Skip to content

Commit 60dbf6c

Browse files
roujaAntoLC
rouja
authored and
AntoLC
committed
💚(ci) fix jobs after migration
The repository migration broke the CI. To fix it, we removed the dependency on the secrets repository.
1 parent 2491ad7 commit 60dbf6c

File tree

13 files changed

+100
-309
lines changed

13 files changed

+100
-309
lines changed

Diff for: ‎.github/workflows/docker-hub.yml

+9-77
Original file line numberDiff line numberDiff line change
@@ -19,26 +19,9 @@ jobs:
1919
build-and-push-backend:
2020
runs-on: ubuntu-latest
2121
steps:
22-
-
23-
uses: actions/create-github-app-token@v1
24-
id: app-token
25-
with:
26-
app-id: ${{ secrets.APP_ID }}
27-
private-key: ${{ secrets.PRIVATE_KEY }}
28-
owner: ${{ github.repository_owner }}
29-
repositories: "impress,secrets"
3022
-
3123
name: Checkout repository
32-
uses: actions/checkout@v2
33-
with:
34-
submodules: recursive
35-
token: ${{ steps.app-token.outputs.token }}
36-
-
37-
name: Load sops secrets
38-
uses: rouja/actions-sops@main
39-
with:
40-
secret-file: secrets/numerique-gouv/impress/secrets.enc.env
41-
age-key: ${{ secrets.SOPS_PRIVATE }}
24+
uses: actions/checkout@v4
4225
-
4326
name: Docker meta
4427
id: meta
@@ -48,7 +31,7 @@ jobs:
4831
-
4932
name: Login to DockerHub
5033
if: github.event_name != 'pull_request'
51-
run: echo "$DOCKER_HUB_PASSWORD" | docker login -u "$DOCKER_HUB_USER" --password-stdin
34+
run: echo "${{ secrets.DOCKER_HUB_PASSWORD }}" | docker login -u "${{ secrets.DOCKER_HUB_USER }}" --password-stdin
5235
-
5336
name: Run trivy scan
5437
uses: numerique-gouv/action-trivy-cache@main
@@ -70,26 +53,9 @@ jobs:
7053
build-and-push-frontend:
7154
runs-on: ubuntu-latest
7255
steps:
73-
-
74-
uses: actions/create-github-app-token@v1
75-
id: app-token
76-
with:
77-
app-id: ${{ secrets.APP_ID }}
78-
private-key: ${{ secrets.PRIVATE_KEY }}
79-
owner: ${{ github.repository_owner }}
80-
repositories: "impress,secrets"
8156
-
8257
name: Checkout repository
83-
uses: actions/checkout@v2
84-
with:
85-
submodules: recursive
86-
token: ${{ steps.app-token.outputs.token }}
87-
-
88-
name: Load sops secrets
89-
uses: rouja/actions-sops@main
90-
with:
91-
secret-file: secrets/numerique-gouv/impress/secrets.enc.env
92-
age-key: ${{ secrets.SOPS_PRIVATE }}
58+
uses: actions/checkout@v4
9359
-
9460
name: Docker meta
9561
id: meta
@@ -99,7 +65,7 @@ jobs:
9965
-
10066
name: Login to DockerHub
10167
if: github.event_name != 'pull_request'
102-
run: echo "$DOCKER_HUB_PASSWORD" | docker login -u "$DOCKER_HUB_USER" --password-stdin
68+
run: echo "${{ secrets.DOCKER_HUB_PASSWORD }}" | docker login -u "${{ secrets.DOCKER_HUB_USER }}" --password-stdin
10369
-
10470
name: Run trivy scan
10571
uses: numerique-gouv/action-trivy-cache@main
@@ -122,26 +88,9 @@ jobs:
12288
build-and-push-y-provider:
12389
runs-on: ubuntu-latest
12490
steps:
125-
-
126-
uses: actions/create-github-app-token@v1
127-
id: app-token
128-
with:
129-
app-id: ${{ secrets.APP_ID }}
130-
private-key: ${{ secrets.PRIVATE_KEY }}
131-
owner: ${{ github.repository_owner }}
132-
repositories: "impress,secrets"
13391
-
13492
name: Checkout repository
135-
uses: actions/checkout@v2
136-
with:
137-
submodules: recursive
138-
token: ${{ steps.app-token.outputs.token }}
139-
-
140-
name: Load sops secrets
141-
uses: rouja/actions-sops@main
142-
with:
143-
secret-file: secrets/numerique-gouv/impress/secrets.enc.env
144-
age-key: ${{ secrets.SOPS_PRIVATE }}
93+
uses: actions/checkout@v4
14594
-
14695
name: Docker meta
14796
id: meta
@@ -151,7 +100,7 @@ jobs:
151100
-
152101
name: Login to DockerHub
153102
if: github.event_name != 'pull_request'
154-
run: echo "$DOCKER_HUB_PASSWORD" | docker login -u "$DOCKER_HUB_USER" --password-stdin
103+
run: echo "${{ secrets.DOCKER_HUB_PASSWORD }}" | docker login -u "${{ secrets.DOCKER_HUB_USER }}" --password-stdin
155104
-
156105
name: Run trivy scan
157106
uses: numerique-gouv/action-trivy-cache@main
@@ -179,29 +128,12 @@ jobs:
179128
if: |
180129
github.event_name != 'pull_request'
181130
steps:
182-
-
183-
uses: actions/create-github-app-token@v1
184-
id: app-token
185-
with:
186-
app-id: ${{ secrets.APP_ID }}
187-
private-key: ${{ secrets.PRIVATE_KEY }}
188-
owner: ${{ github.repository_owner }}
189-
repositories: "impress,secrets"
190131
-
191132
name: Checkout repository
192-
uses: actions/checkout@v2
193-
with:
194-
submodules: recursive
195-
token: ${{ steps.app-token.outputs.token }}
196-
-
197-
name: Load sops secrets
198-
uses: rouja/actions-sops@main
199-
with:
200-
secret-file: secrets/numerique-gouv/impress/secrets.enc.env
201-
age-key: ${{ secrets.SOPS_PRIVATE }}
133+
uses: actions/checkout@v4
202134
-
203135
name: Call argocd github webhook
204136
run: |
205137
data='{"ref": "'$GITHUB_REF'","repository": {"html_url":"'$GITHUB_SERVER_URL'/'$GITHUB_REPOSITORY'"}}'
206-
sig=$(echo -n ${data} | openssl dgst -sha1 -hmac ''${ARGOCD_WEBHOOK_SECRET}'' | awk '{print "X-Hub-Signature: sha1="$2}')
207-
curl -X POST -H 'X-GitHub-Event:push' -H "Content-Type: application/json" -H "${sig}" --data "${data}" $ARGOCD_WEBHOOK_URL
138+
sig=$(echo -n ${data} | openssl dgst -sha1 -hmac ''${{ secrets.ARGOCD_PREPROD_WEBHOOK_SECRET}}'' | awk '{print "X-Hub-Signature: sha1="$2}')
139+
curl -X POST -H 'X-GitHub-Event:push' -H "Content-Type: application/json" -H "${sig}" --data "${data}" ${{ vars.ARGOCD_PREPROD_WEBHOOK_URL }}

