Upgrade Node for security #818
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Node.js CI | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v2 | |
| # TODO: see if we need to do anything special to cache docker images | |
| - uses: c-hive/gha-npm-cache@v1 | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@v1 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.repository_owner }} | |
| password: ${{ github.token }} | |
| - name: Tag Build | |
| uses: docker/metadata-action@v3 | |
| id: meta | |
| with: | |
| images: ghcr.io/${{ github.repository }} | |
| # Only tag with latest if we're on main | |
| tags: | | |
| type=ref,event=pr | |
| type=ref,event=branch | |
| type=sha | |
| type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }} | |
| - name: Build and push Docker images | |
| uses: docker/build-push-action@v2 | |
| with: | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| deployment: | |
| needs: build | |
| if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop' || github.ref == 'refs/heads/feature/actions' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout to branch | |
| uses: actions/checkout@v2 | |
| - name: Tag Build | |
| uses: docker/metadata-action@v3 | |
| id: meta | |
| with: | |
| images: ghcr.io/${{ github.repository }} | |
| tags: | | |
| type=sha | |
| - name: Create build context for k8s deployment | |
| # There should only be 1 tag, so 'join' will just produce a simple string | |
| run: | | |
| touch k8s-context | |
| echo IMAGE=${{ join(steps.meta.outputs.tags, '') }} > k8s-context | |
| cat k8s-context | |
| - name: Set up kubectl | |
| uses: matootie/[email protected] | |
| with: | |
| personalAccessToken: ${{ secrets.DIGITALOCEAN_TOKEN }} | |
| clusterName: k8s-rf | |
| - name: Deploy app | |
| run: | | |
| kubectl diff -k . || echo \n | |
| kubectl delete secret reactibot-env || echo \n | |
| kubectl create secret generic reactibot-env \ | |
| --from-literal=DISCORD_HASH=${{ secrets.DISCORD_HASH }} \ | |
| --from-literal=DISCORD_PUBLIC_KEY=${{ secrets.DISCORD_PUBLIC_KEY }} \ | |
| --from-literal=DISCORD_APP_ID=${{ secrets.DISCORD_APP_ID }} \ | |
| --from-literal=GUILD_ID=${{ secrets.GUILD_ID }} \ | |
| --from-literal=GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }} \ | |
| --from-literal=AMPLITUDE_KEY=${{ secrets.AMPLITUDE_KEY }} || echo \n | |
| kubectl apply -k . |