5b2b01db21Addresses security concern where secrets were directly interpolated in run commands. Following GitHub's security best practices, the secret is now passed through an intermediate environment variable before being written to the file. This maintains compatibility with the existing Makefile workflow while reducing the risk of accidental secret disclosure.
56 lines
No EOL
1.2 KiB
YAML
56 lines
No EOL
1.2 KiB
YAML
name: Deploy
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
PULUMI_VERSION: "3.197.0"
|
|
|
|
jobs:
|
|
deploy-production:
|
|
name: Deploy to Production
|
|
runs-on: ubuntu-latest
|
|
environment: production
|
|
concurrency:
|
|
group: deploy-production
|
|
cancel-in-progress: false
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '22'
|
|
cache: 'npm'
|
|
|
|
- name: Setup Pulumi
|
|
uses: pulumi/actions@v6
|
|
with:
|
|
pulumi-version: ${{ env.PULUMI_VERSION }}
|
|
|
|
- name: Install Pulumi packages
|
|
run: pulumi install
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Build
|
|
run: npm run build
|
|
|
|
- name: Authenticate to Google Cloud
|
|
uses: google-github-actions/auth@v2
|
|
with:
|
|
credentials_json: ${{ secrets.GCP_PROD_SERVICE_ACCOUNT_KEY }}
|
|
|
|
- name: Deploy to Production
|
|
env:
|
|
PULUMI_PASSPHRASE: ${{ secrets.PULUMI_PROD_PASSPHRASE }}
|
|
run: |
|
|
echo "$PULUMI_PASSPHRASE" > passphrase.prod.txt
|
|
make up |