Diff for: ‎.github/workflows/helmfile-linter.yaml

+16-8
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ name: Helmfile lint
22
run-name: Helmfile lint
33

44
on:
5+
push:
56
pull_request:
67
branches:
78
- 'main'
@@ -12,11 +13,18 @@ jobs:
1213
container:
1314
image: ghcr.io/helmfile/helmfile:latest
1415
steps:
15-
-
16-
uses: numerique-gouv/action-helmfile-lint@main
17-
with:
18-
app-id: ${{ secrets.APP_ID }}
19-
age-key: ${{ secrets.SOPS_PRIVATE }}
20-
private-key: ${{ secrets.PRIVATE_KEY }}
21-
helmfile-src: "src/helm"
22-
repositories: "impress,secrets"
16+
-
17+
name: Checkout repository
18+
uses: actions/checkout@v4
19+
-
20+
name: Helmfile lint
21+
shell: bash
22+
run: |
23+
set -e
24+
HELMFILE=src/helm/helmfile.yaml
25+
environments=$(awk '/environments:/ {flag=1; next} flag && NF {print} !NF {flag=0}' "$HELMFILE" | grep -E '^[[:space:]]{2}[a-zA-Z]+' | sed 's/^[[:space:]]*//;s/:.*//')
26+
for env in $environments; do
27+
echo "################### $env lint ###################"
28+
helmfile -e $env -f $HELMFILE lint || exit 1
29+
echo -e "\n"
30+
done

Diff for: ‎.gitmodules

-3
Original file line numberDiff line numberDiff line change
@@ -1,3 +0,0 @@
1-
[submodule "secrets"]
2-
path = secrets
3-
url = ../secrets

