Skip to content
name: Build and Deploy Production
on:
release:
types: [ released ]
jobs:
build-production:
name: Build production ${{ github.event.release.tag_name }}
uses: mlibrary/platform-engineering-workflows/.github/workflows/build-production.yml@v1
with:
image_name: ${{ vars.IMAGE_NAME }}
tag: ${{ github.event.release.tag_name }}
dockerfile: Dockerfile
secrets: inherit
#scan-image:
#needs: build-production
#runs-on: ubuntu-latest
#steps:
#- name: Run Trivy vulnerability scanner
#uses: aquasecurity/trivy-action@master
#with:
#image-ref: ghcr.io/mlibrary/${{ vars.IMAGE_NAME }}:${{ github.event.release.tag_name }}
#format: 'table'
#exit-code: '1'
#ignore-unfixed: true
#vuln-type: 'os,library'
#severity: 'CRITICAL,HIGH'
#skip-files: '/gems/ruby/3.2.0/gems/openid_connect-2.2.0/spec/mock_response/public_keys/private_key.pem'
deploy-production:
needs: build-production
name: Deploy to production
uses: mlibrary/platform-engineering-workflows/.github/workflows/deploy.yml@v1
with:
image: ghcr.io/mlibrary/${{ vars.IMAGE_NAME }}:${{ github.event.release.tag_name }}
file: environments/get-this/production/web-image.txt
CONFIG_REPO_RW_APP_ID: ${{ vars.CONFIG_REPO_RW_APP_ID }}
CONFIG_REPO_RW_INSTALL_ID: ${{ vars.CONFIG_REPO_RW_INSTALL_ID }}
CONFIG_REPO_FULL_NAME: ${{ vars.CONFIG_REPO_FULL_NAME }}
secrets: inherit