[Snyk] Security upgrade next from 11.1.4 to 14.2.7 #48
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Azure - Deploy Preview Environment | |
| # **What it does**: Build and deploy an Azure preview environment for this PR | |
| # **Why we have it**: It's our preview environment deploy mechanism, to docs-internal and docs public repo | |
| # **Who does it impact**: All contributors. | |
| # !!! | |
| # ! This worflow has access to secrets, runs in the public repository, and clones untrusted user code. | |
| # ! Modify with extreme caution | |
| # !!! | |
| on: | |
| # The advantage of 'pull_request' over 'pull_request_target' is that we | |
| # can make changes to this file and test them in a pull request, instead | |
| # of relying on landing it in 'main' first. | |
| # From a security point of view, its arguably safer this way because | |
| # unlike 'pull_request_target', these only have secrets if the pull | |
| # request creator has permission to access secrets. | |
| pull_request_target: | |
| workflow_dispatch: | |
| inputs: | |
| PR_NUMBER: | |
| description: 'PR Number' | |
| type: string | |
| required: true | |
| COMMIT_REF: | |
| description: 'The commit SHA to build' | |
| type: string | |
| required: true | |
| push: | |
| branches: | |
| - gh-readonly-queue/main/** | |
| permissions: | |
| contents: read | |
| deployments: write | |
| # This allows one deploy workflow to interrupt another | |
| concurrency: | |
| group: 'preview-env @ ${{ github.head_ref || github.run_id }} for ${{ github.event.number || github.event.inputs.PR_NUMBER }}' | |
| cancel-in-progress: true | |
| jobs: | |
| build-and-deploy-azure-preview: | |
| name: Build and deploy Azure preview environment | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| environment: | |
| name: preview-env-${{ github.event.number }} | |
| # The environment variable is computer later in this job in | |
| # the "Get preview app info" step. | |
| # That script sets environment variables which is used by Actions | |
| # to link a PR to a list of environments later. | |
| url: ${{ env.APP_URL }} | |
| env: | |
| PR_NUMBER: ${{ github.event.number || github.event.inputs.PR_NUMBER || github.run_id }} | |
| COMMIT_REF: ${{ github.event.pull_request.head.sha || github.event.inputs.COMMIT_REF }} | |
| BRANCH_NAME: ${{ github.head_ref || github.ref_name }} | |
| IS_INTERNAL_BUILD: ${{ github.repository == 'github/docs-internal' }} | |
| # This may also run in forked repositories, not just 'github/docs' | |
| IS_PUBLIC_BUILD: ${{ github.repository != 'github/docs-internal' }} | |
| NONPROD_REGISTRY_USERNAME: ${{ fromJSON('["ghdocs", "ghdocsinternal"]')[github.repository == 'github/docs-internal'] }} | |
| steps: | |
| - name: 'Az CLI login' | |
| uses: azure/login@1f63701bf3e6892515f1b7ce2d2bf1708b46beaf | |
| with: | |
| creds: ${{ secrets.NONPROD_AZURE_CREDENTIALS }} | |
| - name: 'Docker login' | |
| uses: azure/docker-login@81744f9799e7eaa418697cb168452a2882ae844a | |
| with: | |
| login-server: ${{ secrets.NONPROD_REGISTRY_SERVER }} | |
| username: ${{ env.NONPROD_REGISTRY_USERNAME }} | |
| password: ${{ secrets.NONPROD_REGISTRY_PASSWORD }} | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@94ab11c41e45d028884a99163086648e898eed25 | |
| - if: ${{ env.IS_PUBLIC_BUILD == 'true' }} | |
| name: Check out main branch | |
| uses: actions/checkout@dcd71f646680f2efd8db4afa5ad64fdcba30e748 | |
| with: | |
| ref: 'main' | |
| persist-credentials: 'false' | |
| lfs: 'true' | |
| - if: ${{ env.IS_INTERNAL_BUILD == 'true' }} | |
| name: Check out PR code | |
| uses: actions/checkout@dcd71f646680f2efd8db4afa5ad64fdcba30e748 | |
| with: | |
| ref: ${{ env.COMMIT_REF }} | |
| # To prevent issues with cloning early access content later | |
| persist-credentials: 'false' | |
| lfs: 'true' | |
| - name: Check out LFS objects | |
| run: git lfs checkout | |
| - name: Get preview app info | |
| env: | |
| APP_NAME_SEED: ${{ secrets.PREVIEW_ENV_NAME_SEED }} | |
| run: .github/actions-scripts/get-preview-app-info.sh | |
| - name: 'Set env vars' | |
| run: | | |
| # Image tag is unique to each workflow run so that it always triggers a new deployment | |
| echo "DOCKER_IMAGE=${{ secrets.NONPROD_REGISTRY_SERVER }}/${IMAGE_REPO}:${{ env.COMMIT_REF }}-${{ github.run_number }}-${{ github.run_attempt }}" >> $GITHUB_ENV | |
| - if: ${{ env.IS_INTERNAL_BUILD == 'true' }} | |
| name: Determine which docs-early-access branch to clone | |
| id: 'check-early-access' | |
