fix: update trivy-action to v0.33.1 #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 'ArgoCD Application Sync' | ||
|
Check failure on line 1 in .github/workflows/argocd-sync.yml
|
||
| on: | ||
| workflow_call: | ||
| inputs: | ||
| argocd-server: | ||
| description: 'ArgoCD server URL' | ||
| required: true | ||
| type: string | ||
| argocd-app-name: | ||
| description: 'ArgoCD application name' | ||
| required: true | ||
| type: string | ||
| argocd-namespace: | ||
| description: 'ArgoCD namespace' | ||
| required: false | ||
| type: string | ||
| default: 'argocd' | ||
| sync-strategy: | ||
| description: 'Sync strategy (auto, apply, hook)' | ||
| required: false | ||
| type: string | ||
| default: 'auto' | ||
| prune: | ||
| description: 'Prune resources during sync' | ||
| required: false | ||
| type: boolean | ||
| default: false | ||
| force: | ||
| description: 'Force sync (override diverged state)' | ||
| required: false | ||
| type: boolean | ||
| default: false | ||
| dry-run: | ||
| description: 'Perform dry-run sync' | ||
| required: false | ||
| type: boolean | ||
| default: false | ||
| wait-for-sync: | ||
| description: 'Wait for sync to complete' | ||
| required: false | ||
| type: boolean | ||
| default: true | ||
| sync-timeout: | ||
| description: 'Sync timeout in seconds' | ||
| required: false | ||
| type: number | ||
| default: 300 | ||
| health-check: | ||
| description: 'Check application health after sync' | ||
| required: false | ||
| type: boolean | ||
| default: true | ||
| revision: | ||
| description: 'Target revision (branch, tag, commit)' | ||
| required: false | ||
| type: string | ||
| default: '' | ||
| secrets: | ||
| argocd-token: | ||
| description: 'ArgoCD authentication token' | ||
| required: true | ||
| kubeconfig: | ||
| description: 'Kubernetes config (if accessing cluster directly)' | ||
| required: false | ||
| outputs: | ||
| sync-result: | ||
| description: 'Sync result (success/failure)' | ||
| value: ${{ jobs.sync.outputs.result }} | ||
| sync-status: | ||
| description: 'Sync status (Synced, OutOfSync, Unknown)' | ||
| value: ${{ jobs.sync.outputs.status }} | ||
| health-status: | ||
| description: 'Health status (Healthy, Progressing, Degraded, Suspended)' | ||
| value: ${{ jobs.sync.outputs.health }} | ||
| permissions: | ||
| contents: read | ||
| id-token: write | ||
| jobs: | ||
| sync: | ||
| name: Sync ArgoCD Application | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: ${{ fromJSON(inputs.sync-timeout) / 60 + 5 }} | ||
| outputs: | ||
| result: ${{ steps.sync.outcome }} | ||
| status: ${{ steps.get-status.outputs.sync-status }} | ||
| health: ${{ steps.get-status.outputs.health-status }} | ||
| steps: | ||
| - name: Install ArgoCD CLI | ||
| run: | | ||
| ARGOCD_VERSION="v2.13.2" | ||
| wget -q "https://github.com/argoproj/argo-cd/releases/download/${ARGOCD_VERSION}/argocd-linux-amd64" | ||
| sudo mv argocd-linux-amd64 /usr/local/bin/argocd | ||
| sudo chmod +x /usr/local/bin/argocd | ||
| argocd version --client | ||
| - name: Login to ArgoCD | ||
| env: | ||
| ARGOCD_SERVER: ${{ inputs.argocd-server }} | ||
| ARGOCD_AUTH_TOKEN: ${{ secrets.argocd-token }} | ||
| run: | | ||
| echo "Logging in to ArgoCD server: $ARGOCD_SERVER" | ||
| argocd login "$ARGOCD_SERVER" \ | ||
| --auth-token="$ARGOCD_AUTH_TOKEN" \ | ||
| --grpc-web | ||
| - name: Get current application state | ||
| id: pre-sync-state | ||
| env: | ||
| ARGOCD_SERVER: ${{ inputs.argocd-server }} | ||
| run: | | ||
| echo "Getting application state before sync..." | ||
| APP_INFO=$(argocd app get ${{ inputs.argocd-app-name }} \ | ||
