ci(strapi): enable GitOps image bump via PR #6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Strapi CI (build -> push -> PR bump GitOps) | |
| on: | |
| push: | |
| branches: ["main"] | |
| paths: | |
| - "strapi/**" | |
| - ".github/workflows/strapi-ci.yml" | |
| workflow_dispatch: {} | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| packages: write | |
| concurrency: | |
| group: strapi-ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| build_scan_push_and_pr: | |
| runs-on: ubuntu-latest | |
| # Avoid running again on the PR-commit that only changes GitOps (and is made by the bot) | |
| if: github.actor != 'github-actions[bot]' | |
| env: | |
| IMAGE: ghcr.io/${{ github.repository_owner }}/strapi | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: "20" | |
| - name: Install deps | |
| working-directory: strapi | |
| run: npm ci | |
| - name: Build Strapi admin | |
| working-directory: strapi | |
| run: npm run build | |
| - name: Setup Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Login to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| # Use full SHA (best for immutable GitOps) | |
| - name: Compute tag (commit SHA) | |
| id: tag | |
| run: echo "t=${GITHUB_SHA}" >> "$GITHUB_OUTPUT" | |
| - name: Build and push (immutable tag only) | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: ./strapi | |
| file: ./strapi/Dockerfile | |
| push: true | |
| tags: | | |
| ${{ env.IMAGE }}:${{ steps.tag.outputs.t }} | |
| - name: Trivy scan (HIGH/CRITICAL) | |
| uses: aquasecurity/trivy-action@0.28.0 | |
| with: | |
| image-ref: ${{ env.IMAGE }}:${{ steps.tag.outputs.t }} | |
| format: table | |
| severity: HIGH,CRITICAL | |
| ignore-unfixed: true | |
| exit-code: "0" | |
| # Defensive cleanup: avoid committing any trivy artifacts (some actions may write to workspace) | |
| - name: Cleanup workspace (avoid committing trivy artifacts) | |
| run: | | |
| rm -rf trivy .trivy || true | |
| - name: Bump Helm values.yaml image.tag to SHA | |
| env: | |
| FILE: gitops/apps/strapi/chart/values.yaml | |
| SHA: ${{ steps.tag.outputs.t }} | |
| run: | | |
| set -euo pipefail | |
| python3 - <<'PY' | |
| import os | |
| path = os.environ["FILE"] | |
| sha = os.environ["SHA"] | |
| lines = open(path, "r", encoding="utf-8").read().splitlines(True) | |
| out = [] | |
| in_image = False | |
| image_indent = None | |
| for line in lines: | |
| if not in_image and line.lstrip().startswith("image:"): | |
| in_image = True | |
| image_indent = len(line) - len(line.lstrip()) | |
| out.append(line) | |
| continue | |
| if in_image: | |
| cur_indent = len(line) - len(line.lstrip()) | |
| # exit image block on next top-level key | |
| if line.strip() and cur_indent <= image_indent and not line.lstrip().startswith(("#", "-")): | |
| in_image = False | |
| if in_image and line.lstrip().startswith("tag:"): | |
| indent = line[:len(line) - len(line.lstrip())] | |
| out.append(f'{indent}tag: "{sha}"\n') | |
| else: | |
| out.append(line) | |
| open(path, "w", encoding="utf-8").write("".join(out)) | |
| PY | |
| - name: Create PR for GitOps bump | |
| uses: peter-evans/create-pull-request@v6 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| branch: ci/strapi-bump-${{ steps.tag.outputs.t }} | |
| delete-branch: true | |
| base: main | |
| # IMPORTANT: only commit the GitOps file; prevents accidentally committing trivy/ or other artifacts | |
| add-paths: | | |
| gitops/apps/strapi/chart/values.yaml | |
| commit-message: "chore(strapi): bump image tag to ${{ steps.tag.outputs.t }}" | |
| title: "chore(strapi): bump image tag to ${{ steps.tag.outputs.t }}" | |
| body: | | |
| This PR updates Strapi GitOps source-of-truth to the new immutable image tag. | |
| - Image: `${{ env.IMAGE }}:${{ steps.tag.outputs.t }}` | |
| - File: `gitops/apps/strapi/chart/values.yaml` | |
| Merge -> ArgoCD auto-sync -> rollout. |