Skip to content

Commit e7f5acb

Browse files
author
Anket Satbhai
authored
chore: update smurf shared workflows for Docker, Helm, and Terraform, and update the documentation. (#405)
1 parent f6ef7e5 commit e7f5acb

6 files changed

Lines changed: 1347 additions & 313 deletions

File tree

‎.github/workflows/docker-smurf.yml‎

Lines changed: 89 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,27 @@
11
---
2-
name: 🦸‍♂️ Smurf-Docker
3-
'on':
2+
# Reusable Smurf SDKR workflow — build, scan, and push Docker images.
3+
# Docs: docs/docker-smurf.md
4+
name: 🐳 Smurf-Docker
5+
6+
on:
47
workflow_call:
58
inputs:
9+
# ── General toggles ──────────────────────────────────────────────
610
docker_enable:
711
description: Set to true to run docker commands
812
type: string
913
required: false
10-
aws_auth_method:
11-
description: AWS auth method to use like oidc and keys
12-
type: string
13-
required: false
14-
aws_eks_cluster_name:
15-
description: AWS eks cluster name
14+
docker_push:
15+
description: Set true for docker push
1616
type: string
1717
required: false
18-
aws_role:
19-
description: AWS OIDC role for aws authentication.
20-
type: string
21-
default: 'false'
2218
provider:
2319
description: Cloud provider (aws, azure, gcp, digitalocean)
2420
type: string
2521
required: false
2622
default: aws
23+
24+
# ── Docker image & build ─────────────────────────────────────────
2725
docker_image_name:
2826
description: Docker image name
2927
type: string
@@ -37,15 +35,6 @@ name: 🦸‍♂️ Smurf-Docker
3735
type: string
3836
required: false
3937
default: image
40-
docker_push:
41-
description: Set true for docker push
42-
type: string
43-
required: false
44-
docker_buildkit_enable:
45-
description: Set true to enable docker buildkit
46-
type: string
47-
required: false
48-
default: 'false'
4938
docker_registry:
5039
description: 'The registry to Push Docker Image (aws, az, gcp, hub)'
5140
type: string
@@ -54,7 +43,7 @@ name: 🦸‍♂️ Smurf-Docker
5443
description: 'The URL of the container registry (e.g., Docker Hub, ECR, GCR, ACR).'
5544
type: string
5645
dockerfile_path:
57-
description: Docker file directory
46+
description: Docker file path (relative to repo root)
5847
type: string
5948
default: Dockerfile
6049
docker_build_args:
@@ -66,6 +55,13 @@ name: 🦸‍♂️ Smurf-Docker
6655
description: Docker Image Build Platform
6756
type: string
6857
default: linux/amd64
58+
docker_buildkit_enable:
59+
description: Set true to enable docker buildkit
60+
type: string
61+
required: false
62+
default: 'false'
63+
64+
# ── AWS ──────────────────────────────────────────────────────────
6965
aws_region:
7066
required: false
7167
type: string
@@ -80,6 +76,8 @@ name: 🦸‍♂️ Smurf-Docker
8076
type: string
8177
description: AWS assume role
8278
required: false
79+
80+
# ── GCP ──────────────────────────────────────────────────────────
8381
gcp_project_id:
8482
required: false
8583
type: string
@@ -93,17 +91,9 @@ name: 🦸‍♂️ Smurf-Docker
9391
type: string
9492
required: false
9593
default: 'false'
96-
gcp_region:
97-
required: false
98-
type: string
99-
description: GCP Region
100-
default: 'us-central1'
101-
gcp_gke_cluster_name:
102-
description: GCP gke cluster name
103-
type: string
104-
required: false
10594

10695
secrets:
96+
# ── AWS secrets ──────────────────────────────────────────────────
10797
AWS_ACCESS_KEY_ID:
10898
required: false
10999
description: AWS Access Key ID for direct authentication
@@ -113,6 +103,11 @@ name: 🦸‍♂️ Smurf-Docker
113103
AWS_SESSION_TOKEN:
114104
required: false
115105
description: AWS Session Token for direct authentication
106+
BUILD_ROLE:
107+
required: false
108+
description: AWS OIDC role for aws authentication
109+
110+
# ── GCP secrets ──────────────────────────────────────────────────
116111
GCP_WIP:
117112
required: false
118113
description: 'WIP Connected with Service Account'
@@ -125,11 +120,23 @@ name: 🦸‍♂️ Smurf-Docker
125120
GCP_SERVICE_ACCOUNT_KEY:
126121
required: false
127122
description: 'GCP service account JSON Key'
123+
124+
# ── Docker Hub secrets ───────────────────────────────────────────
125+
DOCKER_USERNAME:
126+
required: false
127+
description: Docker Hub username
128+
DOCKER_PASSWORD:
129+
required: false
130+
description: Docker Hub access token or password
131+
128132
aws_set_parameters:
129133
required: false
130134
description: Overriding the default values using --set flag
131135

