UPD - CICD - #11
Conversation
* ADD - Implement CI workflow * UPD - Refactor CI workflow to remove duplicate pnpm setup step * UPD - Refactor CI workflow to remove duplicate pnpm setup step * UPD - Simplify request handling by directly using params.uuid * UPD - Simplify request handling by directly using params.uuid * UPD - Simplify request handling by directly using params.uuid * UPD - Simplify request handling by directly using params.uuid * UPD - Update route parameter handling to use Promise for uuid extraction * UPD - Update route parameter handling to use Promise for uuid extraction * UPD - Enhance CI configuration by adding Docker metadata extraction and updating image tags * UPD - Enhance CI configuration by adding Docker metadata extraction and updating image tags * UPD - Add step to generate Prisma Client in CI configuration * UPD - Add step to generate Prisma Client in CI configuration * UPD - Update Dockerfile to generate Prisma Client and optimize production dependencies * UPD - Update Dockerfile to generate Prisma Client and optimize production dependencies * UPD - Refactor CI configuration to improve environment variable handling and streamline deployment conditions * UPD - Simplify CI configuration by removing environment input and directly setting deployment environments * UPD - Update CI configuration to enforce manual deployment conditions for dev and prod environments * UPD - Add CI workflows for manual deployment to DEV and PROD environments * UPD - Enhance CI configuration to support manual deployment to DEV and PROD environments * UPD - CI * UPD - CI * UPD - CI * UPD - CI * UPD - CI * UPD - CI * UPD - CI * UPD - CI * UPD - CI
* UPD - CI * UPD - CI
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup pnpm | ||
| uses: pnpm/action-setup@v3 | ||
| with: | ||
| version: 9 | ||
|
|
||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 20 | ||
| cache: 'pnpm' | ||
|
|
||
| - name: Install dependencies | ||
| run: pnpm install --frozen-lockfile | ||
|
|
||
| - name: Generate Prisma Client | ||
| run: pnpm prisma generate | ||
|
|
||
| - name: Skip tests (no test script defined) | ||
| run: echo "⚠️ Aucun test défini, étape ignorée." | ||
|
|
||
| - name: Build app | ||
| run: pnpm build | ||
|
|
||
| # 2️⃣ Build & push Docker image | ||
| docker-build-push: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 9 months ago
To fix this issue, the workflow should specify a permissions block for the build-and-test job or at the root level. Since the job doesn't require any write permissions, the minimal recommended value is contents: read. This change should be made by adding the following lines under the build-and-test job definition (.github/workflows/dev.yml, after line 17, before steps). No additional dependencies or imports are required.
| @@ -15,6 +15,8 @@ | ||
| # 1️⃣ Build & tests | ||
| build-and-test: | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
|
|
||
| steps: | ||
| - name: Checkout code |
| runs-on: self-hosted | ||
| needs: docker-build-push | ||
|
|
||
| steps: | ||
| - name: Clean workspace | ||
| run: rm -rf * | ||
|
|
||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Log in to GitHub Container Registry | ||
| uses: docker/login-action@v3 | ||
| with: | ||
| registry: ghcr.io | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Pull new image + restart DEV stack | ||
| run: | | ||
| echo "🔧 Deploying on DEV..." | ||
| cd /home/baptiste/Dev/WPT/dev | ||
| docker-compose pull | ||
| docker rm -f wpt-dev_website || true | ||
| docker-compose up -d --remove-orphans | ||
| echo "🚀 Deployed in DEV!" No newline at end of file |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 9 months ago
To fix the problem, we should add a permissions block to the deploy-dev job in .github/workflows/dev.yml. This restricts the permissions granted to the GITHUB_TOKEN for this job only, applying the principle of least privilege. Since none of the steps in the job require write access to the repository or GitHub APIs (they only run deployment commands, clean the workspace, and log in to container registry), the minimal set of permissions (contents: read) should be specified.
Specifically:
- Edit
.github/workflows/dev.yml. - Under
deploy-dev:and afterruns-on: self-hosted(and before or afterneeds: docker-build-push), insert:permissions: contents: read
- No imports or definitions are required. No functionality is changed.
| @@ -89,6 +89,8 @@ | ||
| deploy-dev: | ||
| runs-on: self-hosted | ||
| needs: docker-build-push | ||
| permissions: | ||
| contents: read | ||
|
|
||
| steps: | ||
| - name: Clean workspace |
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup pnpm | ||
| uses: pnpm/action-setup@v3 | ||
| with: | ||
| version: 9 | ||
|
|
||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 20 | ||
| cache: 'pnpm' | ||
|
|
||
| - name: Install dependencies | ||
| run: pnpm install --frozen-lockfile | ||
|
|
||
| - name: Generate Prisma Client | ||
| run: pnpm prisma generate | ||
|
|
||
| - name: Skip tests (no test script defined) | ||
| run: echo "⚠️ Aucun test défini, étape ignorée." | ||
|
|
||
| - name: Build app | ||
| run: pnpm build | ||
|
|
||
| # 2️⃣ Build & push Docker image | ||
| docker-build-push: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 9 months ago
To fix this issue, you should explicitly set a permissions block for the build-and-test job within .github/workflows/prod.yml to limit the GITHUB_TOKEN permissions to the minimum required. If nothing in this job needs write access (which is apparent from the steps, as they only build/test and don't interact with repository state), then contents: read is typically sufficient. Add the following block to the job under runs-on: ubuntu-latest:
permissions:
contents: readThis edit should be made in .github/workflows/prod.yml within the build-and-test job directly after runs-on: ubuntu-latest.
| @@ -9,6 +9,8 @@ | ||
| # 1️⃣ Build & tests | ||
| build-and-test: | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
|
|
||
| steps: | ||
| - name: Checkout code |
| runs-on: self-hosted | ||
| needs: docker-build-push | ||
|
|
||
| steps: | ||
| - name: Clean workspace | ||
| run: rm -rf * | ||
|
|
||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Log in to GitHub Container Registry | ||
| uses: docker/login-action@v3 | ||
| with: | ||
| registry: ghcr.io | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Pull new image + restart PROD stack | ||
| run: | | ||
| echo "🔧 Deploying on PROD..." | ||
| cd /home/baptiste/Dev/WPT/prod | ||
| docker-compose pull | ||
| docker rm -f wpt_website || true | ||
| docker-compose up -d --no-deps wpt_website | ||
| docker-compose up -d --remove-orphans | ||
| echo "🚀 Deployed in PROD!" |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 9 months ago
To fix this issue, we need to explicitly add a minimal permissions block to the deploy-prod job under jobs: in .github/workflows/prod.yml. As a starting point, contents: read should be used, which grants the least access—just enough to read repository content if needed, but not write to the repo, nor grant unauthorized access to secrets or actions. Place the block indented under the job (deploy-prod:) and before steps:. No additional imports or definitions are needed. No change is required to other jobs, since docker-build-push already sets a suitable permissions block.
| @@ -85,6 +85,8 @@ | ||
| deploy-prod: | ||
| runs-on: self-hosted | ||
| needs: docker-build-push | ||
| permissions: | ||
| contents: read | ||
|
|
||
| steps: | ||
| - name: Clean workspace |
2 participants
No description provided.