Skip to content

Commit 2c15a5c

Browse files
haasonsaasclaude
haasonsaas
and
claude
committed
fix: harden deploy pipeline, k8s manifests, and CI tooling
- Deploy workflow now uses immutable sha-<commit> image tags instead of :latest - K8s deployments updated from placeholder ghcr.io/example/ to ghcr.io/evalops/keep/ - Fixed authz probe YAML indentation (scheme was sibling of httpGet, not child) - Added Service resources for authz, inventory, and app - Expanded .gitignore (sarif, .env, certs, pem/key) and removed committed gosec.sarif - Aligned OTEL exporter packages to v1.42.0 (was v1.38.0 vs core v1.42.0) - Switched CI and Makefile from pip to uv for Python package management Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent ece4731 commit 2c15a5c

14 files changed

Lines changed: 118 additions & 295 deletions

‎.github/workflows/ci.yml‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -28,10 +28,11 @@ jobs:
2828
with:
2929
python-version: ${{ env.PYTHON_VERSION }}
3030

31+
- name: Install uv
32+
uses: astral-sh/setup-uv@v5
33+
3134
- name: Install toolchains
32-
run: |
33-
python -m pip install --upgrade pip
34-
make install-tools
35+
run: make install-tools
3536

3637
- name: Format check
3738
run: make ci-format-check
@@ -80,10 +81,12 @@ jobs:
8081
with:
8182
python-version: ${{ env.PYTHON_VERSION }}
8283

84+
- name: Install uv
85+
uses: astral-sh/setup-uv@v5
86+
8387
- name: Install Python dependencies
8488
run: |
85-
pip install --upgrade pip
86-
pip install -r app/requirements.txt
89+
uv pip install --system -r app/requirements.txt
8790
make install-tools
8891
8992
- name: Wait for database
@@ -118,10 +121,11 @@ jobs:
118121
go-version-file: go.mod
119122
check-latest: true
120123

124+
- name: Install uv
125+
uses: astral-sh/setup-uv@v5
126+
121127
- name: Prepare tooling
122-
run: |
123-
python -m pip install --upgrade pip
124-
make install-tools
128+
run: make install-tools
125129

126130
- name: Run security checks
127131
run: make security

‎.github/workflows/deploy.yml‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -35,25 +35,30 @@ jobs:
3535
context: .
3636
file: services/authz/Dockerfile
3737
push: true
38-
tags: ghcr.io/${{ github.repository }}/authz:latest
38+
tags: |
39+
ghcr.io/${{ github.repository }}/authz:sha-${{ github.sha }}
3940
4041
- name: Build and push inventory image
4142
uses: docker/build-push-action@v6
4243
with:
4344
context: .
4445
file: services/inventory/Dockerfile
4546
push: true
46-
tags: ghcr.io/${{ github.repository }}/inventory:latest
47+
tags: |
48+
ghcr.io/${{ github.repository }}/inventory:sha-${{ github.sha }}
4749
4850
- name: Build and push app image
4951
uses: docker/build-push-action@v6
5052
with:
5153
context: .
5254
file: app/Dockerfile
5355
push: true
54-
tags: ghcr.io/${{ github.repository }}/app:latest
56+
tags: |
57+
ghcr.io/${{ github.repository }}/app:sha-${{ github.sha }}
5558
56-
- name: Deploy manifests
59+
- name: Update Kubernetes manifests with new image tags
5760
run: |
58-
echo "Kubeconfig secret missing, running in dry-run mode"
59-
kubectl apply --dry-run=client -k deploy/kubernetes
61+
cd deploy/kubernetes
62+
sed -i "s|image: ghcr.io/evalops/keep/authz:.*|image: ghcr.io/${{ github.repository }}/authz:sha-${{ github.sha }}|" authz-deployment.yaml
63+
sed -i "s|image: ghcr.io/evalops/keep/inventory:.*|image: ghcr.io/${{ github.repository }}/inventory:sha-${{ github.sha }}|" inventory-deployment.yaml
64+
sed -i "s|image: ghcr.io/evalops/keep/app:.*|image: ghcr.io/${{ github.repository }}/app:sha-${{ github.sha }}|" app-deployment.yaml

‎.gitignore‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,5 +5,16 @@ __pycache__/
55
.venv/
66
venv/
77
app/venv/
8+
9+
# Go build artifacts
810
agent/attestor-agent
911

12+
# Security scan artifacts
13+
*.sarif
14+
15+
# Secrets and certificates
16+
.env
17+
certs/
18+
test-certs/
19+
*.pem
20+
*.key

‎Makefile‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -126,12 +126,11 @@ install-tools:
126126
mv $(GOBIN)/opa.tmp $(GOBIN)/opa; \
127127
fi
128128
@echo "Installing Python tools..."
129-
$(PIP_BIN) install black flake8 isort mypy
129+
uv pip install --system black flake8 isort mypy
130130

131131
setup-venv:
132-
python3 -m venv $(VENV)
133-
$(VENV_BIN)/python3 -m pip install --upgrade pip
134-
$(VENV_BIN)/pip install -r app/requirements.txt
132+
uv venv $(VENV)
133+
uv pip install -r app/requirements.txt
135134
dev-bootstrap:
136135
./scripts/dev-bootstrap.sh
137136

‎deploy/kubernetes/app-deployment.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ spec:
1414
spec:
1515
containers:
1616
- name: keep-app
17-
image: ghcr.io/example/app:latest
17+
image: ghcr.io/evalops/keep/app:latest
1818
env:
1919
- name: APP_ENV
2020
valueFrom:

‎deploy/kubernetes/app-service.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: keep-app
5+
spec:
6+
selector:
7+
app: keep-app
8+
ports:
9+
- name: http
10+
port: 5000
11+
targetPort: 5000
12+
protocol: TCP

‎deploy/kubernetes/authz-deployment.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ spec:
1414
spec:
1515
containers:
1616
- name: authz
17-
image: ghcr.io/example/authz:latest
17+
image: ghcr.io/evalops/keep/authz:latest
1818
env:
1919
- name: OPA_URL
2020
valueFrom:
@@ -37,14 +37,14 @@ spec:
3737
httpGet:
3838
path: /health
3939
port: 8443
40-
scheme: HTTPS
40+
scheme: HTTPS
4141
initialDelaySeconds: 5
4242
periodSeconds: 10
4343
livenessProbe:
4444
httpGet:
4545
path: /health
4646
port: 8443
47-
scheme: HTTPS
47+
scheme: HTTPS
4848
initialDelaySeconds: 15
4949
periodSeconds: 20
5050
resources:

‎deploy/kubernetes/authz-service.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: authz
5+
spec:
6+
selector:
7+
app: authz
8+
ports:
9+
- name: https
10+
port: 8443
11+
targetPort: 8443
12+
protocol: TCP

‎deploy/kubernetes/inventory-deployment.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ spec:
1414
spec:
1515
containers:
1616
- name: inventory
17-
image: ghcr.io/example/inventory:latest
17+
image: ghcr.io/evalops/keep/inventory:latest
1818
env:
1919
- name: INVENTORY_ADDR
2020
value: ":8080"

‎deploy/kubernetes/inventory-service.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: inventory
5+
spec:
6+
selector:
7+
app: inventory
8+
ports:
9+
- name: http
10+
port: 8080
11+
targetPort: 8080
12+
protocol: TCP

0 commit comments

Comments
 (0)