6516f756f3Addresses the security concern where secrets were directly interpolated in GitHub Actions run commands across multiple workflows. Following [GitHub's security best practices](https://docs.github.com/en/actions/reference/security/secure-use#use-an-intermediate-environment-variable), secrets are now passed through intermediate environment variables (matching the secret names: `PULUMI_STAGING_PASSPHRASE` and `PULUMI_PROD_PASSPHRASE`) before being written to files. ## Changes **deploy.yml:** - Fixed staging deployment (line 92) - Fixed production deployment (line 131) **cancel-pulumi-lock.yml:** - Fixed staging lock cancellation (line 62) - Fixed production lock cancellation (line 70) ## Benefits This approach: - Fixes the security issue with direct secret interpolation in 4 locations - Maintains compatibility with existing local development workflows - Keeps the Makefile unchanged - Uses environment variable names that match the secret names for clarity The key improvement is that `${{ secrets.X }}` is no longer expanded directly in the run commands, reducing the risk of accidental disclosure if GitHub's masking fails or is bypassed.
136 lines
4.1 KiB
YAML
136 lines
4.1 KiB
YAML
name: Deploy
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
PULUMI_VERSION: "3.188.0"
|
|
|
|
jobs:
|
|
docker-push:
|
|
name: Build Docker Image
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435
|
|
|
|
- name: Log in to Container Registry
|
|
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Extract metadata
|
|
id: meta
|
|
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f
|
|
with:
|
|
images: ghcr.io/${{ github.repository }}
|
|
tags: |
|
|
type=sha,prefix=main-{{date 'YYYYMMDD'}}-,enable={{is_default_branch}}
|
|
type=raw,value=main,enable={{is_default_branch}}
|
|
|
|
- name: Build and push Docker image
|
|
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
|
|
with:
|
|
context: .
|
|
file: ./Dockerfile
|
|
platforms: linux/amd64,linux/arm64
|
|
push: true
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
cache-from: type=gha
|
|
cache-to: type=gha,mode=max
|
|
|
|
deploy-staging:
|
|
name: Deploy to Staging
|
|
runs-on: ubuntu-latest
|
|
environment: staging
|
|
needs: docker-push
|
|
concurrency:
|
|
group: deploy-staging
|
|
cancel-in-progress: false
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
|
|
|
|
- name: Setup Go
|
|
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00
|
|
with:
|
|
go-version-file: 'go.mod'
|
|
|
|
- name: Setup Pulumi
|
|
uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e
|
|
with:
|
|
pulumi-version: ${{ env.PULUMI_VERSION }}
|
|
|
|
- name: Authenticate to Google Cloud
|
|
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
|
|
with:
|
|
credentials_json: ${{ secrets.GCP_STAGING_SERVICE_ACCOUNT_KEY }}
|
|
|
|
- name: Setup Google Cloud SDK
|
|
uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
|
|
with:
|
|
project_id: mcp-registry-staging
|
|
install_components: gke-gcloud-auth-plugin
|
|
|
|
- name: Deploy to Staging
|
|
working-directory: ./deploy
|
|
env:
|
|
PULUMI_STAGING_PASSPHRASE: ${{ secrets.PULUMI_STAGING_PASSPHRASE }}
|
|
run: |
|
|
echo "$PULUMI_STAGING_PASSPHRASE" > passphrase.staging.txt
|
|
make staging-up
|
|
|
|
deploy-production:
|
|
name: Deploy to Production
|
|
runs-on: ubuntu-latest
|
|
environment: production
|
|
needs: deploy-staging
|
|
concurrency:
|
|
group: deploy-production
|
|
cancel-in-progress: false
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
|
|
|
|
- name: Setup Go
|
|
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00
|
|
with:
|
|
go-version-file: 'go.mod'
|
|
|
|
- name: Setup Pulumi
|
|
uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e
|
|
with:
|
|
pulumi-version: ${{ env.PULUMI_VERSION }}
|
|
|
|
- name: Authenticate to Google Cloud
|
|
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
|
|
with:
|
|
credentials_json: ${{ secrets.GCP_PROD_SERVICE_ACCOUNT_KEY }}
|
|
|
|
- name: Setup Google Cloud SDK
|
|
uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
|
|
with:
|
|
project_id: mcp-registry-prod
|
|
install_components: gke-gcloud-auth-plugin
|
|
|
|
- name: Deploy to Production
|
|
working-directory: ./deploy
|
|
env:
|
|
PULUMI_PROD_PASSPHRASE: ${{ secrets.PULUMI_PROD_PASSPHRASE }}
|
|
run: |
|
|
echo "$PULUMI_PROD_PASSPHRASE" > passphrase.prod.txt
|
|
make prod-up
|