| --output json \ | ||
| --server "$ARGOCD_SERVER" 2>/dev/null || echo '{}') | ||
| CURRENT_SYNC=$(echo "$APP_INFO" | jq -r '.status.sync.status // "Unknown"') | ||
| CURRENT_HEALTH=$(echo "$APP_INFO" | jq -r '.status.health.status // "Unknown"') | ||
| CURRENT_REVISION=$(echo "$APP_INFO" | jq -r '.status.sync.revision // "Unknown"') | ||
| echo "pre-sync-status=$CURRENT_SYNC" >> $GITHUB_OUTPUT | ||
| echo "pre-health-status=$CURRENT_HEALTH" >> $GITHUB_OUTPUT | ||
| echo "pre-revision=$CURRENT_REVISION" >> $GITHUB_OUTPUT | ||
| echo "Pre-sync state:" | ||
| echo " Sync: $CURRENT_SYNC" | ||
| echo " Health: $CURRENT_HEALTH" | ||
| echo " Revision: $CURRENT_REVISION" | ||
| - name: Build sync command | ||
| id: build-sync-cmd | ||
| run: | | ||
| SYNC_CMD="argocd app sync ${{ inputs.argocd-app-name }}" | ||
| SYNC_CMD="$SYNC_CMD --server ${{ inputs.argocd-server }}" | ||
| if [ "${{ inputs.prune }}" == "true" ]; then | ||
| SYNC_CMD="$SYNC_CMD --prune" | ||
| fi | ||
| if [ "${{ inputs.force }}" == "true" ]; then | ||
| SYNC_CMD="$SYNC_CMD --force" | ||
| fi | ||
| if [ "${{ inputs.dry-run }}" == "true" ]; then | ||
| SYNC_CMD="$SYNC_CMD --dry-run" | ||
| fi | ||
| if [ -n "${{ inputs.revision }}" ]; then | ||
| SYNC_CMD="$SYNC_CMD --revision ${{ inputs.revision }}" | ||
| fi | ||
| case "${{ inputs.sync-strategy }}" in | ||
| apply) | ||
| SYNC_CMD="$SYNC_CMD --strategy apply" | ||
| ;; | ||
| hook) | ||
| SYNC_CMD="$SYNC_CMD --strategy hook" | ||
| ;; | ||
| esac | ||
| echo "command=$SYNC_CMD" >> $GITHUB_OUTPUT | ||
| echo "Sync command: $SYNC_CMD" | ||
| - name: Trigger ArgoCD sync | ||
| id: sync | ||
| env: | ||
| ARGOCD_SERVER: ${{ inputs.argocd-server }} | ||
| run: | | ||
| echo "Triggering sync for application: ${{ inputs.argocd-app-name }}" | ||
| ${{ steps.build-sync-cmd.outputs.command }} | ||
| - name: Wait for sync completion | ||
| if: inputs.wait-for-sync && !inputs.dry-run | ||
| env: | ||
| ARGOCD_SERVER: ${{ inputs.argocd-server }} | ||
| timeout-minutes: ${{ fromJSON(inputs.sync-timeout) / 60 }} | ||
| run: | | ||
| echo "Waiting for sync to complete (timeout: ${{ inputs.sync-timeout }}s)..." | ||
| argocd app wait ${{ inputs.argocd-app-name }} \ | ||
| --server "$ARGOCD_SERVER" \ | ||
| --timeout ${{ inputs.sync-timeout }} \ | ||
| --health | ||
| - name: Get post-sync application state | ||
| if: always() && !inputs.dry-run | ||
| id: get-status | ||
| env: | ||
| ARGOCD_SERVER: ${{ inputs.argocd-server }} | ||
| run: | | ||
| echo "Getting application state after sync..." | ||
| APP_INFO=$(argocd app get ${{ inputs.argocd-app-name }} \ | ||
| --output json \ | ||
| --server "$ARGOCD_SERVER" 2>/dev/null || echo '{}') | ||
| SYNC_STATUS=$(echo "$APP_INFO" | jq -r '.status.sync.status // "Unknown"') | ||
| HEALTH_STATUS=$(echo "$APP_INFO" | jq -r '.status.health.status // "Unknown"') | ||
| CURRENT_REVISION=$(echo "$APP_INFO" | jq -r '.status.sync.revision // "Unknown"') | ||
| echo "sync-status=$SYNC_STATUS" >> $GITHUB_OUTPUT | ||
| echo "health-status=$HEALTH_STATUS" >> $GITHUB_OUTPUT | ||
| echo "current-revision=$CURRENT_REVISION" >> $GITHUB_OUTPUT | ||
| echo "Post-sync state:" | ||
| echo " Sync: $SYNC_STATUS" | ||
| echo " Health: $HEALTH_STATUS" | ||
| echo " Revision: $CURRENT_REVISION" | ||
| - name: Verify sync result | ||
| if: inputs.health-check && !inputs.dry-run | ||
| run: | | ||
| SYNC_STATUS="${{ steps.get-status.outputs.sync-status }}" | ||
| HEALTH_STATUS="${{ steps.get-status.outputs.health-status }}" | ||
| if [ "$SYNC_STATUS" != "Synced" ]; then | ||
| echo "❌ Sync failed: Application is not in Synced state (current: $SYNC_STATUS)" | ||
