From 4fda4cc0eff0a2d879637e0b58706aea7a31bc31 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marcos=20P=C3=A9rez=20Ferro?= Date: Thu, 18 Jun 2026 11:10:05 +0200 Subject: [PATCH 1/4] ci: align release workflow with service-hub container release Rename docker-publish workflow to release and rewrite it to trigger on release publication (driven by release-please), build and push the container image to ghcr.io, stamp version.json, and trigger a Terraform Cloud deploy via the variable set. Harden against workflow injection: pass github.ref and secrets through env vars, validate the release tag as strict semver, and build the Terraform payload with jq. --- .github/workflows/docker-publish.yml | 57 ---------------------- .github/workflows/release.yml | 71 ++++++++++++++++++++++++++++ 2 files changed, 71 insertions(+), 57 deletions(-) delete mode 100644 .github/workflows/docker-publish.yml create mode 100644 .github/workflows/release.yml diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml deleted file mode 100644 index dfabb91..0000000 --- a/.github/workflows/docker-publish.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Build and publish container - -on: - push: - branches: [main] - tags: ['v*'] - pull_request: - branches: [main] - -env: - REGISTRY: ghcr.io - IMAGE_NAME: ${{ github.repository }} - -jobs: - build-and-push: - runs-on: ubuntu-latest - permissions: - contents: read - packages: write - - steps: - - name: Checkout - uses: actions/checkout@v4 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - - name: Log in to GitHub Container Registry - if: github.event_name != 'pull_request' - uses: docker/login-action@v3 - with: - registry: ${{ env.REGISTRY }} - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Extract metadata - id: meta - uses: docker/metadata-action@v5 - with: - images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - tags: | - type=ref,event=branch - type=ref,event=pr - type=semver,pattern={{version}} - type=semver,pattern={{major}}.{{minor}} - type=sha - type=raw,value=latest,enable={{is_default_branch}} - - - name: Build and push - uses: docker/build-push-action@v6 - with: - context: . - push: ${{ github.event_name != 'pull_request' }} - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - cache-from: type=gha - cache-to: type=gha,mode=max diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..52d66ea --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,71 @@ +name: Release Action + +on: + release: + types: + - published + +concurrency: + group: '${{ github.workflow }}' + cancel-in-progress: true + +jobs: + deploy_container: + name: Deploy Container + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + + - name: Get version number + id: version + env: + REF: ${{ github.ref }} + run: | + version="${REF##*/}" + if ! echo "$version" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$'; then + echo "::error::Release tag '$version' is not a valid semver tag (vX.Y.Z)" >&2 + exit 1 + fi + echo "version=$version" >> "$GITHUB_OUTPUT" + + - name: Populate version.json + env: + VERSION: ${{ steps.version.outputs.version }} + run: | + hash=$(git rev-parse HEAD) + echo "{\"version\": {\"hash\": \"$hash\", \"version\": \"$VERSION\"}}" > ./version.json + + - name: Login to GitHub Container Registry + uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 + with: + registry: ghcr.io + username: ${{ github.repository_owner }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Build and push + uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0 + with: + context: . + push: true + tags: "ghcr.io/${{ github.repository_owner }}/web-api:${{ steps.version.outputs.version }}" + + - name: Update Terraform variable set + env: + TF_TOKEN: ${{ secrets.TERRAFORM_CLOUD_TOKEN }} + VARSET_ID: ${{ secrets.TERRAFORM_CLOUD_VARSET_ID }} + VERSION: ${{ steps.version.outputs.version }} + run: | + variable_id=$(curl -sSL \ + --header "Authorization: Bearer $TF_TOKEN" \ + --header "Content-Type: application/vnd.api+json" \ + --request GET \ + "https://app.terraform.io/api/v2/varsets/$VARSET_ID" \ + | jq -r '.data.relationships.vars.data[0] | .id') + + curl -sSL \ + --header "Authorization: Bearer $TF_TOKEN" \ + --header "Content-Type: application/vnd.api+json" \ + --request PATCH \ + --data "$(jq -n --arg v "$VERSION" '{data: {type: "vars", attributes: {value: $v}}}')" \ + "https://app.terraform.io/api/v2/varsets/$VARSET_ID/relationships/vars/$variable_id" From 726192175bef53b19e9b6c880e68b8896087412d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marcos=20P=C3=A9rez=20Ferro?