feat: PokeWallet integration for JP card rarity data (#148) #128
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy | |
| on: | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| id-token: write | |
| attestations: write | |
| env: | |
| PROJECT_ID: casecomp-495718 | |
| SERVICE: casecomp-api | |
| IMAGE: us-docker.pkg.dev/casecomp-495718/casecomp-api/app | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| digest: ${{ steps.digest.outputs.digest }} | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3 | |
| with: | |
| workload_identity_provider: projects/129850122606/locations/global/workloadIdentityPools/github-pool/providers/github-provider | |
| service_account: casecomp-deploy@casecomp-495718.iam.gserviceaccount.com | |
| - uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3 | |
| - name: Build and push | |
| run: | | |
| BUILD_ID=$(gcloud builds submit \ | |
| --config=cloudbuild.yml \ | |
| --project ${{ env.PROJECT_ID }} \ | |
| --async \ | |
| --format='value(id)' .) | |
| echo "Waiting for build $BUILD_ID..." | |
| while true; do | |
| STATUS=$(gcloud builds describe $BUILD_ID --project ${{ env.PROJECT_ID }} --format='value(status)' 2>/dev/null) | |
| echo " status: $STATUS" | |
| case "$STATUS" in | |
| SUCCESS) break ;; | |
| FAILURE|TIMEOUT|CANCELLED|INTERNAL_ERROR) echo "Build failed: $STATUS"; exit 1 ;; | |
| *) sleep 15 ;; | |
| esac | |
| done | |
| - name: Get image digest | |
| id: digest | |
| run: | | |
| DIGEST=$(gcloud artifacts docker images describe ${{ env.IMAGE }}:latest \ | |
| --project ${{ env.PROJECT_ID }} \ | |
| --format='value(image_summary.digest)') | |
| echo "digest=$DIGEST" >> "$GITHUB_OUTPUT" | |
| echo "Image digest: $DIGEST" | |
| - name: Configure Docker auth for Artifact Registry | |
| run: gcloud auth configure-docker us-docker.pkg.dev --quiet | |
| - uses: sigstore/cosign-installer@f713795cb21599bc4e5c4b58cbad1da852d7eeb9 # v3 | |
| - name: Sign image (keyless) | |
| run: | | |
| cosign sign --yes \ | |
| --oidc-issuer=https://token.actions.githubusercontent.com \ | |
| "${{ env.IMAGE }}@${{ steps.digest.outputs.digest }}" | |
| - name: Verify signature | |
| run: | | |
| cosign verify \ | |
| --certificate-oidc-issuer=https://token.actions.githubusercontent.com \ | |
| --certificate-identity-regexp="github.com/Pyronewbic/casecomp" \ | |
| "${{ env.IMAGE }}@${{ steps.digest.outputs.digest }}" | |
| - name: Create Binary Auth attestation | |
| run: | | |
| gcloud --quiet beta container binauthz attestations sign-and-create \ | |
| --artifact-url="${{ env.IMAGE }}@${{ steps.digest.outputs.digest }}" \ | |
| --attestor="projects/${{ env.PROJECT_ID }}/attestors/deploy-attestor" \ | |
| --keyversion="projects/${{ env.PROJECT_ID }}/locations/global/keyRings/binary-auth/cryptoKeys/attestor-key/cryptoKeyVersions/1" | |
| - name: Generate container SBOM (Syft) | |
| uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0 | |
| with: | |
| image: "${{ env.IMAGE }}@${{ steps.digest.outputs.digest }}" | |
| format: spdx-json | |
| output-file: /tmp/sbom.spdx.json | |
| upload-artifact: false | |
| - name: Attest SBOM to image | |
| run: | | |
| cosign attest --yes \ | |
| --oidc-issuer=https://token.actions.githubusercontent.com \ | |
| --predicate /tmp/sbom.spdx.json \ | |
| --type spdxjson \ | |
| "${{ env.IMAGE }}@${{ steps.digest.outputs.digest }}" | |
| - name: Attest build provenance | |
| uses: actions/attest-build-provenance@96b4a1ef7235a096b17240c259729fdd70c83d45 # v2 | |
| with: | |
| subject-name: ${{ env.IMAGE }} | |
| subject-digest: ${{ steps.digest.outputs.digest }} | |
| push-to-registry: false | |
| deploy: | |
| needs: build | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| region: [asia-south1, us-central1] | |
| fail-fast: false | |
| steps: | |
| - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3 | |
| with: | |
| workload_identity_provider: projects/129850122606/locations/global/workloadIdentityPools/github-pool/providers/github-provider | |
| service_account: casecomp-deploy@casecomp-495718.iam.gserviceaccount.com | |
| - uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3 | |
| - name: Deploy to Cloud Run (${{ matrix.region }}) | |
| run: | | |
| gcloud run deploy ${{ env.SERVICE }} \ | |
| --image "${{ env.IMAGE }}@${{ needs.build.outputs.digest }}" \ | |
| --region ${{ matrix.region }} \ | |
| --project ${{ env.PROJECT_ID }} \ | |
| --port 3000 \ | |
| --allow-unauthenticated | |
| - name: Health check (${{ matrix.region }}) | |
| run: | | |
| URL=$(gcloud run services describe ${{ env.SERVICE }} \ | |
| --region ${{ matrix.region }} \ | |
| --project ${{ env.PROJECT_ID }} \ | |
| --format='value(status.url)') | |
| echo "Checking $URL/api/health..." | |
| for i in $(seq 1 10); do | |
| STATUS=$(curl -sf "$URL/api/health" | python3 -c "import sys,json; print(json.load(sys.stdin).get('status',''))" 2>/dev/null) | |
| if [ "$STATUS" = "ok" ]; then | |
| echo "Healthy (attempt $i)" | |
| exit 0 | |
| fi | |
| echo " attempt $i: $STATUS" | |
| sleep 5 | |
| done | |
| echo "Health check failed after 10 attempts" | |
| exit 1 | |
| dast: | |
| needs: deploy | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - name: ZAP API Scan | |
| uses: zaproxy/action-api-scan@a9a916402665623ce9d37a6998d7b48e6b35dd6c # v0.9.0 | |
| with: | |
| target: https://api.casecomp.xyz/docs/spec.json | |
| format: openapi | |
| fail_action: false | |
| allow_issue_writing: false | |
| cmd_options: '-a' | |
| - name: Upload DAST report | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: zap-report-${{ github.sha }} | |
| path: report_html.html | |
| retention-days: 30 |