add oauth

social-tw · Oct 18, 2023 · c53241b · c53241b
1 parent fe4dea3
commit c53241b
Show file tree

Hide file tree

Showing 2 changed files with 36 additions and 29 deletions.
diff --git a/.github/workflows/build-all.yml b/.github/workflows/build-all.yml
@@ -9,10 +9,6 @@ on:
             version:
                 default: '0.0.1'
                 type: string
-        secrets:
-            GH_PAT:
-                required: true
-
 jobs:
     build-all:
         if: ${{ inputs.build-services == 'contract' }}
@@ -57,6 +53,15 @@ jobs:
               env:
                   GH_TOKEN: ${{ secrets.GH_PAT }}
 
+            - name: Authenticate to Google Cloud
+              id: auth
+              uses: 'google-github-actions/auth@v1'
+              with:
+                  token_format: access_token
+                  workload_identity_provider: '${{ secrets.WIF_PROVIDER }}'
+                  service_account: '${{ secrets.WIF_SERVICE_ACCOUNT }}'
+                  access_token_lifetime: 300s
+
             - name: Login Registry
               id: docker-auth
               uses: docker/login-action@v1
@@ -65,21 +70,15 @@ jobs:
                   username: oauth2accesstoken
                   password: ${{ steps.auth.outputs.access_token }}
 
-            - name: lower case repository
-              run: |
-                  REPO_STR=$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
-                  echo $REPO_STR
-                  echo "REPO_STR=$REPO_STR" >> $GITHUB_ENV
-
             - name: push relay image
               run: |
-                  docker build -t ghcr.io/$REPO_STR/${{vars.BACKEND_SERVICE}}:${{inputs.version}} -f ./packages/relay/Dockerfile .
-                  docker push ghcr.io/$REPO_STR/${{vars.BACKEND_SERVICE}}:${{inputs.version}}
+                  docker build -t ${{ vars.GAR_LOCATION }}-docker.pkg.dev/${{ vars.PROJECT_ID }}/${{ vars.REPOSITORY }}/${{ vars.BACKEND_SERVICE }}:${{ inputs.version }} -f ./packages/relay/Dockerfile .
+                  docker push ${{ vars.GAR_LOCATION }}-docker.pkg.dev/${{ vars.PROJECT_ID }}/${{ vars.REPOSITORY }}/${{ vars.BACKEND_SERVICE }}:${{ inputs.version }}
 
             - name: push frontend image
               run: |
-                  docker build -t ghcr.io/$REPO_STR/${{vars.FRONTEND_SERVICE}}:${{inputs.version}} -f ./packages/frontend/Dockerfile .
-                  docker push ghcr.io/$REPO_STR/${{vars.FRONTEND_SERVICE}}:${{inputs.version}}
+                  docker build -t ${{ vars.GAR_LOCATION }}-docker.pkg.dev/${{ vars.PROJECT_ID }}/${{ vars.REPOSITORY }}/${{ vars.FRONTEND_SERVICE }}:${{ inputs.version }} -f ./packages/frontend/Dockerfile .
+                  docker push ${{ vars.GAR_LOCATION }}-docker.pkg.dev/${{ vars.PROJECT_ID }}/${{ vars.REPOSITORY }}/${{ vars.FRONTEND_SERVICE }}:${{ inputs.version }}
 
     build-relay-frontend:
         if: ${{ inputs.build-services == 'relay-frontend'}}
@@ -108,6 +107,15 @@ jobs:
             - name: Install and build packages
               run: yarn && yarn build
 
+            - name: Authenticate to Google Cloud
+              id: auth
+              uses: 'google-github-actions/auth@v1'
+              with:
+                  token_format: access_token
+                  workload_identity_provider: '${{ secrets.WIF_PROVIDER }}'
+                  service_account: '${{ secrets.WIF_SERVICE_ACCOUNT }}'
+                  access_token_lifetime: 300s
+
             - name: Login Registry
               id: docker-auth
               uses: docker/login-action@v1
@@ -116,18 +124,12 @@ jobs:
                   username: oauth2accesstoken
                   password: ${{ steps.auth.outputs.access_token }}
 
