feat!: New secret management abstraction #7571
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - release | |
| pull_request: | |
| branches: | |
| - main | |
| - release | |
| env: | |
| GO_VERSION: "1.26.2" | |
| GOLANGCI_LINT_VERSION: "v2.9.0" | |
| HELM_VERSION: "3.18.5" | |
| HELM_UNITTEST_VERSION: "v1.0.0" | |
| KUBECONFORM_VERSION: "0.7.0" | |
| KUBERNETES_API_VERSION: "1.32.0" | |
| NODE_VERSION: "24.8.0" | |
| RUBY_VERSION: "3.4" | |
| COSIGN_VERSION: "v2.4.3" | |
| CYCLONEDX_GOMOD_VERSION: "v1.9.0" | |
| HUGO_VERSION: "0.150.0" | |
| DOCUMENTATION_URL: "https://dadrus.github.io/heimdall/" | |
| permissions: {} | |
| jobs: | |
| check-changes: | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| outputs: | |
| code_changed: ${{steps.changes.outputs.code}} | |
| test_data_changed: ${{steps.changes.outputs.testdata}} | |
| image_config_changed: ${{steps.changes.outputs.imageconfig}} | |
| helm_chart_changed: ${{steps.changes.outputs.helmchart}} | |
| docs_changed: ${{steps.changes.outputs.docs}} | |
| ci_config_changed: ${{steps.changes.outputs.ci}} | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Check code changes | |
| id: changes | |
| uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 | |
| with: | |
| base: ${{ github.ref }} | |
| filters: | | |
| code: | |
| - '*.go' | |
| - '**/*.go' | |
| - 'schema/*.json' | |
| - 'go.mod' | |
| - 'go.sum' | |
| testdata: | |
| - 'cmd/**/*.yaml' | |
| - 'internal/**/*.yaml' | |
| imageconfig: | |
| - 'docker/Dockerfile' | |
| helmchart: | |
| - 'charts/**' | |
| docs: | |
| - 'docs/**' | |
| ci: | |
| - '.github/workflows/**' | |
| check-licenses: | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| needs: | |
| - check-changes | |
| if: > | |
| needs.check-changes.outputs.code_changed == 'true' || | |
| needs.check-changes.outputs.ci_config_changed == 'true' | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Go | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 | |
| with: | |
| go-version: "${{ env.GO_VERSION }}" | |
| - name: Get google/go-licenses package | |
| run: go install github.com/google/go-licenses@v1.6.0 | |
| - name: Check the licenses | |
| run: go-licenses check --disallowed_types=forbidden,restricted,reciprocal,permissive,unknown . | |
| lint-code: | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| timeout-minutes: 10 | |
| needs: | |
| - check-changes | |
| if: > | |
| needs.check-changes.outputs.code_changed == 'true' || | |
| needs.check-changes.outputs.ci_config_changed == 'true' | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 | |
| - name: Review code | |
| uses: reviewdog/action-golangci-lint@c76cceaaab89abe74e649d2e34c6c9adc26662d2 # v2.10.0 | |
| with: | |
| go_version: "${{ env.GO_VERSION }}" | |
| golangci_lint_version: "${{ env.GOLANGCI_LINT_VERSION }}" | |
| reporter: github-pr-review | |
| fail_level: error | |
| lint-api: | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| needs: | |
| - check-changes | |
| if: > | |
| needs.check-changes.outputs.docs_changed == 'true' || | |
| needs.check-changes.outputs.ci_config_changed == 'true' | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Setup Node | |
| uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| - name: Run Redocly CLI | |
| run: npx --yes @redocly/cli@1.34.3 lint | |
| lint-dockerfiles: | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| needs: | |
| - check-changes | |
| if: > | |
| needs.check-changes.outputs.image_config_changed == 'true' || | |
| needs.check-changes.outputs.ci_config_changed == 'true' | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Run hadolint | |
| uses: reviewdog/action-hadolint@921946a7ebaaf08ac72607bad67209f4e52b5407 # v1.50.5 | |
| with: | |
| reporter: github-pr-review | |
| reviewdog_flags: -fail-level=error | |
| lint-helm-chart: | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| needs: | |
| - check-changes | |
| if: > | |
| needs.check-changes.outputs.helm_chart_changed == 'true' || | |