132136
jobs:
137+
###############################################
138+
# BUILD → SAVE → UPLOAD ARTIFACT
139+
###############################################
133140
docker_build:
134141
if: inputs.docker_enable == 'true'
135142
runs-on: ubuntu-latest
@@ -140,35 +147,40 @@ jobs:
140147
- name: 📦 Checkout
141148
uses: actions/checkout@v6
142149

143-
# - Setup smurf CLI
144-
- name: Setup Smurf
145-
uses: clouddrove/smurf@v1.1.3
150+
- name: ⚙️ Setup Smurf
151+
uses: clouddrove/smurf@v1.1.5
146152

147153
- name: 🐳 Docker Image Build
148154
if: inputs.docker_buildkit_enable != 'true'
149155
run: |
150-
smurf sdkr build ${{ inputs.docker_image_name }}:${{ inputs.docker_image_tag }} -f ${{
151-
inputs.dockerfile_path }} --platform ${{ inputs.docker_build_platform }}
156+
smurf sdkr build ${{ inputs.docker_image_name }}:${{ inputs.docker_image_tag }} \
157+
-f ${{ inputs.dockerfile_path }} \
158+
--platform ${{ inputs.docker_build_platform }} \
152159
--build-arg ${{ inputs.docker_build_args }}
153160
154161
- name: 🐳 Docker Image Build with Buildkit
155162
if: inputs.docker_buildkit_enable == 'true'
156163
run: |
157-
smurf sdkr build ${{ inputs.docker_image_name }}:${{ inputs.docker_image_tag }} -f ${{
158-
inputs.dockerfile_path }} --platform ${{ inputs.docker_build_platform }}
159-
--build-arg ${{ inputs.docker_build_args }} --buildkit
164+
smurf sdkr build ${{ inputs.docker_image_name }}:${{ inputs.docker_image_tag }} \
165+
-f ${{ inputs.dockerfile_path }} \
166+
--platform ${{ inputs.docker_build_platform }} \
167+
--build-arg ${{ inputs.docker_build_args }} \
168+
--buildkit
160169
161170
- name: 💾 Save Docker Image as Artifact
162-
run: >
163-
docker save ${{ inputs.docker_image_name }}:${{ inputs.docker_image_tag }} -o ${{
164-
inputs.docker_image_tar }}
171+
run: |
172+
docker save ${{ inputs.docker_image_name }}:${{ inputs.docker_image_tag }} \
173+
-o ${{ inputs.docker_image_tar }}
165174
166-
- name: ⬆️ Upload Docker Image Artifact
175+
- name: 📤 Upload Docker Image Artifact
167176
uses: actions/upload-artifact@v7
168177
with:
169-
name: '${{ inputs.docker_image_name }}'
170-
path: '${{ inputs.docker_image_tar }}'
178+
name: docker-image
179+
path: ${{ inputs.docker_image_tar }}
171180

181+
###############################################
182+
# DOWNLOAD → AUTH → SCAN → TAG → PUSH
183+
###############################################
172184
docker_scan_push:
173185
if: inputs.docker_enable == 'true' && inputs.docker_push == 'true'
174186
runs-on: ubuntu-latest
@@ -180,19 +192,18 @@ jobs:
180192
- name: 📦 Checkout
181193
uses: actions/checkout@v6
182194

183-
# - Setup smurf CLI
184-
- name: Setup Smurf
185-
uses: clouddrove/smurf@v1.1.3
195+
- name: ⚙️ Setup Smurf
196+
uses: clouddrove/smurf@v1.1.5
186197

187-
- name: ⬇️ Download Docker Image Artifact
198+
- name: 📥 Download Docker Image Artifact
188199
uses: actions/download-artifact@v8
189200
with:
190-
name: '${{ inputs.docker_image_name }}'
201+
name: docker-image
191202

