Skip to content

Adjust page titles

Adjust page titles #39

Workflow file for this run

name: Pipeline
on:
push:
branches: [main, remix-migration]
pull_request:
branches: [main]
# Allow to run this workflow manually
workflow_dispatch:
env:
IMAGE_NAME: ${{ github.repository }}-remix
jobs:
build:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: validate github workflow files to have pinned versions
uses: digitalservicebund/github-actions/github-actions-linter@5009471245d84903ea1af84104eb1908f8e2b2a2
- name: Setup Node
uses: actions/setup-node@v4
with:
node-version-file: .node-version
cache: npm
- name: Cache npm dependencies
id: cache-npm-deps
uses: actions/cache@v3
with:
path: |
**/node_modules
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
restore-keys: |
${{ runner.os }}-node-
- name: Install dependencies
if: steps.cache-npm-deps.outputs.cache-hit != 'true'
run: npm ci
- name: Check build
run: npm run build
- name: Check format
run: npm run format:check
- name: Lint
run: npm run lint:check
- name: Run tests
run: npm test
- name: Install E2E & A11y test dependencies
run: |
npx --yes playwright install --with-deps
- name: Run E2E tests
run: npm run test:e2e
- uses: actions/upload-artifact@v3
if: ${{ failure() }}
with:
name: playwright-e2e-test-results
path: tests/e2e/playwright-report
- name: Run A11y tests
run: npm run test:a11y
env:
# Use a different port (from the one used with E2E tests) to workaround problem in CI/GitHub Actions,
# starting to occur with playwright/test 1.28.0:
# Error: http://localhost:4173 is already used ...
# See https://github.com/digitalservicebund/typescript-vite-application-template/actions/runs/3486985178/jobs/5834089375
VITE_PORT: 4183
- uses: actions/upload-artifact@v3
if: ${{ failure() }}
with:
name: playwright-a11y-test-results
path: tests/a11y/playwright-report
- name: Build an image from Dockerfile
run: |
docker build -t ${{ env.IMAGE_NAME }}:${{ github.sha }} . --build-arg COMMIT_SHA=${{ github.sha }}
- name: Create SBOM
uses: digitalservicebund/github-actions/create-sbom@24b9a8a55f22d21cebeae777aede3ae1b2fd3889
with:
image_name: ${{ env.IMAGE_NAME }}:${{ github.sha }}
- name: Send failure to Slack
uses: digitalservicebund/github-actions/notify-on-failure@b1492a10bdcc4a4f78a5706f9447d0908e856a53
if: ${{ failure() }}
with:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
audit-licenses:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: validate github workflow files to have pinned versions
uses: digitalservicebund/github-actions/github-actions-linter@5009471245d84903ea1af84104eb1908f8e2b2a2
- name: Setup Node
uses: actions/setup-node@v4
with:
node-version-file: .node-version
cache: npm
- name: Cache npm dependencies
id: cache-npm-deps
uses: actions/cache@v3
with:
path: |
**/node_modules
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
restore-keys: |
${{ runner.os }}-node-
- name: Install dependencies
if: steps.cache-npm-deps.outputs.cache-hit != 'true'
run: npm ci
- name: Audit used licences
run: npm run audit:licences
- name: Send status to Slack
uses: digitalservicebund/notify-on-failure-gha@0b21f14f28717b3b756282824976cdd1354b1235 # v1.3.0
if: ${{ failure() }}
with:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
vulnerability-scan:
runs-on: ubuntu-latest
permissions:
contents: read
security-events: write
steps:
- name: validate github workflow files to have pinned versions
uses: digitalservicebund/github-actions/github-actions-linter@5009471245d84903ea1af84104eb1908f8e2b2a2
- name: Run Trivy vulnerability scanner