| uses: actions/github-script@2b34a689ec86a68d8ab9478298f91d5401337b7d | |
| env: | |
| BRANCH_NAME: ${{ env.BRANCH_NAME }} | |
| with: | |
| github-token: ${{ secrets.DOCUBOT_REPO_PAT }} | |
| result-encoding: string | |
| script: | | |
| const { BRANCH_NAME } = process.env | |
| try { | |
| const { status } = await github.request('GET /repos/{owner}/{repo}/branches/{branch}', { | |
| owner: 'github', | |
| repo: 'docs-early-access', | |
| branch: BRANCH_NAME, | |
| }) | |
| if (status !== 200) { | |
| throw new Error('Received non-200 response from branch GET request') | |
| } | |
| console.log(`Using docs-early-access branch '${BRANCH_NAME}'`) | |
| return BRANCH_NAME | |
| } catch (e) { | |
| console.log(`Failed to get docs-early-access branch '${BRANCH_NAME}', 'main' will be used instead.`) | |
| return 'main' | |
| } | |
| - if: ${{ env.IS_INTERNAL_BUILD == 'true' }} | |
| name: Clone docs-early-access | |
| uses: actions/checkout@dcd71f646680f2efd8db4afa5ad64fdcba30e748 | |
| with: | |
| repository: github/docs-early-access | |
| token: ${{ secrets.DOCUBOT_REPO_PAT }} | |
| path: docs-early-access | |
| ref: ${{ steps.check-early-access.outputs.result }} | |
| - if: ${{ env.IS_INTERNAL_BUILD == 'true' }} | |
| name: Merge docs-early-access repo's folders | |
| run: .github/actions-scripts/merge-early-access.sh | |
| - if: ${{ env.IS_PUBLIC_BUILD == 'true' }} | |
| name: Check out user code to temp directory | |
| uses: actions/checkout@dcd71f646680f2efd8db4afa5ad64fdcba30e748 | |
| with: | |
| path: ./user-code | |
| ref: ${{ env.COMMIT_REF }} | |
| # Move acceptable user changes into our main branch checkout | |
| - if: ${{ env.IS_PUBLIC_BUILD == 'true' }} | |
| name: Move acceptable user changes | |
| run: | | |
| # Make sure recursive path expansion is enabled | |
| shopt -s globstar | |
| rsync -rptovR ./user-code/content/./**/*.md ./content | |
| rsync -rptovR ./user-code/assets/./**/*.png ./assets | |
| rsync -rptovR ./user-code/data/./**/*.{yml,md} ./data | |
| rsync -rptovR ./user-code/components/./**/*.{scss,ts,tsx} ./components | |
| rsync -rptovR --ignore-missing-args ./user-code/lib/./**/*.{js,ts} ./lib | |
| rsync -rptovR --ignore-missing-args ./user-code/middleware/./**/*.{js,ts} ./middleware | |
| rsync -rptovR ./user-code/pages/./**/*.tsx ./pages | |
| rsync -rptovR ./user-code/stylesheets/./**/*.scss ./stylesheets | |
| # In addition to making the final image smaller, we also save time by not sending unnecessary files to the docker build context | |
| - name: 'Prune for preview env' | |
| run: .github/actions-scripts/prune-for-preview-env.sh | |
| - name: 'Build and push image' | |
| uses: docker/build-push-action@7f9d37fa544684fb73bfe4835ed7214c255ce02b | |
| with: | |
| context: . | |
| push: true | |
| target: preview | |
| tags: ${{ env.DOCKER_IMAGE }} | |
| # we only pull the `main` cache image | |
| cache-from: type=registry,ref=${{ secrets.NONPROD_REGISTRY_SERVER }}/${{ github.repository }}:main-preview | |
| # `main-docker-cache.yml` handles updating the remote cache so we don't pollute it with PR specific code | |
| cache-to: '' | |
| # Succeed despite any non-zero exit code (e.g. if there is no deployment to cancel) | |
| - name: 'Cancel any existing deployments for this PR' | |
| run: | | |
| az deployment group cancel --name ${{ env.DEPLOYMENT_NAME }} -g ${{ secrets.PREVIEW_ENV_RESOURCE_GROUP }} || true | |
| # Deploy ARM template is idempotent | |
| # Note: once the resources exist the image tag must change for a new deployment to occur (the image tag includes workflow run number, run attempt, as well as sha) | |
| - name: Run ARM deploy | |
| id: deploy | |
| uses: azure/arm-deploy@841b12551939c88af8f6df767c24c38a5620fd0d | |
| with: | |
| resourceGroupName: ${{ secrets.PREVIEW_ENV_RESOURCE_GROUP }} | |
| subscriptionId: ${{ secrets.NONPROD_SUBSCRIPTION_ID }} | |
| template: ./azure-preview-env-template.json | |
| deploymentName: ${{ env.DEPLOYMENT_NAME }} | |
| parameters: appName="${{ env.APP_NAME }}" | |
| containerImage="${{ env.DOCKER_IMAGE }}" | |
| dockerRegistryUrl="${{ secrets.NONPROD_REGISTRY_SERVER }}" | |
| dockerRegistryUsername="${{ env.NONPROD_REGISTRY_USERNAME }}" | |
| dockerRegistryPassword="${{ secrets.NONPROD_REGISTRY_PASSWORD }}" | |
| # this shows warnings in the github actions console, because the flag is passed through a validation run, | |
| # but it *is* functional during the actual execution | |
| additionalArguments: --no-wait |