GitHub Actions

March 4, 2022 · View on GitHub

GitHub Actions master template & GitHub Actions Shared Workflows library.

main.yaml - GitHub Actions master workflow template
.github/workflows/ - GitHub Actions Reusable Workflows Library

See Documentation for how to call these workflows directly from your own GitHub Actions workflow.

Fork this repo to have full control over all updates via Pull Requests. Create environment branches to stage updates across dev/staging/production.

Examples

In your GitHub repo, import these workflows by adding small yaml files to the .github/workflows/ directory.

Scan for Secrets and Security issues

Alerts appear under Security -> Code scanning alerts.

Create .github/workflows/semgrep.yaml:

on: [push]
jobs:
  semgrep:
    uses: buluma/GitHub-Actions/.github/workflows/semgrep.yaml@master

Analyze your Terraform code security & best practices

Alerts appear under Security -> Code scanning alerts.

Create .github/workflows/tfsec.yaml:

on: [push]
jobs:
  tfsec:
    uses: buluma/Gi/tHub-Actions/.github/workflows/tfsec.yaml@master

Docker Build and push to DockerHub

Create .github/workflows/docker_build.yaml:

on: [push]
jobs:
  docker_build:
    uses: buluma/GitHub-Actions/.github/workflows/docker_build.yaml@master
    with:
      repo: user/repo  # your DockerHub user/repo
      tags: latest v1.1
    secrets:
      DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }}
      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}

Docker Build and push to AWS ECR

Create .github/workflows/docker_build_aws_ecr.yaml:

on: [push]
jobs:
  docker_build:
    uses: buluma/GitHub-Actions/.github/workflows/docker_build_aws_ecr.yaml@master
    with:
      repo: MY_ECR_REPO
    secrets:
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}

Creates several useful tags, supports multi-stage build caching, see README for details.

Check for Broken URL Links

Create .github/workflows/url_links.yaml:

on: [push]
jobs:
  url_links:
    uses: buluma/GitHub-Actions/.github/workflows/url_links.yaml@master

See README for details on ignoring inaccessible / partially constructed links or those containing variables

Auto-Merge Production hotfixes back to Staging

Merges via a Pull Request for full auditing.

Create .github/workflows/merge_production_to_staging.yaml:

on: [push]
jobs:
  merge:
    if: github.ref_name == 'production'
    uses: buluma/GitHub-Actions/.github/workflows/merge-branch.yaml@master
    with:
      head: production  # from
      base: staging     # to