feat: change service type to LoadBalancer for demo external access #10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI/CD Pipeline | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - develop | |
| - 'feature/**' | |
| paths: | |
| - 'infrastructure/**' | |
| - 'kubernetes/**' | |
| - 'helm-charts/**' | |
| - '**.tf' | |
| - '**.tfvars' | |
| - '**.yaml' | |
| - '**.yml' | |
| - '.github/workflows/ci.yml' | |
| - 'Makefile' | |
| pull_request: | |
| branches: | |
| - main | |
| - develop | |
| paths: | |
| - 'infrastructure/**' | |
| - 'kubernetes/**' | |
| - 'helm-charts/**' | |
| - '**.tf' | |
| - '**.tfvars' | |
| - '**.yaml' | |
| - '**.yml' | |
| - '.github/workflows/ci.yml' | |
| - 'Makefile' | |
| jobs: | |
| # Job 1: Terraform validation and formatting | |
| terraform: | |
| name: Terraform | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: infrastructure | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Terraform | |
| uses: hashicorp/setup-terraform@v3 | |
| with: | |
| terraform_version: '1.9.0' | |
| cli_config_credentials_token: ${{ secrets.TF_CLOUD_TOKEN }} | |
| - name: Terraformfmt | |
| run: terraform fmt -check -recursive | |
| continue-on-error: false | |
| - name: Terraform Init | |
| run: terraform init -backend=false # Don't use remote state in CI | |
| - name: Terraform Validate | |
| run: terraform validate | |
| - name: Terraform Plan | |
| run: terraform plan -detailed-exitcode | |
| env: | |
| TF_VAR_aws_region: ap-southeast-2 | |
| TF_VAR_project_name: gitops-demo-ci | |
| TF_VAR_environment: ci | |
| continue-on-error: true # Allow plan to fail (no changes is still success) | |
| - name: Checkov Security Scan | |
| uses: bridgecrewio/checkov-action@master | |
| with: | |
| directory: . | |
| framework: terraform | |
| skip_check: CKV_AWS_33 # Example: skip specific check if needed | |
| continue-on-error: true # Don't fail build on checkov warnings | |
| - name: Terraform Security Scan (tfsec) | |
| uses: aquasecurity/tfsec-action@master | |
| with: | |
| format: sarif | |
| output: tfsec.sarif | |
| continue-on-error: true | |
| - name: Upload SARIF file | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: tfsec.sarif | |
| continue-on-error: true | |
| # Job 2: Kubernetes manifest validation | |
| kubernetes: | |
| name: Kubernetes Manifests | |
| runs-on: ubuntu-latest | |
| needs: terraform | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Kubeval | |
| run: | | |
| curl -sSL https://github.com/instrumenta/kubeval/releases/latest/download/kubeval-linux-amd64.tar.gz | tar -xz | |
| sudo mv kubeval /usr/local/bin/ | |
| - name: Validate Kustomize manifests | |
| run: | | |
| find kubernetes/overlays -name "kustomization.yaml" -print0 | while IFS= read -r -d '' f; do | |
| echo "Validating $(dirname "$f")" | |
| kubectl kustomize "$(dirname "$f")" | kubeval --strict --ignore-missing-schemas | |
| done | |
| - name: Validate Helm charts | |
| run: | | |
| helm lint helm-charts/demo-app | |
| - name: Check YAML syntax | |
| run: | | |
| find kubernetes/ helm-charts/ namespaces/ argocd/ -name "*.yaml" -exec yamllint {} \; | |
| continue-on-error: true | |
| # Job 3: Docker image build (optional) | |
| docker: | |
| name: Docker Build | |
| runs-on: ubuntu-latest | |
| needs: [terraform, kubernetes] | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Build Docker image | |
| run: | | |
| # Build demo app Dockerfile if it exists | |
| if [ -f "docker/Dockerfile" ]; then | |
| docker build -t demo-app:${{ github.sha }} docker/ | |
| else | |
| echo "No Dockerfile found, skipping build" | |
| fi | |
| - name: Scan with Trivy | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: demo-app:${{ github.sha }} | |
| format: sarif | |
| output: trivy-results.sarif | |
| continue-on-error: true | |
| - name: Upload Trivy scan results | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: trivy-results.sarif | |
| continue-on-error: true | |
| # Job 4: Deploy to dev (on push to main) | |
| deploy-dev: | |
| name: Deploy to Dev | |
| runs-on: ubuntu-latest | |
| needs: [terraform, kubernetes, docker] | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| environment: development | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup kubectl | |
| uses: azure/setup-kubectl@v3 | |
| with: | |
| version: 'v1.33.0' | |
| - name: Configure kubeconfig | |
| run: | | |
| # This would require AWS credentials and EKS cluster info | |
| # aws eks update-kubeconfig --region ap-southeast-2 --name gitops-eks | |
| echo "Dev deployment would happen here with Argo CD or kubectl" | |
| echo "Make sure Argo CD is set up and repository is accessible" | |
| # Option 1: Argo CD sync via CLI | |
| # - name: Sync Argo CD app | |
| # run: | | |
| # argocd app sync demo-app-dev --prune | |
| # Option 2: Direct kubectl apply (not recommended for prod) | |
| # - name: Apply manifests | |
| # run: | | |
| # kubectl apply -k kubernetes/overlays/dev | |
| # Job 5: Security scanning | |
| security: | |
| name: Security Scan | |
| runs-on: ubuntu-latest | |
| needs: [terraform, kubernetes] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Run TruffleHog OSS on entire repo | |
| uses: trufflesecurity/trufflehog@main | |
| with: | |
| path: ./ | |
| base: ${{ github.event.before }} | |
| head: HEAD | |
| - name: Run GitLeaks | |
| uses: zricethezav/gitleaks-action@v2 | |
| continue-on-error: true | |
| - name: Run Checkov | |
| uses: bridgecrewio/checkov-action@master | |
| with: | |
| directory: . | |
| framework: terraform,kubernetes | |
| output_format: sarif | |
| container_user: 0 | |
| - name: Upload SARIF | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: checkov/results.sarif | |
| continue-on-error: true |