willemjanandClaude Sonnet 5
e0d6b79e68
gitea.zb.local resolves but is plain HTTP, which Docker refuses as a registry without daemon-level insecure-registry config. gitea.zb.lan resolves but nothing answers there yet (proxy not configured for it). gitea.zb-kw.duckdns.org is confirmed reachable end-to-end over HTTPS, including the registry v2 API, from both the runner and the deploy target, so use that consistently. Also fix aquasecurity/trivy-action's token-setup-trivy input, which defaults to gitea.token and gets rejected by github.com when it tries to clone the install script. Co-Authored-By: Claude Sonnet 5 <[email protected]>
89 lines
3.3 KiB
YAML
89 lines
3.3 KiB
YAML
name: CI/CD
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
# ---------------------------------------------------------------------
|
|
# 1. Unit tests — moeten slagen voordat er iets gebouwd wordt
|
|
# ---------------------------------------------------------------------
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
- name: Installeer dependencies
|
|
run: pip install -r requirements.txt
|
|
- name: Lint (ruff)
|
|
run: ruff check .
|
|
- name: Unit tests (pytest)
|
|
run: pytest tests/ -v
|
|
|
|
# ---------------------------------------------------------------------
|
|
# 2. SonarQube — codekwaliteit-gate
|
|
# ---------------------------------------------------------------------
|
|
sonarqube:
|
|
runs-on: ubuntu-latest
|
|
needs: test
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0 # SonarQube wil de volledige git-historie zien
|
|
- name: SonarQube scan
|
|
uses: sonarsource/sonarqube-scan-action@v6
|
|
env:
|
|
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
|
|
SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }}
|
|
|
|
# ---------------------------------------------------------------------
|
|
# 3. Image bouwen + Trivy security-scan + naar Gitea-registry pushen
|
|
# ---------------------------------------------------------------------
|
|
build-and-scan:
|
|
runs-on: ubuntu-latest
|
|
needs: [test, sonarqube]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Build Docker image
|
|
run: docker build -t gitea.zb-kw.duckdns.org/willemjan/glucose-dashboard:${{ gitea.sha }} .
|
|
|
|
- name: Trivy scan
|
|
uses: aquasecurity/trivy-action@master
|
|
with:
|
|
image-ref: gitea.zb-kw.duckdns.org/willemjan/glucose-dashboard:${{ gitea.sha }}
|
|
severity: CRITICAL,HIGH
|
|
exit-code: "1" # laat de pipeline falen bij kritieke kwetsbaarheden
|
|
# gitea.token is geen geldig GitHub-token; leeg laten zodat setup-trivy
|
|
# de aquasecurity/trivy-repo anoniem kan clonen in plaats van een
|
|
# ongeldige Authorization-header naar github.com te sturen.
|
|
token-setup-trivy: ""
|
|
|
|
- name: Login bij Gitea-registry
|
|
run: echo "${{ secrets.GLUCOSE_TOKEN }}" | docker login gitea.zb-kw.duckdns.org -u willemjan --password-stdin
|
|
|
|
- name: Tag en push
|
|
run: |
|
|
docker tag gitea.zb-kw.duckdns.org/willemjan/glucose-dashboard:${{ gitea.sha }} gitea.zb-kw.duckdns.org/willemjan/glucose-dashboard:latest
|
|
docker push gitea.zb-kw.duckdns.org/willemjan/glucose-dashboard:${{ gitea.sha }}
|
|
docker push gitea.zb-kw.duckdns.org/willemjan/glucose-dashboard:latest
|
|
|
|
# ---------------------------------------------------------------------
|
|
# 4. Deploy — SSH naar de LXC en herstart met de nieuwe image
|
|
# ---------------------------------------------------------------------
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
needs: build-and-scan
|
|
steps:
|
|
- name: Deploy via SSH
|
|
uses: appleboy/ssh-action@v1
|
|
with:
|
|
host: ${{ secrets.DEPLOY_HOST }}
|
|
username: ${{ secrets.DEPLOY_USER }}
|
|
key: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
script: |
|
|
cd /opt/glucose-dashboard
|
|
docker compose pull
|
|
docker compose up -d
|