Diff for: ‎bin/start-kind.sh

+1-102
Original file line numberDiff line numberDiff line change
@@ -1,103 +1,2 @@
11
#!/bin/sh
2-
set -o errexit
3-
4-
CURRENT_DIR=$(pwd)
5-
6-
echo "0. Create ca"
7-
# 0. Create ca
8-
mkcert -install
9-
cd /tmp
10-
mkcert "127.0.0.1.nip.io" "*.127.0.0.1.nip.io"
11-
cd $CURRENT_DIR
12-
13-
echo "1. Create registry container unless it already exists"
14-
# 1. Create registry container unless it already exists
15-
reg_name='kind-registry'
16-
reg_port='5001'
17-
if [ "$(docker inspect -f '{{.State.Running}}' "${reg_name}" 2>/dev/null || true)" != 'true' ]; then
18-
docker run \
19-
-d --restart=unless-stopped -p "127.0.0.1:${reg_port}:5000" --network bridge --name "${reg_name}" \
20-
registry:2
21-
fi
22-
23-
echo "2. Create kind cluster with containerd registry config dir enabled"
24-
# 2. Create kind cluster with containerd registry config dir enabled
25-
# TODO: kind will eventually enable this by default and this patch will
26-
# be unnecessary.
27-
#
28-
# See:
29-
# https://github.com/kubernetes-sigs/kind/issues/2875
30-
# https://github.com/containerd/containerd/blob/main/docs/cri/config.md#registry-configuration
31-
# See: https://github.com/containerd/containerd/blob/main/docs/hosts.md
32-
cat <<EOF | kind create cluster --config=-
33-
kind: Cluster
34-
apiVersion: kind.x-k8s.io/v1alpha4
35-
containerdConfigPatches:
36-
- |-
37-
[plugins."io.containerd.grpc.v1.cri".registry]
38-
config_path = "/etc/containerd/certs.d"
39-
nodes:
40-
- role: control-plane
41-
image: kindest/node:v1.27.3
42-
kubeadmConfigPatches:
43-
- |
44-
kind: InitConfiguration
45-
nodeRegistration:
46-
kubeletExtraArgs:
47-
node-labels: "ingress-ready=true"
48-
extraPortMappings:
49-
- containerPort: 80
50-
hostPort: 80
51-
protocol: TCP
52-
- containerPort: 443
53-
hostPort: 443
54-
protocol: TCP
55-
- role: worker
56-
image: kindest/node:v1.27.3
57-
- role: worker
58-
image: kindest/node:v1.27.3
59-
EOF
60-
61-
echo "3. Add the registry config to the nodes"
62-
# 3. Add the registry config to the nodes
63-
#
64-
# This is necessary because localhost resolves to loopback addresses that are
65-
# network-namespace local.
66-
# In other words: localhost in the container is not localhost on the host.
67-
#
68-
# We want a consistent name that works from both ends, so we tell containerd to
69-
# alias localhost:${reg_port} to the registry container when pulling images
70-
REGISTRY_DIR="/etc/containerd/certs.d/localhost:${reg_port}"
71-
for node in $(kind get nodes); do
72-
docker exec "${node}" mkdir -p "${REGISTRY_DIR}"
73-
cat <<EOF | docker exec -i "${node}" cp /dev/stdin "${REGISTRY_DIR}/hosts.toml"
74-
[host."http://${reg_name}:5000"]
75-
EOF
76-
done
77-
78-
echo "4. Connect the registry to the cluster network if not already connected"
79-
# 4. Connect the registry to the cluster network if not already connected
80-
# This allows kind to bootstrap the network but ensures they're on the same network
81-
if [ "$(docker inspect -f='{{json .NetworkSettings.Networks.kind}}' "${reg_name}")" = 'null' ]; then
82-
docker network connect "kind" "${reg_name}"
83-
fi
84-
85-
echo "5. Document the local registry"
86-
# 5. Document the local registry
87-
# https://github.com/kubernetes/enhancements/tree/master/keps/sig-cluster-lifecycle/generic/1755-communicating-a-local-registry
88-
cat <<EOF | kubectl apply -f -
89-
apiVersion: v1
90-
kind: ConfigMap
91-
metadata:
92-
name: local-registry-hosting
93-
namespace: kube-public
94-
data:
95-
localRegistryHosting.v1: |
96-
host: "localhost:${reg_port}"
97-
help: "https://kind.sigs.k8s.io/docs/user/local-registry/"
98-
EOF
99-
100-
echo "6. Install ingress-nginx"
101-
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
102-
kubectl -n ingress-nginx create secret tls mkcert --key /tmp/127.0.0.1.nip.io+1-key.pem --cert /tmp/127.0.0.1.nip.io+1.pem
103-
kubectl -n ingress-nginx patch deployments.apps ingress-nginx-controller --type 'json' -p '[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value":"--default-ssl-certificate=ingress-nginx/mkcert"}]'
2+
curl https://raw.githubusercontent.com/numerique-gouv/tools/refs/heads/main/kind/create_cluster.sh | bash -s -- impress

Diff for: ‎secrets

-1
This file was deleted.

Diff for: ‎src/helm/env.d/dev/secrets.enc.yaml

-62
This file was deleted.

0 commit comments

Comments
 (0)