willemjanandClaude Sonnet 5
7379f6be8c
@master resolves to a version that installs Trivy via a nested setup-trivy composite action, which does an actions/checkout against github.com with a token. On Gitea's act_runner that fails with "Input required and not supplied: token" even when the token is explicitly set to an empty string (act_runner doesn't distinguish empty from unset). v0.26.0 introduced that composite/setup-trivy split; v0.25.0 is the last release that ships as a self-contained Docker image with Trivy already baked in, so it needs no token at all. Co-Authored-By: Claude Sonnet 5 <[email protected]>
95 lines
3.6 KiB
YAML
95 lines
3.6 KiB
YAML
name: CI/CD
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
# ---------------------------------------------------------------------
|
|
# 1. Unit tests — moeten slagen voordat er iets gebouwd wordt
|
|
# ---------------------------------------------------------------------
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
- name: Installeer dependencies
|
|
run: pip install -r requirements.txt
|
|
- name: Lint (ruff)
|
|
run: ruff check .
|
|
- name: Unit tests (pytest)
|
|
run: pytest tests/ -v
|
|
|
|
# ---------------------------------------------------------------------
|
|
# 2. SonarQube — codekwaliteit-gate
|
|
# ---------------------------------------------------------------------
|
|
sonarqube:
|
|
runs-on: ubuntu-latest
|
|
needs: test
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0 # SonarQube wil de volledige git-historie zien
|
|
- name: SonarQube scan
|
|
uses: sonarsource/sonarqube-scan-action@v6
|
|
env:
|
|
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
|
|
SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }}
|
|
|
|
# ---------------------------------------------------------------------
|
|
# 3. Image bouwen + Trivy security-scan + naar Gitea-registry pushen
|
|
# ---------------------------------------------------------------------
|
|
build-and-scan:
|
|
runs-on: ubuntu-latest
|
|
needs: [test, sonarqube]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Build Docker image
|
|
run: docker build -t gitea.zb-kw.duckdns.org/willemjan/glucose-dashboard:${{ gitea.sha }} .
|
|
|
|
- name: Trivy scan
|
|
# Gepind op de laatste Docker-gebaseerde release: vanaf v0.26.0 installeert
|
|
# deze action Trivy via een los 'setup-trivy'-composite-action dat zelf een
|
|
# actions/checkout met een GitHub-token doet. Op act_runner (Gitea) faalt
|
|
# dat met "Input required and not supplied: token" — ook met een expliciet
|
|
# lege token-setup-trivy-input, want act_runner onderscheidt "leeg" niet
|
|
# van "niet meegegeven". v0.25.0 draait als kant-en-klare Docker-image en
|
|
# heeft dat probleem niet.
|
|
uses: aquasecurity/[email protected]
|
|
with:
|
|
image-ref: gitea.zb-kw.duckdns.org/willemjan/glucose-dashboard:${{ gitea.sha }}
|
|
format: table
|
|
exit-code: "1" # laat de pipeline falen bij kritieke kwetsbaarheden
|
|
ignore-unfixed: true
|
|
vuln-type: os,library
|
|
severity: CRITICAL,HIGH
|
|
|
|
- name: Login bij Gitea-registry
|
|
run: echo "${{ secrets.GLUCOSE_TOKEN }}" | docker login gitea.zb-kw.duckdns.org -u willemjan --password-stdin
|
|
|
|
- name: Tag en push
|
|
run: |
|
|
docker tag gitea.zb-kw.duckdns.org/willemjan/glucose-dashboard:${{ gitea.sha }} gitea.zb-kw.duckdns.org/willemjan/glucose-dashboard:latest
|
|
docker push gitea.zb-kw.duckdns.org/willemjan/glucose-dashboard:${{ gitea.sha }}
|
|
docker push gitea.zb-kw.duckdns.org/willemjan/glucose-dashboard:latest
|
|
|
|
# ---------------------------------------------------------------------
|
|
# 4. Deploy — SSH naar de LXC en herstart met de nieuwe image
|
|
# ---------------------------------------------------------------------
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
needs: build-and-scan
|
|
steps:
|
|
- name: Deploy via SSH
|
|
uses: appleboy/ssh-action@v1
|
|
with:
|
|
host: ${{ secrets.DEPLOY_HOST }}
|
|
username: ${{ secrets.DEPLOY_USER }}
|
|
key: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
script: |
|
|
cd /opt/glucose-dashboard
|
|
docker compose pull
|
|
docker compose up -d
|