Skip to content

Commit 2c55d25

Browse files
codez0mb1ecodez0mb1e
committed
Add Release pipeline
1 parent 68154af commit 2c55d25

4 files changed

Lines changed: 222 additions & 0 deletions

File tree

‎.github/workflows/release.yml‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
name: BinanceBot Release Pipeline
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
branches: [ "master" ]
7+
tags:
8+
- 'v*.*.*'
9+
10+
permissions:
11+
contents: read
12+
packages: write
13+
id-token: write
14+
15+
concurrency:
16+
group: release-${{ github.ref }}
17+
cancel-in-progress: true
18+
19+
jobs:
20+
build-and-push-images:
21+
22+
name: Build and push Docker images
23+
24+
runs-on: ubuntu-latest
25+
26+
env:
27+
DOCKER_BUILDKIT: 1
28+
29+
strategy:
30+
matrix:
31+
app:
32+
- name: marketbot
33+
dockerfile: Dockerfile.marketbot
34+
project: BinanceBot.MarketBot.Console
35+
- name: marketviewer
36+
dockerfile: Dockerfile.marketviewer
37+
project: BinanceBot.MarketViewer.Console
38+
39+
steps:
40+
- name: Check out the repo
41+
uses: actions/checkout@v4
42+
43+
- name: Set up Docker Buildx
44+
uses: docker/setup-buildx-action@v3
45+
46+
- name: Login to GitHub Container Registry
47+
uses: docker/login-action@v3
48+
with:
49+
registry: ghcr.io
50+
username: ${{ github.actor }}
51+
password: ${{ secrets.CONTAINER_REGISTRY_TOKEN }}
52+
53+
- name: Docker metadata
54+
id: meta
55+
uses: docker/metadata-action@v5
56+
with:
57+
images: |
58+
ghcr.io/${{ github.repository_owner }}/binancebot-${{ matrix.app.name }}
59+
tags: |
60+
type=raw,value=latest
61+
type=ref,event=branch
62+
type=semver,pattern={{version}}
63+
type=semver,pattern={{major}}.{{minor}}
64+
type=sha
65+
labels: |
66+
org.opencontainers.image.source=${{ github.repository }}
67+
org.opencontainers.image.created=${{ github.event.head_commit.timestamp }}
68+
org.opencontainers.image.revision=${{ github.sha }}
69+
org.opencontainers.image.title=BinanceBot ${{ matrix.app.name }}
70+
org.opencontainers.image.description=BinanceBot ${{ matrix.app.project }}
71+
72+
- name: Build and push
73+
uses: docker/build-push-action@v6
74+
with:
75+
context: .
76+
file: ./${{ matrix.app.dockerfile }}
77+
push: true
78+
tags: ${{ steps.meta.outputs.tags }}
79+
labels: ${{ steps.meta.outputs.labels }}
80+
cache-from: type=gha,scope=${{ matrix.app.name }}
81+
cache-to: type=gha,mode=max,scope=${{ matrix.app.name }}
82+
build-args: |
83+
PROJECT_NAME=${{ matrix.app.project }}
84+
85+
- name: Run Trivy vulnerability scanner
86+
uses: aquasecurity/trivy-action@0.31.0
87+
with:
88+
image-ref: ghcr.io/${{ github.repository_owner }}/binancebot-${{ matrix.app.name }}:latest
89+
format: 'table'
90+
ignore-unfixed: true
91+
vuln-type: 'library'
92+
severity: 'CRITICAL,HIGH'

‎Dockerfile.marketbot‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Build stage
2+
FROM mcr.microsoft.com/dotnet/sdk:9.0-alpine AS build
3+
ARG BUILD_CONFIGURATION=Release
4+
ARG PROJECT_NAME=BinanceBot.MarketBot.Console
5+
WORKDIR /src
6+
7+
# Copy solution and project files for better layer caching
8+
COPY src/*.sln ./
9+
COPY src/BinanceBot.Market/*.csproj ./BinanceBot.Market/
10+
COPY src/BinanceBot.MarketBot.Console/*.csproj ./BinanceBot.MarketBot.Console/
11+
COPY src/BinanceBot.MarketViewer.Console/*.csproj ./BinanceBot.MarketViewer.Console/
12+
13+
# Restore dependencies as a separate layer
14+
RUN dotnet restore "${PROJECT_NAME}/${PROJECT_NAME}.csproj" \
15+
--runtime linux-musl-x64
16+
17+
# Copy remaining source files
18+
COPY src/. ./
19+
20+
# Build and publish
21+
WORKDIR /src/${PROJECT_NAME}
22+
RUN dotnet publish "${PROJECT_NAME}.csproj" \
23+
-c $BUILD_CONFIGURATION \
24+
-o /app/publish \
25+
--no-restore \
26+
--runtime linux-musl-x64 \
27+
--self-contained false \
28+
/p:UseAppHost=false
29+
30+
# Runtime stage
31+
FROM mcr.microsoft.com/dotnet/aspnet:9.0-alpine AS final
32+
ARG PROJECT_NAME=BinanceBot.MarketBot.Console
33+
WORKDIR /app
34+
35+
# Create non-root user
36+
RUN addgroup -g 1000 appuser && \
37+
adduser -u 1000 -G appuser -s /bin/sh -D appuser && \
38+
chown -R appuser:appuser /app
39+
40+
# Copy published output
41+
COPY --from=build --chown=appuser:appuser /app/publish .
42+
43+
# Security: Run as non-root
44+
USER appuser
45+
46+
# Set environment variables
47+
ENV DOTNET_RUNNING_IN_CONTAINER=true \
48+
DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=false
49+
50+
# Note: Set BINANCE_API_KEY and BINANCE_SECRET via environment variables or .env file at runtime
51+
ENTRYPOINT dotnet "${PROJECT_NAME}.dll"

