feat: Helm chart #1086
feat: Helm chart #1086
Conversation
|
Preview (prod backend + PR dashboard) → https://1086.ns-preview.trapti.tech/ |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
motoki317
force-pushed
the
feat/helm-chart
branch
from
fe1701a to
979115b
Compare
motoki317
force-pushed
the
feat/helm-chart
branch
from
979115b to
fb8d289
Compare
motoki317
force-pushed
the
feat/helm-chart
branch
from
fb8d289 to
d8901de
Compare
|
@pirosiki197 テスト用リポジトリ: https://github.com/motoki317/actions-test |
| needs: [ tag ] | ||
| uses: ./.github/workflows/release-helm.yaml | ||
| with: | ||
| strategy: ${{ inputs.strategy }} |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 4 months ago
To fix the problem, add a permissions block to the workflow, either at the root level (applies to all jobs) or to each job individually. The minimal required permissions for this workflow are likely contents: write (to allow pushing tags) and possibly actions: read (for workflow usage), but the most important is contents: write for the tag job. For jobs that only use other workflows (like release and helm-tag), contents: read is usually sufficient. The best approach is to add a root-level permissions block with contents: write, which will apply to all jobs unless overridden. This should be added after the name and run-name fields, before the on block.
| @@ -1,5 +1,7 @@ | ||
| name: Create new tag | ||
| run-name: Create new tag (${{ inputs.strategy }}) | ||
| permissions: | ||
| contents: write | ||
|
|
||
| on: | ||
| workflow_dispatch: |
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v5 | ||
| with: | ||
| fetch-depth: '0' | ||
|
|
||
| - name: Git config | ||
| run: | | ||
| git config user.name "github-actions[bot]" | ||
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | ||
| - name: Update helm Chart.yaml | ||
| run: | | ||
| cd charts | ||
| ./bump.sh ${{ inputs.chart }} ${{ github.event.inputs.strategy }} | ||
| cd .. | ||
| - name: Commit and push helm changes | ||
| run: | | ||
| git add charts/${{ inputs.chart }}/Chart.yaml | ||
| git commit -m "Update charts/${{ inputs.chart }} to ${{ steps.calc-tag.outputs.new-raw }}" | ||
| git push | ||
| - uses: docker/login-action@v3 | ||
| with: | ||
| registry: ghcr.io | ||
| username: ${{ env.REGISTRY_USER }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Publish chart | ||
| run: | | ||
| cd charts | ||
| ./publish.sh ${{ inputs.chart }} oci://ghcr.io/${{ env.REGISTRY_USER }}/charts |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 4 months ago
To fix the problem, add a permissions block to the workflow to restrict the permissions granted to the GITHUB_TOKEN. The block should be placed at the top level of the workflow (before jobs:) to apply to all jobs, unless a job requires different permissions. For this workflow, since it pushes commits and publishes to a registry, it needs contents: write (to push changes to the repository). If it interacts with other resources (such as packages or pull requests), those permissions should be added as needed, but based on the provided code, only contents: write is required. The change should be made at the top of the file, after the name and run-name fields and before on:.
| @@ -1,5 +1,7 @@ | ||
| name: Release helm chart | ||
| run-name: Release helm chart (${{ inputs.strategy }}) | ||
| permissions: | ||
| contents: write | ||
|
|
||
| on: | ||
| workflow_dispatch: |
|
何度も変更してすみません |
motoki317
force-pushed
the
feat/helm-chart
branch
from
595793e to
8eae0ee
Compare
なぜやるか
Helm chartを導入
アプリケーションと、よく行う冗長な設定を一緒にパッケージ化し、必要なところだけをいじれるようにします。
kustomizeでのパッチ祭りが辛くなってきたら、helmに移行していくと良いと思います。
やったこと
helm createから作成)使い方
以下の使い方を参考にしてください
.local-manifest/ns-system以下.local-manifestディレクトリでmake upで立ち上げでテスト可能ですやらなかったこと
https://github.com/googleapis/release-please がHelmに対応しており、ちゃんとしているリポジトリはこういうものを使っているイメージがあるのですが、
semverに沿う必要があったり、色々考慮事項がありそうなので、一旦shell芸でがっとシンプルにやってしまいました
資料
actions周りのテスト用リポジトリ: https://github.com/motoki317/actions-test