mlops-python-package/.github/workflows/cd.yml at main · fmind/mlops-python-package · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
# https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax
name: CD
on:
  release:
    types: [published]
permissions:
  contents: read
jobs:
  checks:
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install mise toolchain
        uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2
        with:
          cache: false
      - name: Run release gate
        run: mise run all
      - name: Verify no generated changes
        run: test -z "$(git status --porcelain)" || { git status --porcelain; git diff; exit 1; }
  pages:
    needs: checks
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    permissions:
      contents: read
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false # no step pushes back to the repository
      - name: Install mise toolchain
        uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2
        with:
          cache: false # a poisoned tool cache must never reach published artifacts
      - name: Build API documentation
        run: mise run docs
      - name: Configure Pages
        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
      - name: Upload Pages artifact
        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
        with:
          path: docs/
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
  image:
    needs: checks
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false # the registry login below carries its own token
      - name: Install mise toolchain
        uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2
        with:
          cache: false
      - name: Set lower-case image path
        # GitHub expands `${{ }}` before the shell runs, so repository references reach
        # the script through `env:` rather than being interpolated into the command.
        env:
          REPOSITORY: ${{ github.repository }}
        run: echo "IMAGE=$(echo "ghcr.io/$REPOSITORY" | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_ENV"
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
      - name: Build and push candidate image
        id: build
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          push: true
          tags: ${{ env.IMAGE }}:candidate-${{ github.sha }}
      - name: Scan candidate image
        env:
          IMAGE_REF: ${{ env.IMAGE }}@${{ steps.build.outputs.digest }}
        run: mise exec -- trivy --config trivy.yaml image --skip-dirs '' --platform linux/amd64 --scanners misconfig,secret,vuln "$IMAGE_REF"
      - name: Record license inventory
        env:
          IMAGE_REF: ${{ env.IMAGE }}@${{ steps.build.outputs.digest }}
        # Debian ships reciprocal licenses; inventory them separately from security findings.
        run: mise exec -- trivy --config trivy.yaml image --skip-dirs '' --platform linux/amd64 --scanners license --exit-code 0 "$IMAGE_REF"
      - name: Promote verified digest
        env:
          IMAGE_REF: ${{ env.IMAGE }}@${{ steps.build.outputs.digest }}
          VERSION: ${{ github.ref_name }}
        run: docker buildx imagetools create --tag "$IMAGE:$VERSION" --tag "$IMAGE:latest" "$IMAGE_REF"