| needs.check-changes.outputs.ci_config_changed == 'true' | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Setup k8s tools | |
| uses: yokawasa/action-setup-kube-tools@5778123f7b071387e9c8e522492d8f39427dc6c7 # v0.13.4 | |
| with: | |
| setup-tools: | | |
| helm | |
| kubeconform | |
| helm: '${{ env.HELM_VERSION }}' | |
| kubeconform: '${{ env.KUBECONFORM_VERSION }}' | |
| - name: Helm Lint | |
| run: helm lint ./charts/heimdall | |
| - name: Kubeconform decision mode deployment | |
| run: | | |
| helm template --kube-version ${{ env.KUBERNETES_API_VERSION }} --set crds.enabled=true ./charts/heimdall > generated-config.yaml | |
| kubeconform \ | |
| -schema-location default \ | |
| -schema-location "https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master/{{ .NormalizedKubernetesVersion }}/{{ .ResourceKind }}.json" \ | |
| --skip RuleSet -kubernetes-version ${{ env.KUBERNETES_API_VERSION }} generated-config.yaml | |
| - name: Kubeconform proxy mode deployment | |
| run: | | |
| helm template --kube-version ${{ env.KUBERNETES_API_VERSION }} --set crds.enabled=true --set operationMode=proxy ./charts/heimdall > generated-config.yaml | |
| kubeconform \ | |
| -schema-location default \ | |
| -schema-location "https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master/{{ .NormalizedKubernetesVersion }}/{{ .ResourceKind }}.json" \ | |
| --skip RuleSet -kubernetes-version ${{ env.KUBERNETES_API_VERSION }} generated-config.yaml | |
| unittest-helm-chart: | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| needs: | |
| - check-changes | |
| if: > | |
| needs.check-changes.outputs.helm_chart_changed == 'true' || | |
| needs.check-changes.outputs.ci_config_changed == 'true' | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Setup k8s tools | |
| uses: yokawasa/action-setup-kube-tools@5778123f7b071387e9c8e522492d8f39427dc6c7 # v0.13.4 | |
| with: | |
| setup-tools: | | |
| helm | |
| kubeconform | |
| helm: '${{ env.HELM_VERSION }}' | |
| kubeconform: '${{ env.KUBECONFORM_VERSION }}' | |
| - name: Install Helm Unittest | |
| run: helm plugin install --version ${{ env.HELM_UNITTEST_VERSION }} https://github.com/helm-unittest/helm-unittest.git | |
| - name: Run tests | |
| run: | | |
| helm unittest ./charts/heimdall | |
| test: | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| timeout-minutes: 20 | |
| needs: | |
| - check-changes | |
| if: > | |
| needs.check-changes.outputs.code_changed == 'true' || | |
| needs.check-changes.outputs.test_data_changed == 'true' || | |
| needs.check-changes.outputs.ci_config_changed == 'true' | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Go | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 | |
| with: | |
| go-version: "${{ env.GO_VERSION }}" | |
| - name: Install go-junit-report | |
| run: go install github.com/jstemmer/go-junit-report/v2@v2.1.0 | |
| - name: Test | |
| run: | | |
| set -o pipefail | |
| go test -v -coverprofile=coverage.cov -coverpkg=./... ./... 2>&1 | \ | |
| tee >(go-junit-report -set-exit-code > junit-report.xml) | |
| - name: Upload test results to Codecov | |
| uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0 | |
| if: always() && !cancelled() | |
| with: | |
| report_type: test_results | |
| files: junit-report.xml | |
| verbose: true | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| - name: Upload code coverage report to Codecov | |
| uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0 | |
| with: | |
| report_type: coverage | |
| files: coverage.cov | |
| verbose: true | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| build-binaries: | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| timeout-minutes: 20 | |
| needs: | |
| - test | |
| if: needs.test.result == 'success' | |
| strategy: | |
| matrix: | |
| # build and publish in parallel: linux/amd64, linux/arm64, windows/amd64, darwin/amd64, darwin/arm64 | |
| goos: [ linux, windows, darwin ] | |
| goarch: [ amd64, arm64, arm ] | |
| exclude: | |
| - goarch: arm | |
| goos: darwin | |
| - goarch: arm | |
| goos: windows | |
| - goarch: arm64 | |