# Third-party action, pin to commit SHA!
# See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
uses: aquasecurity/trivy-action@b77b85c0254bba6789e787844f0585cde1e56320
env:
TRIVY_USERNAME: ${{ github.actor }}
TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
with:
scan-type: "fs"
skip-dirs: "node_modules" # See https://github.com/aquasecurity/trivy/issues/1283
format: "sarif"
output: "trivy-results.sarif"
severity: "CRITICAL,HIGH"
exit-code: "1" # Fail the build!
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@9885f86fab4879632b7e44514f19148225dfbdcd # == v2
if: always() # Bypass non-zero exit code..
with:
sarif_file: "trivy-results.sarif"
- name: Send status to Slack
uses: digitalservicebund/notify-on-failure-gha@0b21f14f28717b3b756282824976cdd1354b1235 # v1.3.0
if: ${{ failure() }}
with:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
build-and-push-image:
runs-on: ubuntu-latest
if: ${{ github.ref == 'refs/heads/remix-migration' }}
needs:
- build
- audit-licenses
- vulnerability-scan
permissions:
contents: read
id-token: write # This is used to complete the identity challenge with sigstore/fulcio..
packages: write
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: validate github workflow files to have pinned versions
uses: digitalservicebund/github-actions/github-actions-linter@5009471245d84903ea1af84104eb1908f8e2b2a2
- name: Build image from Dockerfile
run: |
docker build -t ${{ env.IMAGE_NAME }}:${{ github.sha }} . --build-arg COMMIT_SHA=${{ github.sha }}
- name: Generate cosign vulnerability scan record
# Third-party action, pin to commit SHA!
# See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
uses: aquasecurity/trivy-action@2b6a709cf9c4025c5438138008beaddbb02086f0
with:
image-ref: ${{ env.IMAGE_NAME }}:${{ github.sha }}
format: "cosign-vuln"
output: "vulnerabilities.json"
- name: Upload cosign vulnerability scan record
uses: actions/upload-artifact@v3
with:
name: "vulnerabilities.json"
path: "vulnerabilities.json"
if-no-files-found: error
- name: Install cosign
# Third-party action, pin to commit SHA!
# See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
uses: sigstore/cosign-installer@1fc5bd396d372bee37d608f955b336615edf79c8
- name: Login to container registry
uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
with:
registry: "ghcr.io"
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Push image
run: |
docker tag ${{ env.IMAGE_NAME }}:${{ github.sha }} ghcr.io/${{ env.IMAGE_NAME }}
docker tag ${{ env.IMAGE_NAME }}:${{ github.sha }} ghcr.io/${{ env.IMAGE_NAME }}:${{ github.sha }}
docker push --all-tags ghcr.io/${{ env.IMAGE_NAME }}
- name: Sign the published Docker image
env:
COSIGN_EXPERIMENTAL: "true"
# This step uses the identity token to provision an ephemeral certificate
# against the sigstore community Fulcio instance.
run: cosign sign --yes ghcr.io/${{ env.IMAGE_NAME }}:${{ github.sha }}
- name: Attest the vulnerability scan
env:
COSIGN_EXPERIMENTAL: "true"
run: cosign attest --yes --replace --predicate vulnerabilities.json --type vuln ghcr.io/${{ env.IMAGE_NAME }}:${{ github.sha }}
deploy:
needs: [build-and-push-image]
if: github.ref == 'refs/heads/remix-migration'
runs-on: ubuntu-latest
timeout-minutes: 10
permissions:
packages: read
environment: staging
steps:
- name: Deploy new image
uses: digitalservicebund/github-actions/argocd-deploy@9b15fba0ce0e874d9af5be33ebeea7d476f808d0
with:
environment: staging
version: ${{ github.sha }}
deploying_repo: achill-remix
infra_repo: achill-infra
deploy_key: ${{ secrets.DEPLOY_KEY }}
app: achill-staging
argocd_pipeline_password: ${{ secrets.ARGOCD_PIPELINE_PASSWORD }}
argocd_server: ${{ secrets.ARGOCD_SERVER }}
argocd_sync_timeout: 300