diff --git a/.github/workflows/cicd.yml b/.github/workflows/cicd.yml index 0cea9618..3e8f3360 100644 --- a/.github/workflows/cicd.yml +++ b/.github/workflows/cicd.yml @@ -1,153 +1,19 @@ -name: CICD Pipeline - +name: Automated deploy for Dev environment on: - push: - branches: [ "main" ] + pull_request_review: + types: [submitted] jobs: compile: - runs-on: self-hosted - - steps: - - uses: actions/checkout@v4 - - name: Set up JDK 17 - uses: actions/setup-java@v4 - with: - java-version: '17' - distribution: 'temurin' - cache: maven - - name: Build with Maven - run: mvn compile - - security-check: - runs-on: self-hosted - needs: compile - - steps: - - uses: actions/checkout@v4 - - name: Trivy Installation - run: | - sudo apt-get install -y wget apt-transport-https gnupg lsb-release - wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add - - echo deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main | sudo tee -a /etc/apt/sources.list.d/trivy.list - sudo apt-get update -y - sudo apt-get install -y trivy - - - name: Trivy FS Scan - run: trivy fs --format table -o fs-report.json . - - - name: Gitleaks Installation - run: sudo apt install gitleaks -y - - name: Gitleaks Code Scan - run: gitleaks detect source . -r gitleaks-report.json -f json + runs-on: ubuntu-latest - test: - runs-on: self-hosted - needs: security-check steps: - - uses: actions/checkout@v4 - - name: Set up JDK 17 - uses: actions/setup-java@v4 - with: - java-version: '17' - distribution: 'temurin' - cache: maven - - name: Unit Test Cases - run: mvn test - - build_project_and_sonar_scan: - runs-on: self-hosted - needs: test - steps: - - uses: actions/checkout@v4 - - name: Set up JDK 17 - uses: actions/setup-java@v4 - with: - java-version: '17' - distribution: 'temurin' - cache: maven - - name: Build Project - run: mvn package - - name: Upload JAR artifact - uses: actions/upload-artifact@v4 - with: - name: app-jar - path: target/*.jar - - - uses: actions/checkout@v4 - with: - # Disabling shallow clones is recommended for improving the relevancy of reporting - fetch-depth: 0 - - name: SonarQube Scan - uses: SonarSource/sonarqube-scan-action@v5.0.0 # Ex: v4.1.0, See the latest version at https://github.com/marketplace/actions/official-sonarqube-scan - env: - SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} - SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }} - - - name: SonarQube Quality Gate check - id: sonarqube-quality-gate-check - uses: sonarsource/sonarqube-quality-gate-action@master - with: - pollingTimeoutSec: 600 - env: - SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} - SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }} - - buils_docker_image_and_push: - runs-on: self-hosted - needs: build_project_and_sonar_scan - steps: - - uses: actions/checkout@v4 - - name: Download JAR artifact - uses: actions/download-artifact@v4 - with: - name: app-jar - path: app # this will download JAR to ./app folder - - - name: Login to Docker Hub - uses: docker/login-action@v3 - with: - username: ${{ vars.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} - - name: Set up QEMU - uses: docker/setup-qemu-action@v3 - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - name: Build and Push Docker image - uses: docker/build-push-action@v6 - with: - context: . - push: true - tags: adijaiswal/bankapp:latest - file: ./Dockerfile - - deploy_to_kubernetes: - runs-on: self-hosted - needs: buils_docker_image_and_push - steps: - - name: Checkout Code - uses: actions/checkout@v4 - - name: Install AWS CLI - run: | - curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" - unzip awscliv2.zip - sudo ./aws/install - - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v2 - with: - aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} - aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - aws-region: ap-south-1 - - name: Set up kubectl - uses: azure/setup-kubectl@v3 - with: - version: latest - - name: Configure kubeconfig - run: | - mkdir -p $HOME/.kube - echo "${{ secrets.EKS_KUBECONFIG }}" > $HOME/.kube/config - - name: Deploy to EKS - run: | - kubectl apply -f ds.yml - - + - uses: actions/checkout@v4 + - name: Set up JDK 17 + uses: actions/setup-java@v4 + with: + java-version: '17' + distribution: 'temurin' + cache: maven + - name: Build with Maven + run: mvn -B package --file pom.xml diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml new file mode 100644 index 00000000..0947abf1 --- /dev/null +++ b/.github/workflows/sonar.yml @@ -0,0 +1,28 @@ +name: sonarscan + +on: + workflow_dispatch: + inputs: + branch: + description: 'Branch to build from' + required: true + default: 'develop' + +jobs: + Checkout: + runs-on: sdvtc-runner + steps: + - name: Checkout Source Code + uses: actions/checkout@v4 + with: + ref: ${{ inputs.branch }} + + - name: Build Source + run: | + echo "Building in environment from branch ${{ inputs.branch }}" + + - name: Official SonarQube Scan + uses: SonarSource/sonarqube-scan-action@v2.3.0 + env: + SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} + SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }}