Skip to content

Commit 2c68b62

Browse files
anket-cdanket-cd
committed
feat: add shared workflows for smurf sdkr
1 parent 53128e9 commit 2c68b62

1 file changed

Lines changed: 274 additions & 0 deletions

File tree

‎.github/workflows/smurf-docker.yml‎

Lines changed: 274 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,274 @@
1+
---
2+
name: 🦸‍♂️ Smurf-Docker-Helm
3+
'on':
4+
workflow_call:
5+
inputs:
6+
docker_enable:
7+
description: Set to true to run docker commands
8+
type: string
9+
required: false
10+
aws_auth_method:
11+
description: AWS auth method to use like oidc and keys
12+
type: string
13+
required: false
14+
aws_eks_cluster_name:
15+
description: AWS eks cluster name
16+
type: string
17+
required: false
18+
aws_role:
19+
description: AWS OIDC role for aws authentication.
20+
type: string
21+
default: 'false'
22+
provider:
23+
description: Cloud provider (aws, azure, gcp, digitalocean)
24+
type: string
25+
required: false
26+
default: aws
27+
docker_image_name:
28+
description: Docker image name
29+
type: string
30+
required: false
31+
docker_image_tag:
32+
description: Docker image tag
33+
type: string
34+
default: 'latest'
35+
docker_image_tar:
36+
description: Docker image tar
37+
type: string
38+
required: false
39+
default: image
40+
docker_push:
41+
description: Set true for docker push
42+
type: string
43+
required: false
44+
docker_build_enable:
45+
description: Set true to enable docker build
46+
type: string
47+
required: false
48+
default: 'false'
49+
docker_buildkit_enable:
50+
description: Set true to enable docker buildkit
51+
type: string
52+
required: false
53+
default: 'false'
54+
docker_registry:
55+
description: 'The registry to Push Docker Image (aws, az, gcp, hub)'
56+
type: string
57+
default: aws
58+
docker_registry_url:
59+
description: 'The URL of the container registry (e.g., Docker Hub, ECR, GCR, ACR).'
60+
type: string
61+
dockerfile_path:
62+
description: Docker file directory
63+
type: string
64+
default: Dockerfile
65+
docker_build_args:
66+
description: Docker Build Arguments
67+
type: string
68+
required: false
69+
default: key1=val1
70+
docker_build_platform:
71+
description: Docker Image Build Platform
72+
type: string
73+
default: linux/amd64
74+
aws_region:
75+
required: false
76+
type: string
77+
description: AWS Region
78+
default: 'us-east-1'
79+
aws_assume_role:
80+
description: Set to True to run Assume another IAM Role step
81+
required: false
82+
type: string
83+
default: 'false'
84+
aws_assume_role_arn:
85+
type: string
86+
description: AWS assume role
87+
required: false
88+
gcp_project_id:
89+
required: false
90+
type: string
91+
description: 'ID of the default project to use for future API calls and invocations.'
92+
gcp_auth_method:
93+
description: GCP auth method to use like wip and json
94+
type: string
95+
required: false
96+
gcp_docker_push:
97+
description: Set to True to Push Images in GCP
98+
type: string
99+
required: false
100+
default: 'false'
101+
gcp_region:
102+
required: false
103+
type: string
104+
description: GCP Region
105+
default: 'us-central1'
106+
gcp_gke_cluster_name:
107+
description: GCP gke cluster name
108+
type: string
109+
required: false
110+
111+
secrets:
112+
AWS_ACCESS_KEY_ID:
113+
required: false
114+
description: AWS Access Key ID for direct authentication
115+
AWS_SECRET_ACCESS_KEY:
116+
required: false
117+
description: AWS Secret Access Key for direct authentication
118+
AWS_SESSION_TOKEN:
119+
required: false
120+
description: AWS Session Token for direct authentication
121+
GCP_WIP:
122+
required: false
123+
description: 'WIP Connected with Service Account'
124+
GCP_SERVICE_ACCOUNT:
125+
required: false
126+
description: 'GCP service account'
127+
GOOGLE_CREDENTIALS:
128+
required: false
129+
description: 'GCP service account JSON Key'
130+
GCP_SERVICE_ACCOUNT_KEY:
131+
required: false
132+
description: 'GCP service account JSON Key'
133+
aws_set_parameters:
134+
required: false
135+
description: Overriding the default values using --set flag
136+
137+
jobs:
138+
docker_build:
139+
if: inputs.docker_enable == 'true'
140+
runs-on: ubuntu-latest
141+
permissions:
142+
id-token: write
143+
contents: read
144+
steps:
145+
- name: 📦 Checkout
146+
uses: actions/checkout@v6
147+
148+
- name: setup smurf
149+
uses: clouddrove/smurf@v0.1.3
150+
with:
151+
version: latest
152+
153+
- name: 🐳 Docker Image Build
154+
if: inputs.docker_build_enable != 'true'
155+
run: |
156+
