change h5p to index html #8859
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: push workflow | |
| on: | |
| push: | |
| branches-ignore: | |
| - dependabot/** | |
| pull_request: | |
| types: [labeled] | |
| permissions: | |
| contents: read | |
| jobs: | |
| build_and_push_nuxt: | |
| # this basically means do not execute it as dependabot unless it is labeled as ready-for-ci | |
| # because automated processes and pr from forks are dangerous, therefore those prs won't have access to secrets, labeling them acts like allow-listing them | |
| # more details here https://docs.github.com/en/rest/dependabot/secrets?apiVersion=2022-11-28 | |
| # even when re-running an action manually the actor stays the same as of mid 2022, details here https://github.blog/changelog/2022-07-19-differentiating-triggering-actor-from-executing-actor/ | |
| #https://github.com/actions/runner/issues/1173#issuecomment-1354501147 when false equals true, you have to come up with something ... | |
| if: | | |
| (github.actor == 'dependabot[bot]' && | |
| contains(github.event.issue.labels.*.name, 'ready-for-ci') == 'true') || | |
| github.actor != 'dependabot[bot]' | |
| runs-on: ubuntu-latest | |
| needs: | |
| - branch_meta | |
| permissions: | |
| packages: write | |
| strategy: | |
| matrix: | |
| tenants: [default, brb, n21, thr] | |
| steps: | |
| - uses: actions/checkout@v3 | |
| with: | |
| fetch-depth: 0 | |
| - name: Docker meta Service Name | |
| id: docker_meta_img | |
| uses: docker/metadata-action@v4 | |
| with: | |
| images: ghcr.io/${{ github.repository }}-${{ matrix.tenants }} | |
| tags: | | |
| type=ref,event=branch,enable=false,priority=600 | |
| type=sha,enable=true,priority=600,prefix= | |
| - name: Log into registry | |
| uses: docker/login-action@v2 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: test image exists | |
| run: | | |
| mkdir -p ~/.docker | |
| echo '{"experimental": "enabled"}' >> ~/.docker/config.json | |
| echo "IMAGE_EXISTS=$(docker manifest inspect ghcr.io/${{ github.repository }}-${{ matrix.tenants }}:${{ needs.branch_meta.outputs.sha }} > /dev/null && echo 1 || echo 0)" >> $GITHUB_ENV | |
| - name: Set up Docker Buildx | |
| if: ${{ env.IMAGE_EXISTS == 0 }} | |
| uses: docker/setup-buildx-action@v2 | |
| - name: Build and push ${{ github.repository }} | |
| if: ${{ env.IMAGE_EXISTS == 0 }} | |
| uses: docker/build-push-action@v3 | |
| with: | |
| build-args: | | |
| SC_THEME=${{ matrix.tenants }} | |
| context: . | |
| file: ./Dockerfile | |
| platforms: linux/amd64 | |
| push: true | |
| tags: ghcr.io/${{ github.repository }}-${{ matrix.tenants }}:${{ needs.branch_meta.outputs.sha }} | |
| labels: ${{ steps.docker_meta_img.outputs.labels }} | |
| branch_meta: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| branch: ${{ steps.extract_branch_meta.outputs.branch }} | |
| sha: ${{ steps.extract_branch_meta.outputs.sha }} | |
| steps: | |
| - name: Extract branch meta | |
| shell: bash | |
| id: extract_branch_meta | |
| run: | | |
| if [ "${{ github.event_name }}" == 'pull_request' ]; then | |
| echo "branch=${{ github.event.pull_request.head.ref }}" >> $GITHUB_OUTPUT | |
| echo "sha=${{ github.event.pull_request.head.sha }}" >> $GITHUB_OUTPUT | |
| else | |
| echo "branch=${GITHUB_REF#refs/heads/}" >> $GITHUB_OUTPUT | |
| echo "sha=${{ github.sha }}" >> $GITHUB_OUTPUT | |
| fi | |
| deploy: | |
| needs: | |
| - build_and_push_nuxt | |
| - branch_meta | |
| uses: hpi-schul-cloud/dof_app_deploy/.github/workflows/deploy.yml@main | |
| with: | |
| branch: ${{ needs.branch_meta.outputs.branch }} | |
| secrets: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| DEV_VAULT: ${{ secrets.DEV_VAULT }} | |
| DEV_KUBE_CONFIG: ${{ secrets.DEV_KUBE_CONFIG }} | |
| BINGO_REPO_TOKEN: ${{ secrets.BINGO_REPO_TOKEN }} | |
| deploy-successful: | |
| needs: | |
| - deploy | |
| runs-on: ubuntu-latest | |
| steps: | |
| - run: echo "deploy was successful" | |
| end-to-end-tests: | |
| needs: | |
| - build_and_push_nuxt | |
| - branch_meta | |
| uses: hpi-schul-cloud/end-to-end-tests/.github/workflows/e2e_call.yml@main | |
| with: | |
| ref: ${{ needs.branch_meta.outputs.branch }} | |
| cy-e2e-tests: | |
| needs: | |
| - branch_meta | |
| - deploy | |
| uses: hpi-schul-cloud/e2e-system-tests/.github/workflows/remote-trigger.yml@main | |
| with: | |
| ref: ${{ needs.branch_meta.outputs.branch }} | |
| secrets: inherit | |
| test-successful: | |
| runs-on: ubuntu-latest | |
| needs: | |
| - end-to-end-tests | |
| steps: | |
| - run: echo "Test was successful" | |
| trivy-vulnerability-scanning: | |
| needs: | |
| - build_and_push_nuxt | |
| - branch_meta | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: run trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@9ab158e8597f3b310480b9a69402b419bc03dbd5 | |
| with: | |
| image-ref: "ghcr.io/${{ github.repository }}-default:${{ needs.branch_meta.outputs.sha }}" | |
| format: "sarif" | |
| output: "trivy-results.sarif" | |
| severity: "CRITICAL,HIGH" | |
| ignore-unfixed: true | |
| - name: upload trivy results | |
| if: ${{ always() }} | |
| uses: github/codeql-action/upload-sarif@v2 | |
| with: | |
| sarif_file: "trivy-results.sarif" |