-            - name: lower case repository
-              run: |
-                  REPO_STR=$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
-                  echo $REPO_STR
-                  echo "REPO_STR=$REPO_STR" >> $GITHUB_ENV
-
             - name: push relay image
               run: |
-                  docker build -t ghcr.io/$REPO_STR/${{vars.BACKEND_SERVICE}}:${{inputs.version}} -f ./packages/relay/Dockerfile .
-                  docker push ghcr.io/$REPO_STR/${{vars.BACKEND_SERVICE}}:${{inputs.version}}
+                  docker build -t ${{ vars.GAR_LOCATION }}-docker.pkg.dev/${{ vars.PROJECT_ID }}/${{ vars.REPOSITORY }}/${{ vars.BACKEND_SERVICE }}:${{ inputs.version }} -f ./packages/relay/Dockerfile .
+                  docker push ${{ vars.GAR_LOCATION }}-docker.pkg.dev/${{ vars.PROJECT_ID }}/${{ vars.REPOSITORY }}/${{ vars.BACKEND_SERVICE }}:${{ inputs.version }} 
 
             - name: push frontend image
               run: |
-                  docker build -t ghcr.io/$REPO_STR/${{vars.FRONTEND_SERVICE}}:${{inputs.version}} -f ./packages/frontend/Dockerfile .
-                  docker push ghcr.io/$REPO_STR/${{vars.FRONTEND_SERVICE}}:${{inputs.version}}
+                  docker build -t ${{ vars.GAR_LOCATION }}-docker.pkg.dev/${{ vars.PROJECT_ID }}/${{ vars.REPOSITORY }}/${{ vars.FRONTEND_SERVICE }}:${{ inputs.version }} -f ./packages/frontend/Dockerfile .
+                  docker push ${{ vars.GAR_LOCATION }}-docker.pkg.dev/${{ vars.PROJECT_ID }}/${{ vars.REPOSITORY }}/${{ vars.FRONTEND_SERVICE }}:${{ inputs.version }}
diff --git a/.github/workflows/main-cd.yml b/.github/workflows/main-cd.yml
@@ -2,7 +2,6 @@ name: CD-Main
 run-name: ${{ github.actor }} acitvates the actions 🚀
 
 on:
-    push: 
     workflow_dispatch:
         branches: ['feat_system_cicd_enhancment']
         inputs:
@@ -21,12 +20,14 @@ on:
 
 jobs:
     build:
+        permissions:
+            contents: 'read'
+            id-token: 'write'
         uses: ./.github/workflows/build-all.yml
         with:
             build-services: ${{ inputs.build-services }}
             version: ${{ inputs.version }}
-        secrets:
-            GH_PAT: ${{ secrets.GH_PAT }}
+        secrets: inherit
 
     backend:
         needs: build
@@ -63,11 +64,15 @@ jobs:
               with:
                   service: ${{ vars.BACKEND_SERVICE }}
                   region: ${{ vars.REGION }}
-                  image: ${{ vars.GAR_LOCATION }}-docker.pkg.dev/${{ vars.PROJECT_ID }}/${{ vars.REPOSITORY }}/${{ vars.BACKEND_SERVICE }}:${{ github.sha }}
+                  image: ${{ vars.GAR_LOCATION }}-docker.pkg.dev/${{ vars.PROJECT_ID }}/${{ vars.REPOSITORY }}/${{ vars.BACKEND_SERVICE }}:${{ inputs.version }}
                   # add ENV as below
                   env_vars: |
                       TWITTER_CLIENT_ID=${{ secrets.TWITTER_CLIENT_ID }}
                       TWITTER_CLIENT_KEY=${{ secrets.TWITTER_CLIENT_KEY }}
+                      TENDERLY_ACCESS_KEY=${{ secrets.TENDERLY_ACCESS_KEY }}
+                      TENDERLY_PROJECT_SLUG=${{ secrets.TENDERLY_PROJECT_SLUG }}
+                      TENDERLY_DEVNET_TEMPLATE=${{ secrets.TENDERLY_DEVNET_TEMPLATE }}
+                      TENDERLY_ACCOUNT_ID=${{ secrets.TENDERLY_ACCOUNT_ID }}
                       CLIENT_URL=${{ vars.CLIENT_URL }}
                       CALLBACK_URL=${{ vars.CALLBACK_URL }}
 
@@ -112,7 +117,7 @@ jobs:
               with:
                   service: ${{ vars.FRONTEND_SERVICE }}
                   region: ${{ vars.REGION }}
-                  image: ${{ vars.GAR_LOCATION }}-docker.pkg.dev/${{ vars.PROJECT_ID }}/${{ vars.REPOSITORY }}/${{ vars.FRONTEND_SERVICE }}:${{ github.sha }}
+                  image: ${{ vars.GAR_LOCATION }}-docker.pkg.dev/${{ vars.PROJECT_ID }}/${{ vars.REPOSITORY }}/${{ vars.FRONTEND_SERVICE }}:${{ inputs.version }}
                   ## set --max-old-space-size=8192 for node.js to increase memory limit
                   env_vars: |
                       ENV=${{ vars.ENV }}