| goos: windows | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Go | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 | |
| with: | |
| go-version: "${{ env.GO_VERSION }}" | |
| - name: Build | |
| run: CGO_ENABLED=0 GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} go build -trimpath -buildvcs=false -ldflags="-buildid= -w -s -X github.com/dadrus/heimdall/version.Version=${{ github.sha }}" -o ./build/ | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| if: github.ref == 'refs/heads/main' | |
| with: | |
| name: build-result-${{ matrix.goos }}-${{ matrix.goarch }} | |
| path: ./build/* | |
| retention-days: 30 | |
| build-dev-container-images: | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| timeout-minutes: 20 | |
| needs: | |
| - test | |
| - check-changes | |
| if: > | |
| github.ref != 'refs/heads/main' && | |
| (needs.test.result == 'success' || (needs.test.result == 'skipped' && needs.check-changes.outputs.image_config_changed == 'true')) | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Go # required as the sbom generator is compiled using go < 1.21 | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 | |
| with: | |
| go-version: "${{ env.GO_VERSION }}" | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 | |
| - name: Build images | |
| uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 | |
| with: | |
| context: . | |
| file: ./docker/Dockerfile | |
| platforms: linux/amd64,linux/arm64,linux/arm | |
| push: false | |
| build-args: VERSION=${{ github.sha }} | |
| tags: ${{ github.repository }}:local | |
| publish-dev-container-images: | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| timeout-minutes: 20 | |
| needs: | |
| - test | |
| - check-changes | |
| if: > | |
| github.ref == 'refs/heads/main' && | |
| (needs.test.result == 'success' || (needs.test.result == 'skipped' && needs.check-changes.outputs.image_config_changed == 'true')) | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1 | |
| with: | |
| cosign-release: "${{ env.COSIGN_VERSION }}" | |
| - name: Set up Go # required as the sbom generator is compiled using go < 1.21 | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 | |
| with: | |
| go-version: "${{ env.GO_VERSION }}" | |
| - name: Generate SBOM | |
| uses: CycloneDX/gh-gomod-generate-sbom@efc74245d6802c8cefd925620515442756c70d8f # v2.0.0 | |
| with: | |
| version: "${{ env.CYCLONEDX_GOMOD_VERSION }}" | |
| args: app -licenses -assert-licenses -json -std -output CycloneDX-SBOM.json -main . | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 | |
| - name: Collect container meta-info for DockerHub | |
| id: dockerhub-meta | |
| uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0 | |
| with: | |
| images: ${{ github.repository }} | |
| labels: | | |
| org.opencontainers.image.version=${{ github.sha }} | |
| org.opencontainers.image.documentation=${{ env.DOCUMENTATION_URL }} | |
| - name: Collect container meta-info for GHCR | |
| id: ghcr-meta | |
| uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0 | |
| with: | |
| images: ghcr.io/${{ github.repository }} | |
| labels: | | |
| org.opencontainers.image.version=${{ github.sha }} | |
| org.opencontainers.image.documentation=${{ env.DOCUMENTATION_URL }} | |
| - name: Login to DockerHub | |
| uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USER }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: Login to GitHub | |
| uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build and push dev image to DockerHub | |
| id: dockerhub-image | |
| uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 | |
| with: | |
| context: . | |
| file: ./docker/Dockerfile | |
| platforms: linux/amd64,linux/arm64,linux/arm | |
| push: true | |
| build-args: VERSION=${{ github.sha }} | |
| labels: ${{ steps.dockerhub-meta.outputs.labels }} | |
| tags: | | |
| ${{ github.repository }}:dev | |
| ${{ github.repository }}:dev-${{ github.sha }} | |
| - name: Build and push dev image to GHCR | |
| id: ghcr-image | |
| uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 | |
