure AWS CLI | |
| if: ${{ !startsWith(github.ref, 'refs/pull/') }} | |
| shell: bash | |
| env: | |
| aws_access_key_id: ${{ secrets.ECR_PUSH_USER_AWS_ACCESS_KEY_ID }} | |
| aws_secret_access_key: ${{ secrets.ECR_PUSH_USER_AWS_SECRET_ACCESS_KEY }} | |
| aws_region: ${{ secrets.ECR_PUSH_USER_AWS_REGION }} | |
| run: | | |
| sudo apt-get update && sudo apt-get -y install awscli | |
| aws configure set aws_access_key_id $aws_access_key_id | |
| aws configure set aws_secret_access_key $aws_secret_access_key | |
| aws configure set default.region $aws_region | |
| - name: Build Fat Jar | |
| if: ${{ steps.check-commit-already-built-and-pushed.outputs.count == 0 && !startsWith(github.ref, 'refs/pull/') }} | |
| uses: gradle/gradle-build-action@v2.4.2 | |
| with: | |
| arguments: shadowJar | |
| - name: Extract branch name | |
| shell: bash | |
| run: echo "branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" >> $GITHUB_OUTPUT | |
| id: extract_branch | |
| - name: Login to Amazon ECR | |
| id: login-ecr | |
| uses: aws-actions/amazon-ecr-login@v2 | |
| - name: Build, tag and push docker image to Amazon ECR | |
| env: | |
| REGISTRY: ${{ steps.login-ecr.outputs.registry }} | |
| REPOSITORY: ${{ github.repository }} | |
| IMAGE_TAG: ${{ github.sha }} | |
| BRANCH: ${{ steps.extract_branch.outputs.branch }} | |
| run: | | |
| repository=$(echo $REPOSITORY | cut -d '/' -f2) | |
| docker build -t $REGISTRY/$repository:$IMAGE_TAG -f kubernetes/Dockerfile . | |
| docker tag $REGISTRY/$repository:$IMAGE_TAG $REGISTRY/$repository:$BRANCH | |
| docker push $REGISTRY/$repository:$IMAGE_TAG | |
| docker push $REGISTRY/$repository:$BRANCH | |
| stop-runner: | |
| name: Stop self-hosted EC2 runner | |
| needs: | |
| - start-runner # required to get output from the start-runner job | |
| - build # required to wait when the main job is done | |
| runs-on: ubuntu-latest | |
| if: ${{ always() }} # required to stop the runner even if the error happened in the previous jobs | |
| steps: | |
| - name: Configure AWS credentials | |
| uses: aws-actions/configure-aws-credentials@v3 | |
| with: | |
| aws-access-key-id: ${{ secrets.RUNNER_MANAGER_AWS_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ secrets.RUNNER_MANAGER_AWS_SECRET_ACCESS_KEY }} | |
| aws-region: ${{ secrets.RUNNER_MANAGER_AWS_REGION }} | |
| - name: Stop EC2 runner | |
| uses: TogaiHQ/ec2-github-runner@main | |
| with: | |
| mode: stop | |
| github-token: ${{ secrets.RUNNER_MANAGER_GH_PERSONAL_ACCESS_TOKEN }} | |
| label: ${{ needs.start-runner.outputs.label }} | |
| ec2-instance-id: ${{ needs.start-runner.outputs.ec2-instance-id }} | |
| commit-badge: | |
| runs-on: ubuntu-latest | |
| needs: build | |
| steps: | |
| - name: Extract branch name | |
| shell: bash | |
| run: | | |
| TMP_PULL_HEAD_REF="${{ github.head_ref }}" | |
| TMP_GITHUB_REF="${GITHUB_REF#refs/heads/}" | |
| EXPORT_VALUE="" | |
| if [ "${TMP_PULL_HEAD_REF}" != "" ] | |
| then | |
| EXPORT_VALUE="${TMP_PULL_HEAD_REF}" | |
| else | |
| EXPORT_VALUE="${TMP_GITHUB_REF}" | |
| fi | |
| echo "##[set-output name=branch;]${EXPORT_VALUE}" | |
| id: extract_branch | |
| - uses: actions/checkout@v3 | |
| with: | |
| ref: badges | |
| path: badges | |
| - uses: actions/download-artifact@v3 | |
| with: | |
| name: jacoco-report | |
| - name: Generate JaCoCo badge | |
| id: jacoco | |
| uses: cicirello/jacoco-badge-generator@v2 | |
| with: | |
| jacoco-csv-file: jacocoTestReport.csv | |
| badges-directory: badges/${{ steps.extract_branch.outputs.branch }} | |
| generate-branches-badge: true | |
| - name: Log coverage percentages to workflow output | |
| run: | | |
| echo "coverage = ${{ steps.jacoco.outputs.coverage }}" | |
| echo "branches = ${{ steps.jacoco.outputs.branches }}" | |
| - name: Commit badge | |
| env: | |
| BRANCH: ${{ steps.extract_branch.outputs.branch }} | |
| run: | | |
| pushd badges | |
| git config --local user.email "action@github.com" | |
| git config --local user.name "GitHub Action" | |
| git add "${BRANCH}" | |
| # Will give error if badge did not changed | |
| git commit -m "Add/Update badge" || true | |
| popd | |
| - name: Push badge commit | |
| uses: ad-m/github-push-action@master | |
| if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }} | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| branch: badges | |
| force: true | |
| directory: badges |