= Date: Thu, 18 Jun 2026 11:46:28 +0200 Subject: [PATCH 2/4] ci: pin actions to commit SHAs at latest releases Pin every GitHub Action to a commit SHA and bump to the latest release: - googleapis/release-please-action v4 -> v5.0.0 - actions/checkout v6.0.2 -> v6.0.3 - docker/login-action v4.1.0 -> v4.2.0 - docker/build-push-action v7.0.0 -> v7.2.0 --- .github/workflows/release-please.yml | 2 +- .github/workflows/release.yml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index e371abb..18e1a29 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -12,7 +12,7 @@ jobs: release-please: runs-on: ubuntu-latest steps: - - uses: googleapis/release-please-action@v4 + - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0 with: config-file: release-please-config.json manifest-file: .release-please-manifest.json diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 52d66ea..634430d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,7 +15,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Get version number id: version @@ -37,14 +37,14 @@ jobs: echo "{\"version\": {\"hash\": \"$hash\", \"version\": \"$VERSION\"}}" > ./version.json - name: Login to GitHub Container Registry - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 + uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 with: registry: ghcr.io username: ${{ github.repository_owner }} password: ${{ secrets.GITHUB_TOKEN }} - name: Build and push - uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0 + uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 with: context: . push: true From b08d77dfec34ccc310d4986ae63c3948c976a129 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marcos=20P=C3=A9rez=20Ferro?= Date: Thu, 18 Jun 2026 16:02:31 +0200 Subject: [PATCH 3/4] ci: auto-apply Terraform run on release After updating the web_api_version variable set, trigger a Terraform Cloud run on the web-api workspace with auto-apply enabled so a published release deploys immediately instead of waiting for manual confirmation. --- .github/workflows/release.yml | 49 +++++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 634430d..dde649b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -69,3 +69,52 @@ jobs: --request PATCH \ --data "$(jq -n --arg v "$VERSION" '{data: {type: "vars", attributes: {value: $v}}}')" \ "https://app.terraform.io/api/v2/varsets/$VARSET_ID/relationships/vars/$variable_id" + + - name: Trigger Terraform apply + env: + TF_TOKEN: ${{ secrets.TERRAFORM_CLOUD_TOKEN }} + TF_ORG: ohf + TF_WORKSPACE: web-api + VERSION: ${{ steps.version.outputs.version }} + run: | + # The variable set update above does not queue a run on its own, so we + # create one explicitly and let Terraform Cloud apply it without manual + # confirmation. web-api is its own workspace/state, so this only + # deploys web-api — shared infrastructure is untouched. + workspace_id=$(curl -sSL \ + --header "Authorization: Bearer $TF_TOKEN" \ + --header "Content-Type: application/vnd.api+json" \ + --request GET \ + "https://app.terraform.io/api/v2/organizations/$TF_ORG/workspaces/$TF_WORKSPACE" \ + | jq -r '.data.id') + + if [ -z "$workspace_id" ] || [ "$workspace_id" = "null" ]; then + echo "::error::Could not resolve Terraform Cloud workspace '$TF_WORKSPACE'" >&2 + exit 1 + fi + + run_id=$(curl -sSL \ + --header "Authorization: Bearer $TF_TOKEN" \ + --header "Content-Type: application/vnd.api+json" \ + --request POST \ + --data "$(jq -n --arg ws "$workspace_id" --arg v "$VERSION" '{ + data: { + type: "runs", + attributes: { + message: "Deploy web-api \($v) (release action)", + "auto-apply": true + }, + relationships: { + workspace: { data: { type: "workspaces", id: $ws } } + } + } + }')" \ + "https://app.terraform.io/api/v2/runs" \ + | jq -r '.data.id') + + if [ -z "$run_id" ] || [ "$run_id" = "null" ]; then + echo "::error::Failed to create Terraform Cloud run" >&2 + exit 1 + fi + + echo "Triggered Terraform Cloud run $run_id (auto-apply) for $TF_WORKSPACE" From aba5d56dad84b2b5e7f0016499eccc34bcc3c5cc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marcos=20P=C3=A9rez=20Ferro?= Date: Thu, 18 Jun 2026 17:13:06 +0200 Subject: [PATCH 4/4] ci: select release variable by key Look up the variable set entry by its key (web_api_image_tag) instead of assuming it is the first variable, and fail loudly if it is missing. --- .github/workflows/release.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index dde649b..302ee8f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -54,14 +54,20 @@ jobs: env: TF_TOKEN: ${{ secrets.TERRAFORM_CLOUD_TOKEN }} VARSET_ID: ${{ secrets.TERRAFORM_CLOUD_VARSET_ID }} + VAR_KEY: web_api_image_tag VERSION: ${{ steps.version.outputs.version }} run: | variable_id=$(curl -sSL \ --header "Authorization: Bearer $TF_TOKEN" \ --header "Content-Type: application/vnd.api+json" \ --request GET \ - "https://app.terraform.io/api/v2/varsets/$VARSET_ID" \ - | jq -r '.data.relationships.vars.data[0] | .id') + "https://app.terraform.io/api/v2/varsets/$VARSET_ID/relationships/vars" \ + | jq -r --arg k "$VAR_KEY" '.data[] | select(.attributes.key == $k) | .id') + + if [ -z "$variable_id" ] || [ "$variable_id" = "null" ]; then + echo "::error::Variable '$VAR_KEY' not found in the configured variable set" >&2 + exit 1 + fi curl -sSL \ --header "Authorization: Bearer $TF_TOKEN" \