| exit 1 | ||
| fi | ||
| if [ "$HEALTH_STATUS" != "Healthy" ]; then | ||
| if [ "$HEALTH_STATUS" == "Progressing" ]; then | ||
| echo "⚠️ Application is still progressing (current: $HEALTH_STATUS)" | ||
| elif [ "$HEALTH_STATUS" == "Suspended" ]; then | ||
| echo "ℹ️ Application is suspended (current: $HEALTH_STATUS)" | ||
| else | ||
| echo "❌ Health check failed: Application is not Healthy (current: $HEALTH_STATUS)" | ||
| exit 1 | ||
| fi | ||
| fi | ||
| echo "✅ Sync verified: Application is Synced and Healthy" | ||
| - name: Get application resources | ||
| if: always() && !inputs.dry-run | ||
| env: | ||
| ARGOCD_SERVER: ${{ inputs.argocd-server }} | ||
| run: | | ||
| echo "Application resources:" | ||
| argocd app resources ${{ inputs.argocd-app-name }} \ | ||
| --server "$ARGOCD_SERVER" || true | ||
| - name: Generate sync summary | ||
| if: always() | ||
| run: | | ||
| { | ||
| echo "## 🔄 ArgoCD Application Sync Summary" | ||
| echo "" | ||
| echo "**Application:** \`${{ inputs.argocd-app-name }}\`" | ||
| echo "**Server:** \`${{ inputs.argocd-server }}\`" | ||
| echo "**Namespace:** \`${{ inputs.argocd-namespace }}\`" | ||
| echo "" | ||
| } >> "$GITHUB_STEP_SUMMARY" | ||
| if [ "${{ inputs.dry-run }}" == "true" ]; then | ||
| echo "ℹ️ **Dry-run mode** - No actual changes made" >> "$GITHUB_STEP_SUMMARY" | ||
| else | ||
| if [ "${{ steps.sync.outcome }}" == "success" ]; then | ||
| echo "✅ **Sync Status: Success**" >> "$GITHUB_STEP_SUMMARY" | ||
| else | ||
| echo "❌ **Sync Status: Failed**" >> "$GITHUB_STEP_SUMMARY" | ||
| fi | ||
| echo "" >> "$GITHUB_STEP_SUMMARY" | ||
| echo "### State Changes" >> "$GITHUB_STEP_SUMMARY" | ||
| echo "" >> "$GITHUB_STEP_SUMMARY" | ||
| echo "| Metric | Before | After |" >> "$GITHUB_STEP_SUMMARY" | ||
| echo "|--------|--------|-------|" >> "$GITHUB_STEP_SUMMARY" | ||
| echo "| Sync Status | ${{ steps.pre-sync-state.outputs.pre-sync-status }} | ${{ steps.get-status.outputs.sync-status }} |" >> "$GITHUB_STEP_SUMMARY" | ||
| echo "| Health Status | ${{ steps.pre-sync-state.outputs.pre-health-status }} | ${{ steps.get-status.outputs.health-status }} |" >> "$GITHUB_STEP_SUMMARY" | ||
| if [ -n "${{ inputs.revision }}" ]; then | ||
| echo "| Target Revision | ${{ steps.pre-sync-state.outputs.pre-revision }} | ${{ inputs.revision }} |" >> "$GITHUB_STEP_SUMMARY" | ||
| fi | ||
| fi | ||
| echo "" >> "$GITHUB_STEP_SUMMARY" | ||
| echo "### Sync Configuration" >> "$GITHUB_STEP_SUMMARY" | ||
| echo "" >> "$GITHUB_STEP_SUMMARY" | ||
| echo "- **Strategy:** \`${{ inputs.sync-strategy }}\`" >> "$GITHUB_STEP_SUMMARY" | ||
| echo "- **Prune:** \`${{ inputs.prune }}\`" >> "$GITHUB_STEP_SUMMARY" | ||
| echo "- **Force:** \`${{ inputs.force }}\`" >> "$GITHUB_STEP_SUMMARY" | ||
| echo "- **Timeout:** \`${{ inputs.sync-timeout }}s\`" >> "$GITHUB_STEP_SUMMARY" | ||
| if [ "${{ inputs.health-check }}" == "true" ] && [ "${{ inputs.dry-run }}" == "false" ]; then | ||
| HEALTH="${{ steps.get-status.outputs.health-status }}" | ||
| case "$HEALTH" in | ||
| Healthy) | ||
| echo "" >> "$GITHUB_STEP_SUMMARY" | ||
| echo "✅ **Application is Healthy**" >> "$GITHUB_STEP_SUMMARY" | ||
| ;; | ||
| Progressing) | ||
| echo "" >> "$GITHUB_STEP_SUMMARY" | ||
| echo "⚠️ **Application is Progressing**" >> "$GITHUB_STEP_SUMMARY" | ||
| ;; | ||
| Degraded) | ||
| echo "" >> "$GITHUB_STEP_SUMMARY" | ||
| echo "❌ **Application is Degraded**" >> "$GITHUB_STEP_SUMMARY" | ||
| ;; | ||
| Suspended) | ||
| echo "" >> "$GITHUB_STEP_SUMMARY" | ||
| echo "ℹ️ **Application is Suspended**" >> "$GITHUB_STEP_SUMMARY" | ||
| ;; | ||
| esac | ||
| fi | ||