smurf sdkr build ${{ inputs.docker_image_name }}:${{ inputs.docker_image_tag }} -f ${{
157+
inputs.dockerfile_path }} --platform ${{ inputs.docker_build_platform }}
158+
--build-arg ${{ inputs.docker_build_args }}
159+
160+
- name: 🐳 Docker Image Build with Buildkit
161+
if: inputs.docker_buildkit_enable == 'true'
162+
run: |
163+
smurf sdkr build ${{ inputs.docker_image_name }}:${{ inputs.docker_image_tag }} -f ${{
164+
inputs.dockerfile_path }} --platform ${{ inputs.docker_build_platform }}
165+
--build-arg ${{ inputs.docker_build_args }} --buildkit
166+
167+
- name: 💾 Save Docker Image as Artifact
168+
run: >
169+
docker save ${{ inputs.docker_image_name }}:${{ inputs.docker_image_tag }} -o ${{
170+
inputs.docker_image_tar }}
171+
172+
- name: ⬆️ Upload Docker Image Artifact
173+
uses: actions/upload-artifact@v6
174+
with:
175+
name: '${{ inputs.docker_image_name }}'
176+
path: '${{ inputs.docker_image_tar }}'
177+
178+
docker_scan_push:
179+
if: inputs.docker_enable == 'true' && inputs.docker_push == 'true'
180+
runs-on: ubuntu-latest
181+
needs: docker_build
182+
permissions:
183+
id-token: write
184+
contents: read
185+
steps:
186+
- name: 📦 Checkout
187+
uses: actions/checkout@v6
188+
189+
- name: ⬇️ Download Docker Image Artifact
190+
uses: actions/download-artifact@v7
191+
with:
192+
name: '${{ inputs.docker_image_name }}'
193+
194+
- name: 📥 Load Docker Image
195+
run: |
196+
docker load -i ${{ inputs.docker_image_tar }}
197+
198+
- name: 🔑 Configure AWS credentials with OIDC
199+
if: inputs.aws_auth_method == 'oidc'
200+
uses: aws-actions/configure-aws-credentials@v6
201+
with:
202+
role-to-assume: ${{ inputs.aws_role }}
203+
aws-region: ${{ inputs.aws_region }}
204+
205+
- name: 🔄 Assume another IAM Role
206+
if: inputs.aws_assume_role == 'true'
207+
uses: aws-actions/configure-aws-credentials@v6
208+
with:
209+
role-to-assume: ${{ inputs.aws_assume_role_arn }}
210+
aws-region: ${{ inputs.aws_region }}
211+
212+
- name: 🔑 Configure AWS credentials with access keys
213+
if: inputs.aws_auth_method == 'keys'
214+
env:
215+
AWS_ACCESS_KEY_ID: '${{ secrets.AWS_ACCESS_KEY_ID }}'
216+
AWS_SECRET_ACCESS_KEY: '${{ secrets.AWS_SECRET_ACCESS_KEY }}'
217+
AWS_SESSION_TOKEN: '${{ secrets.AWS_SESSION_TOKEN }}'
218+
aws-region: ${{ inputs.aws_region }}
219+
run: |
220+
aws configure set aws_access_key_id $AWS_ACCESS_KEY_ID
221+
aws configure set aws_secret_access_key $AWS_SECRET_ACCESS_KEY
222+
if [[ -n "$AWS_SESSION_TOKEN" ]]; then
223+
aws configure set aws_session_token $AWS_SESSION_TOKEN
224+
fi
225+
aws configure set region $AWS_REGION
226+
227+
- name: ☁️ Authenticate Google Cloud with WIP and Service Account
228+
if: inputs.gcp_auth_method == 'wip'
229+
uses: google-github-actions/auth@v3
230+
with:
231+
token_format: access_token
232+
workload_identity_provider: ${{ secrets.GCP_WIP }}
233+
service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
234+
access_token_lifetime: 300s
235+
project_id: ${{ inputs.gcp_project_id }}
236+
237+
- name: ☁️ Authenticate Google Cloud with Service Account JSON Key
238+
if: inputs.gcp_auth_method == 'json'
239+
uses: 'google-github-actions/auth@v3'
240+
with:
241+
credentials_json: '${{ secrets.GOOGLE_CREDENTIALS }}'
242+
243+
- name: 🛡️ Docker Image Scan
244+
uses: clouddrove/smurf@v1.1.4
245+
with:
246+
tool: sdkr
247+
command: scan ${{ inputs.docker_image_name }}:${{ inputs.docker_image_tag }}
248+
249+
- name: 🏷️ Docker Image Tag
250+
if: inputs.docker_push == 'true'
251+
uses: clouddrove/smurf@v1.1.4
252+
with:
253+
tool: sdkr
254+
command: >-
255+
tag ${{ inputs.docker_image_name }}:${{ inputs.docker_image_tag }} ${{
256+
inputs.docker_registry_url }}/${{ inputs.docker_image_name }}:${{ inputs.docker_image_tag }}
257+
258+
- name: 🚀 Docker Image Push
259+
if: inputs.docker_push == 'true' && inputs.gcp_docker_push != 'true'
260+
uses: clouddrove/smurf@v1.1.4
261+
with:
262+
tool: sdkr
263+
command: >-
264+
push ${{ inputs.docker_registry }} ${{ inputs.docker_registry_url }}/${{ inputs.docker_image_name }}:${{
265+
inputs.docker_image_tag }}
266+
267+
- name: 🚀 Docker Image Push in GCP
268+
if: inputs.docker_push == 'true' && inputs.gcp_docker_push == 'true'
269+
uses: clouddrove/smurf@v1.1.4
270+
with:
271+
tool: sdkr
272+
command: >-
273+
push ${{ inputs.docker_registry }} ${{ inputs.docker_registry_url }}/${{ inputs.docker_image_name }}:${{
274+
inputs.docker_image_tag }} --project-id ${{ inputs.gcp_project_id }}

0 commit comments

Comments
 (0)