192-
- name: 📥 Load Docker Image
193-
run: |
194-
docker load -i ${{ inputs.docker_image_tar }}
203+
- name: 📂 Load Docker Image
204+
run: docker load -i ${{ inputs.docker_image_tar }}
195205

206+
# ── Cloud authentication ─────────────────────────────────────────
196207
- name: 🟦 Install AWS CLI
197208
if: ${{ inputs.provider == 'aws' }}
198209
uses: aws-actions/configure-aws-credentials@v6
@@ -205,7 +216,7 @@ jobs:
205216
role-duration-seconds: 900
206217
role-skip-session-tagging: true
207218

208-
- name: 🔄 Assume another IAM Role
219+
- name: 🔑 Assume another IAM Role
209220
if: inputs.aws_assume_role == 'true'
210221
uses: aws-actions/configure-aws-credentials@v6
211222
with:
@@ -224,29 +235,41 @@ jobs:
224235

225236
- name: ☁️ Authenticate Google Cloud with Service Account JSON Key
226237
if: inputs.gcp_auth_method == 'json'
227-
uses: 'google-github-actions/auth@v3'
238+
uses: google-github-actions/auth@v3
228239
with:
229-
credentials_json: '${{ secrets.GOOGLE_CREDENTIALS }}'
240+
credentials_json: ${{ secrets.GOOGLE_CREDENTIALS }}
241+
242+
- name: 🐋 Set Docker Hub environment variables
243+
if: inputs.docker_registry == 'hub'
244+
run: |
245+
echo "DOCKER_USERNAME=${{ secrets.DOCKER_USERNAME }}" >> $GITHUB_ENV
246+
echo "DOCKER_PASSWORD=${{ secrets.DOCKER_PASSWORD }}" >> $GITHUB_ENV
247+
shell: bash
248+
249+
# ── Scan & push ──────────────────────────────────────────────────
250+
- name: 🛡️ Install Trivy
251+
run: |
252+
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
253+
trivy --version
230254
231-
- name: 🛡️ Docker Image Scan
255+
- name: 🔍 Docker Image Scan
232256
run: |
233257
smurf sdkr scan ${{ inputs.docker_image_name }}:${{ inputs.docker_image_tag }}
234258
235259
- name: 🏷️ Docker Image Tag
236260
if: inputs.docker_push == 'true'
237261
run: |
238-
smurf sdkr tag ${{ inputs.docker_image_name }}:${{ inputs.docker_image_tag }} ${{
239-
inputs.docker_registry_url }}/${{ inputs.docker_image_name }}:${{ inputs.docker_image_tag }}
262+
smurf sdkr tag ${{ inputs.docker_image_name }}:${{ inputs.docker_image_tag }} \
263+
${{ inputs.docker_registry_url }}/${{ inputs.docker_image_name }}:${{ inputs.docker_image_tag }}
240264
241265
- name: 🚀 Docker Image Push
242-
if: inputs.docker_push == 'true' && inputs.gcp_docker_push != 'true'
266+
if: inputs.docker_push == 'true' && inputs.gcp_docker_push != 'true'
243267
run: |
244-
smurf sdkr push ${{ inputs.docker_registry }} ${{ inputs.docker_registry_url }}/${{ inputs.docker_image_name }}:${{
245-
inputs.docker_image_tag }}
268+
smurf sdkr push ${{ inputs.docker_registry }} ${{ inputs.docker_registry_url }}/${{ inputs.docker_image_name }}:${{ inputs.docker_image_tag }}
246269
247-
- name: 🚀 Docker Image Push on gcp
270+
- name: 🚀 Docker Image Push on GCP
248271
if: inputs.docker_push == 'true' && inputs.gcp_docker_push == 'true'
249272
run: |
250-
smurf sdkr push ${{ inputs.docker_registry }} ${{ inputs.docker_registry_url }}/${{ inputs.docker_image_name }}:${{
251-
inputs.docker_image_tag }} --project-id ${{ inputs.gcp_project_id }}
252-
...
273+
smurf sdkr push ${{ inputs.docker_registry }} \
274+
${{ inputs.docker_registry_url }}/${{ inputs.docker_image_name }}:${{ inputs.docker_image_tag }} \
275+
--project-id ${{ inputs.gcp_project_id }}

0 commit comments

Comments
 (0)