Skip to content
This repository was archived by the owner on Feb 12, 2026. It is now read-only.

Commit b66ec4b

Browse files
danpasecinicdanpasecinic
authored
ci: add multiple workflows (#12)
1 parent 4f73c93 commit b66ec4b

9 files changed

Lines changed: 1263 additions & 0 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "gomod"
4+
directory: "/"
5+
schedule:
6+
interval: "weekly"
7+
day: "monday"
8+
time: "09:00"
9+
open-pull-requests-limit: 10
10+
labels:
11+
- "dependencies"
12+
- "go"
13+
commit-message:
14+
prefix: "chore(deps)"
15+
include: "scope"
16+
reviewers:
17+
- "danpasecinic"
18+
groups:
19+
minor-and-patch:
20+
patterns:
21+
- "*"
22+
update-types:
23+
- "minor"
24+
- "patch"
25+
26+
- package-ecosystem: "github-actions"
27+
directory: "/"
28+
schedule:
29+
interval: "weekly"
30+
day: "monday"
31+
time: "09:00"
32+
open-pull-requests-limit: 5
33+
labels:
34+
- "dependencies"
35+
- "github-actions"
36+
commit-message:
37+
prefix: "chore(ci)"
38+
include: "scope"
39+
40+
- package-ecosystem: "docker"
41+
directory: "/"
42+
schedule:
43+
interval: "weekly"
44+
day: "monday"
45+
time: "09:00"
46+
open-pull-requests-limit: 5
47+
labels:
48+
- "dependencies"
49+
- "docker"
50+
commit-message:
51+
prefix: "chore(docker)"
52+
include: "scope"

‎.github/labeler.yml‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
'component: master':
2+
- changed-files:
3+
- any-glob-to-any-file:
4+
- 'cmd/master/**'
5+
- 'internal/master/**'
6+
7+
'component: worker':
8+
- changed-files:
9+
- any-glob-to-any-file:
10+
- 'cmd/worker/**'
11+
- 'internal/worker/**'
12+
13+
'component: cli':
14+
- changed-files:
15+
- any-glob-to-any-file:
16+
- 'cmd/podling/**'
17+
- 'internal/cli/**'
18+
19+
'area: api':
20+
- changed-files:
21+
- any-glob-to-any-file:
22+
- '**/api/**'
23+
- '**/*handler*.go'
24+
25+
'area: storage':
26+
- changed-files:
27+
- any-glob-to-any-file:
28+
- 'internal/master/state/**'
29+
- '**/migrations/**'
30+
31+
'area: scheduler':
32+
- changed-files:
33+
- any-glob-to-any-file:
34+
- 'internal/master/scheduler/**'
35+
36+
'area: docker':
37+
- changed-files:
38+
- any-glob-to-any-file:
39+
- 'internal/worker/docker/**'
40+
- 'deployments/docker/**'
41+
- 'Dockerfile*'
42+
- 'docker-compose*.yml'
43+
44+
'area: health':
45+
- changed-files:
46+
- any-glob-to-any-file:
47+
- 'internal/worker/health/**'
48+
- '**/*health*.go'
49+
50+
'area: pods':
51+
- changed-files:
52+
- any-glob-to-any-file:
53+
- '**/*pod*.go'
54+
- '**/pod_*.go'
55+
56+
'area: services':
57+
- changed-files:
58+
- any-glob-to-any-file:
59+
- 'internal/master/services/**'
60+
- '**/*service*.go'
61+
62+
'type: tests':
63+
- changed-files:
64+
- any-glob-to-any-file:
65+
- '**/*_test.go'
66+
- '**/test/**'
67+
- '**/testdata/**'
68+
69+
'type: documentation':
70+
- changed-files:
71+
- any-glob-to-any-file:
72+
- '**/*.md'
73+
- 'docs/**'
74+
- 'CLAUDE.md'
75+
- 'README.md'
76+
77+
'type: dependencies':
78+
- changed-files:
79+
- any-glob-to-any-file:
80+
- 'go.mod'
81+
- 'go.sum'
82+
83+
'type: ci/cd':
84+
- changed-files:
85+
- any-glob-to-any-file:
86+
- '.github/**'
87+
- '.gitignore'
88+
- 'Makefile'
89+
- '.air.toml'
90+
91+
'type: database':
92+
- changed-files:
93+
- any-glob-to-any-file:
94+
- '**/migrations/**'
95+
- '**/*postgres*.go'
96+
- 'docker-compose.yml'
97+
98+
'breaking change':
99+
- changed-files:
100+
- any-glob-to-any-file:
101+
- 'internal/types/**'
102+
- '**/api/v*/**'
103+
104+
'needs review':
105+
- changed-files:
106+
- any-glob-to-any-file:
107+
- 'internal/master/state/**'
108+
- 'internal/worker/agent/**'
109+
- '**/migrations/**'

