118 lines
4.1 KiB
YAML
118 lines
4.1 KiB
YAML
name: CD - Production
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
build-and-deploy:
|
|
runs-on: production
|
|
env:
|
|
GIT_SSL_NO_VERIFY: "true"
|
|
MAVEN_OPTS: "-Dmaven.wagon.http.ssl.insecure=true -Dmaven.wagon.http.ssl.allowall=true"
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Verify toolchain
|
|
run: java -version && mvn -version && trivy --version
|
|
|
|
- name: Clean runner disk
|
|
run: docker system prune -f 2>/dev/null || true
|
|
|
|
- name: Configure Maven settings
|
|
run: |
|
|
mkdir -p ~/.m2
|
|
cat > ~/.m2/settings.xml << EOF
|
|
<settings>
|
|
<servers>
|
|
<server>
|
|
<id>gitea</id>
|
|
<username>hiveiq</username>
|
|
<password>${{ secrets.MAVEN_TOKEN }}</password>
|
|
</server>
|
|
</servers>
|
|
<mirrors>
|
|
<mirror>
|
|
<id>maven-default-http-blocker</id>
|
|
<mirrorOf>dummy</mirrorOf>
|
|
<name>Disabled</name>
|
|
<url>http://0.0.0.0/</url>
|
|
<blocked>true</blocked>
|
|
</mirror>
|
|
</mirrors>
|
|
<profiles>
|
|
<profile>
|
|
<id>gitea-registry</id>
|
|
<repositories>
|
|
<repository>
|
|
<id>gitea</id>
|
|
<url>https://hiveiq-gitea.directlx.dev/api/packages/hiveops/maven</url>
|
|
<releases><enabled>true</enabled></releases>
|
|
<snapshots><enabled>false</enabled></snapshots>
|
|
</repository>
|
|
</repositories>
|
|
</profile>
|
|
</profiles>
|
|
<activeProfiles>
|
|
<activeProfile>gitea-registry</activeProfile>
|
|
</activeProfiles>
|
|
</settings>
|
|
EOF
|
|
|
|
- name: Build JAR
|
|
run: mvn clean package -DskipTests -B
|
|
|
|
- name: Trivy vulnerability scan
|
|
run: |
|
|
trivy fs \
|
|
--exit-code 1 \
|
|
--severity HIGH,CRITICAL \
|
|
--ignore-unfixed \
|
|
--scanners vuln \
|
|
--skip-db-update \
|
|
--format table \
|
|
target/
|
|
|
|
- name: OWASP Dependency Check
|
|
run: |
|
|
if [ ! -d /opt/owasp-data ]; then
|
|
echo "::warning::OWASP local NVD data not found on this runner — skipping scan"
|
|
exit 0
|
|
fi
|
|
cp -r /opt/owasp-data /tmp/owasp-data
|
|
mvn org.owasp:dependency-check-maven:check \
|
|
-DfailBuildOnCVSS=7 \
|
|
-DautoUpdate=false \
|
|
-DdataDirectory=/tmp/owasp-data \
|
|
-DsuppressionFile=deployment/owasp-suppressions.xml \
|
|
-DassemblyAnalyzerEnabled=false \
|
|
-Dformats=HTML,JSON \
|
|
-B
|
|
|
|
- name: Build and push Docker image
|
|
run: |
|
|
echo "${{ secrets.REGISTRY_PASSWORD }}" | \
|
|
docker login ${{ secrets.REGISTRY_URL }} \
|
|
-u ${{ secrets.REGISTRY_USERNAME }} --password-stdin
|
|
SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
|
|
docker build \
|
|
-t ${{ secrets.REGISTRY_URL }}/hiveiq-aria:latest \
|
|
-t ${{ secrets.REGISTRY_URL }}/hiveiq-aria:${SHORT_SHA} .
|
|
docker push ${{ secrets.REGISTRY_URL }}/hiveiq-aria:latest
|
|
docker push ${{ secrets.REGISTRY_URL }}/hiveiq-aria:${SHORT_SHA}
|
|
|
|
- name: Notify Slack
|
|
if: always() && github.ref_name == 'main'
|
|
run: |
|
|
STATUS="${{ job.status }}"
|
|
[ "$STATUS" = "success" ] && COLOR="good" || COLOR="danger"
|
|
SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
|
|
RUN_URL="https://hiveiq-gitea.directlx.dev/hiveiq-src/hiveops-aria/actions/runs/${{ github.run_id }}"
|
|
curl -s -X POST "${{ secrets.SLACK_PROD_WEBHOOK_URL }}" \
|
|
-H "Content-Type: application/json" \
|
|
-d "{\"attachments\":[{\"color\":\"$COLOR\",\"text\":\"*<$RUN_URL|hiveops-aria CD Production — $STATUS>*\\n${{ github.ref_name }} · $SHORT_SHA · ${{ github.actor }}\",\"mrkdwn_in\":[\"text\"],\"footer\":\"Gitea Actions\"}]}"
|