‎Dockerfile.marketviewer‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Build stage
2+
FROM mcr.microsoft.com/dotnet/sdk:9.0-alpine AS build
3+
ARG BUILD_CONFIGURATION=Release
4+
ARG PROJECT_NAME=BinanceBot.MarketViewer.Console
5+
WORKDIR /src
6+
7+
# Copy solution and project files for better layer caching
8+
COPY src/*.sln ./
9+
COPY src/BinanceBot.Market/*.csproj ./BinanceBot.Market/
10+
COPY src/BinanceBot.MarketBot.Console/*.csproj ./BinanceBot.MarketBot.Console/
11+
COPY src/BinanceBot.MarketViewer.Console/*.csproj ./BinanceBot.MarketViewer.Console/
12+
13+
# Restore dependencies as a separate layer
14+
RUN dotnet restore "${PROJECT_NAME}/${PROJECT_NAME}.csproj" \
15+
--runtime linux-musl-x64
16+
17+
# Copy remaining source files
18+
COPY src/. ./
19+
20+
# Build and publish
21+
WORKDIR /src/${PROJECT_NAME}
22+
RUN dotnet publish "${PROJECT_NAME}.csproj" \
23+
-c $BUILD_CONFIGURATION \
24+
-o /app/publish \
25+
--no-restore \
26+
--runtime linux-musl-x64 \
27+
--self-contained false \
28+
/p:UseAppHost=false
29+
30+
# Runtime stage
31+
FROM mcr.microsoft.com/dotnet/aspnet:9.0-alpine AS final
32+
ARG PROJECT_NAME=BinanceBot.MarketViewer.Console
33+
WORKDIR /app
34+
35+
# Create non-root user
36+
RUN addgroup -g 1000 appuser && \
37+
adduser -u 1000 -G appuser -s /bin/sh -D appuser && \
38+
chown -R appuser:appuser /app
39+
40+
# Copy published output
41+
COPY --from=build --chown=appuser:appuser /app/publish .
42+
43+
# Security: Run as non-root
44+
USER appuser
45+
46+
# Set environment variables
47+
ENV DOTNET_RUNNING_IN_CONTAINER=true \
48+
DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=false
49+
50+
# Note: Set BINANCE_API_KEY and BINANCE_SECRET via environment variables or .env file at runtime
51+
ENTRYPOINT dotnet "${PROJECT_NAME}.dll"

‎compose.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
services:
2+
marketbot:
3+
image: ghcr.io/${GITHUB_REPOSITORY_OWNER:-codez0mb1e}/binancebot-marketbot:latest
4+
container_name: binancebot-marketbot
5+
restart: unless-stopped
6+
environment:
7+
- BINANCE_API_KEY=${BINANCE_API_KEY}
8+
- BINANCE_SECRET=${BINANCE_SECRET}
9+
env_file:
10+
- .env
11+
networks:
12+
- binancebot-network
13+
14+
marketviewer:
15+
image: ghcr.io/${GITHUB_REPOSITORY_OWNER:-codez0mb1e}/binancebot-marketviewer:latest
16+
container_name: binancebot-marketviewer
17+
restart: unless-stopped
18+
environment:
19+
- BINANCE_API_KEY=${BINANCE_API_KEY}
20+
- BINANCE_SECRET=${BINANCE_SECRET}
21+
env_file:
22+
- .env
23+
networks:
24+
- binancebot-network
25+
26+
networks:
27+
binancebot-network:
28+
driver: bridge

0 commit comments

Comments
 (0)