| with: | |
| context: . | |
| file: ./docker/Dockerfile | |
| platforms: linux/amd64,linux/arm64,linux/arm | |
| push: true | |
| build-args: VERSION=${{ github.sha }} | |
| labels: ${{ steps.ghcr-meta.outputs.labels }} | |
| tags: | | |
| ghcr.io/${{ github.repository }}:dev | |
| ghcr.io/${{ github.repository }}:dev-${{ github.sha }} | |
| - name: Sign the image published in DockerHub | |
| if: steps.dockerhub-image.conclusion == 'success' | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| COSIGN_REPOSITORY: ${{ github.repository }}-signatures | |
| run: cosign sign --yes ${{ github.repository }}@${{ steps.dockerhub-image.outputs.digest }} | |
| - name: Attest and attach SBOM to the image published in DockerHub | |
| if: steps.dockerhub-image.conclusion == 'success' | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| COSIGN_REPOSITORY: ${{ github.repository }}-sbom | |
| run: cosign attest --yes --predicate CycloneDX-SBOM.json --type cyclonedx ${{ github.repository }}@${{ steps.dockerhub-image.outputs.digest }} | |
| - name: Sign the image published in GitHub | |
| if: steps.ghcr-image.conclusion == 'success' | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| COSIGN_REPOSITORY: ghcr.io/${{ github.repository }}-signatures | |
| run: cosign sign --yes ghcr.io/${{ github.repository }}@${{ steps.ghcr-image.outputs.digest }} | |
| - name: Attest and attach SBOM to the image published in GitHub | |
| if: steps.ghcr-image.conclusion == 'success' | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| COSIGN_REPOSITORY: ghcr.io/${{ github.repository }}-sbom | |
| run: cosign attest --yes --predicate CycloneDX-SBOM.json --type cyclonedx ghcr.io/${{ github.repository }}@${{ steps.ghcr-image.outputs.digest }} | |
| build-dev-documentation: | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| timeout-minutes: 20 | |
| needs: | |
| - check-changes | |
| if: > | |
| needs.check-changes.outputs.docs_changed == 'true' || | |
| needs.check-changes.outputs.ci_config_changed == 'true' | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| persist-credentials: false | |
| submodules: true # Fetch Hugo themes (true OR recursive) | |
| fetch-depth: 0 # Fetch all history for .GitInfo and .Lastmod | |
| - name: Setup Hugo | |
| uses: peaceiris/actions-hugo@75d2e84710de30f6ff7268e08f310b60ef14033f # v3.0.0 | |
| with: | |
| hugo-version: ${{ env.HUGO_VERSION }} | |
| extended: true | |
| - name: Setup Node | |
| uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| - name: Setup ruby | |
| uses: ruby/setup-ruby@7372622e62b60b3cb750dcd2b9e32c247ffec26a # v1.302.0 | |
| with: | |
| ruby-version: ${{ env.RUBY_VERSION }} | |
| - name: Install asciidoctor | |
| run: gem install asciidoctor asciidoctor-diagram asciidoctor-html5s asciidoctor-diagram-ditaamini rouge | |
| - name: Install dependencies | |
| working-directory: ./docs | |
| run: npm ci | |
| - name: Update version string to dev version | |
| uses: jacobtomlinson/gha-find-replace@2ff30f644d2e0078fc028beb9193f5ff0dcad39e # v3 | |
| with: | |
| find: "x-current-version" | |
| replace: "dev" | |
| regex: false | |
| include: docs/** | |
| - name: Build documentation | |
| working-directory: ./docs | |
| run: hugo --minify -d ./public | |
| - name: Upload documentation artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: dev-docs | |
| path: ./docs/public/* | |
| retention-days: 1 | |
| deploy-dev-documentation: | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: write | |
| timeout-minutes: 20 | |
| needs: | |
| - build-dev-documentation | |
| if: github.ref == 'refs/heads/main' | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0 | |
| with: | |
| egress-policy: audit | |
| - name: Download documentation artifact | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: dev-docs | |
| path: ./docs | |
| - name: Deploy documentation | |
| uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0 | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| publish_dir: ./docs | |
| destination_dir: dev |