‎.github/workflows/docker.yml‎

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
name: Docker Build & Push
2+
3+
on:
4+
push:
5+
branches: [ main, development ]
6+
tags:
7+
- 'v*.*.*'
8+
pull_request:
9+
branches: [ main, development ]
10+
workflow_dispatch:
11+
12+
permissions:
13+
contents: read
14+
packages: write
15+
16+
env:
17+
REGISTRY: ghcr.io
18+
IMAGE_NAME_MASTER: ${{ github.repository }}/master
19+
IMAGE_NAME_WORKER: ${{ github.repository }}/worker
20+
21+
jobs:
22+
build-master:
23+
name: Build Master Image
24+
runs-on: ubuntu-latest
25+
steps:
26+
- name: Checkout code
27+
uses: actions/checkout@v4
28+
29+
- name: Set up Docker Buildx
30+
uses: docker/setup-buildx-action@v3
31+
32+
- name: Log in to Container Registry
33+
if: github.event_name != 'pull_request'
34+
uses: docker/login-action@v3
35+
with:
36+
registry: ${{ env.REGISTRY }}
37+
username: ${{ github.actor }}
38+
password: ${{ secrets.GITHUB_TOKEN }}
39+
40+
- name: Extract metadata
41+
id: meta
42+
uses: docker/metadata-action@v5
43+
with:
44+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_MASTER }}
45+
tags: |
46+
type=ref,event=branch
47+
type=ref,event=pr
48+
type=semver,pattern={{version}}
49+
type=semver,pattern={{major}}.{{minor}}
50+
type=semver,pattern={{major}}
51+
type=sha,prefix=sha-
52+
type=raw,value=latest,enable={{is_default_branch}}
53+
54+
- name: Build and push Master image
55+
uses: docker/build-push-action@v6
56+
with:
57+
context: .
58+
file: ./deployments/docker/Dockerfile.master
59+
platforms: linux/amd64,linux/arm64
60+
push: ${{ github.event_name != 'pull_request' }}
61+
tags: ${{ steps.meta.outputs.tags }}
62+
labels: ${{ steps.meta.outputs.labels }}
63+
cache-from: type=gha
64+
cache-to: type=gha,mode=max
65+
build-args: |
66+
VERSION=${{ steps.meta.outputs.version }}
67+
BUILD_DATE=${{ github.event.head_commit.timestamp }}
68+
VCS_REF=${{ github.sha }}
69+
70+
build-worker:
71+
name: Build Worker Image
72+
runs-on: ubuntu-latest
73+
steps:
74+
- name: Checkout code
75+
uses: actions/checkout@v4
76+
77+
- name: Set up Docker Buildx
78+
uses: docker/setup-buildx-action@v3
79+
80+
- name: Log in to Container Registry
81+
if: github.event_name != 'pull_request'
82+
uses: docker/login-action@v3
83+
with:
84+
registry: ${{ env.REGISTRY }}
85+
username: ${{ github.actor }}
86+
password: ${{ secrets.GITHUB_TOKEN }}
87+
88+
- name: Extract metadata
89+
id: meta
90+
uses: docker/metadata-action@v5
91+
with:
92+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_WORKER }}
93+
tags: |
94+
type=ref,event=branch
95+
type=ref,event=pr
96+
type=semver,pattern={{version}}
97+
type=semver,pattern={{major}}.{{minor}}
98+
type=semver,pattern={{major}}
99+
type=sha,prefix=sha-
100+
type=raw,value=latest,enable={{is_default_branch}}
101+
102+
- name: Build and push Worker image
103+
uses: docker/build-push-action@v6
104+
with:
105+
context: .
106+
file: ./deployments/docker/Dockerfile.worker
107+
platforms: linux/amd64,linux/arm64
108+
push: ${{ github.event_name != 'pull_request' }}
109+
tags: ${{ steps.meta.outputs.tags }}
110+
labels: ${{ steps.meta.outputs.labels }}
111+
cache-from: type=gha
112+
cache-to: type=gha,mode=max
113+
build-args: |
114+
VERSION=${{ steps.meta.outputs.version }}
115+
BUILD_DATE=${{ github.event.head_commit.timestamp }}
116+
VCS_REF=${{ github.sha }}
117+
118+
scan-images:
119+
name: Scan Images for Vulnerabilities
120+
needs: [ build-master, build-worker ]
121+
runs-on: ubuntu-latest
122+
if: github.event_name != 'pull_request'
123+
strategy:
124+
matrix:
125+
image: [ master, worker ]
126+
steps:
127+
- name: Log in to Container Registry
128+
uses: docker/login-action@v3
129+
with:
130+
registry: ${{ env.REGISTRY }}
131+
username: ${{ github.actor }}
132+
password: ${{ secrets.GITHUB_TOKEN }}
133+
134+
- name: Run Trivy vulnerability scanner
135+
uses: aquasecurity/trivy-action@master
136+
with:
137+
image-ref: ${{ env.REGISTRY }}/${{ github.repository }}/${{ matrix.image }}:${{ github.ref_name }}
138+
format: 'sarif'
139+
output: 'trivy-${{ matrix.image }}-results.sarif'
140+
severity: 'CRITICAL,HIGH'
141+
142+
- name: Upload Trivy results to GitHub Security
143+
uses: github/codeql-action/upload-sarif@v3
144+
with:
145+
sarif_file: 'trivy-${{ matrix.image }}-results.sarif'
146+
category: 'trivy-${{ matrix.image }}'
147+
148+
summary:
149+
name: Build Summary
150+
needs: [ build-master, build-worker ]
151+
runs-on: ubuntu-latest
152+
if: always()
153+
steps:
154+
- name: Generate summary
155+
run: |
156+
echo "## Docker Build Summary" >> $GITHUB_STEP_SUMMARY
157+
echo "" >> $GITHUB_STEP_SUMMARY
158+
echo "✅ Master image: ${{ needs.build-master.result }}" >> $GITHUB_STEP_SUMMARY
159+
echo "✅ Worker image: ${{ needs.build-worker.result }}" >> $GITHUB_STEP_SUMMARY
160+
echo "" >> $GITHUB_STEP_SUMMARY
161+
if [ "${{ github.event_name }}" != "pull_request" ]; then
162+
echo "Images pushed to: \`${{ env.REGISTRY }}/${{ github.repository }}\`" >> $GITHUB_STEP_SUMMARY
163+
else
164+
echo "PR build - images not pushed" >> $GITHUB_STEP_SUMMARY
165+
fi

0 commit comments

Comments
 (0)