secure-doc-api/cloudbuild.yaml at master · mohammadanang/secure-doc-api · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
steps:
  # ==========================================
  # STEP 1A: Unit Test
  # ==========================================
  - name: 'golang:1.24'
    id: 'Tingkat-1A-Unit-Test'
    entrypoint: 'bash'
    args:
      - '-c'
      - |
        echo "Menjalankan Golang Unit Test..."
        go test ./... -v

  # ==========================================
  # STEP 1B: SAST (Static Application Security Testing)
  # ==========================================
  - name: 'golang:1.24'
    id: 'Tingkat-1B-Security-Scan'
    entrypoint: 'bash'
    args:
      - '-c'
      - |
        echo "Menginstal Gosec..."
        go install github.com/securego/gosec/v2/cmd/gosec@v2.22.0

        echo "Menjalankan Gosec Security Scan..."
        /go/bin/gosec -no-fail -fmt=text -out=results.txt ./...

        echo "=== HASIL SCAN KEAMANAN ==="
        cat results.txt

  # ==========================================
  # STEP 2: Build Docker Image
  # ==========================================
  # Membangun image menggunakan Secure Dockerfile yang sudah kita buat
  # Kita menggunakan tag $COMMIT_SHA (ID unik dari GitHub commit) sebagai versioning
  - name: 'gcr.io/cloud-builders/docker'
    id: 'Tingkat-2-Build-Image'
    args:
      - 'build'
      - '-t'
      - '$_REGION-docker.pkg.dev/$PROJECT_ID/$_REPO_NAME/$_IMAGE_NAME:$COMMIT_SHA'
      - '.'

  # ==========================================
  # STEP 3: Push ke Artifact Registry
  # ==========================================
  # Menyimpan image ke Artifact Registry.
  # *Catatan DevSecOps: Setelah di-push, Artifact Registry akan otomatis melakukan Container Vulnerability Scanning!
  - name: 'gcr.io/cloud-builders/docker'
    id: 'Tingkat-3-Push-Artifact'
    args:
      - 'push'
      - '$_REGION-docker.pkg.dev/$PROJECT_ID/$_REPO_NAME/$_IMAGE_NAME:$COMMIT_SHA'

  # ==========================================
  # STEP 4: CD - Deploy ke Kubernetes (GKE)
  # ==========================================
  # Memperbarui image pada Deployment Kubernetes yang sudah berjalan dengan image baru
  - name: 'gcr.io/cloud-builders/kubectl'
    id: 'Tingkat-4-Deploy-GKE'
    args:
      - 'set'
      - 'image'
      - 'deployment/$_K8S_DEPLOYMENT_NAME'
      - '$_K8S_CONTAINER_NAME=$_REGION-docker.pkg.dev/$PROJECT_ID/$_REPO_NAME/$_IMAGE_NAME:$COMMIT_SHA'
    env:
      - 'CLOUDSDK_COMPUTE_REGION=$_REGION'
      - 'CLOUDSDK_CONTAINER_CLUSTER=$_CLUSTER_NAME'

# ==========================================
# Variabel Substitusi (Ubah sesuai dengan project GCP Anda)
# ==========================================
substitutions:
  _REGION: 'us-central1'                         # Region standar untuk Free Trial
  _REPO_NAME: 'secure-doc-repo'                  # Nama repository di Artifact Registry
  _IMAGE_NAME: 'secure-doc-api'                  # Nama Docker Image
  _CLUSTER_NAME: 'secure-gke-cluster'            # Nama klaster GKE Anda
  _K8S_DEPLOYMENT_NAME: 'secure-api-deployment'  # Nama deployment di Kubernetes
  _K8S_CONTAINER_NAME: 'secure-api'              # Nama container di dalam pod Kubernetes

# Memastikan image dicatat di Cloud Build build logs
images:
  - '$_REGION-docker.pkg.dev/$PROJECT_ID/$_REPO_NAME/$_IMAGE_NAME:$COMMIT_SHA'

# ==========================================
# WAJIB: Konfigurasi Logging untuk Service Account
# ==========================================
options:
  logging: CLOUD_LOGGING_ONLY