initial push to configure pipeline for polycli docker deployment

.github/build.yml

@@ -0,0 +1,120 @@
+name: "Build Pipeline"
+
+on:
+  push:
+    branches:
+      - jesse/pipeline-deploy
+      - main
+    paths-ignore:
+      - 'helm-chart/**'
+
+env:
+  PROJECT_ID: "polygonlabs-wbutton-dev"
+  GAR_LOCATION: "europe-west2"
+  WIF_PROVIDER: "projects/104168936956/locations/global/workloadIdentityPools/wbutton-test-pool/providers/wbutton-test" # this was hard to find: WIP --> Expand pool --> Click pencil icon
+  WIF_SERVICE_ACCOUNT: "wbutton-test-github-actions@polygonlabs-wbutton-dev.iam.gserviceaccount.com"
+  CRITICAL_COUNT: 5
+  IMAGE_NAME: "europe-west2-docker.pkg.dev/prj-polygonlabs-shared-dev/polygonlabs-docker-dev/jesse/polygon-cli"
+
+  ATTESTOR_PROJECT_ID: "polygonlabs-wbutton-dev"
+  KEY_RING: "wbutton-test-ring"
+  KEY: "wbutton-test-binary-auth-key"
+  ATTESTOR: "wbutton-test-attestor"
+
+jobs:
+  build-pipeline:
+    name: "Build, push, scan, and sign Docker image"
+    permissions:
+      contents: "write"
+      id-token: "write"
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Google Auth
+        id: auth
+        uses: google-github-actions/auth@v1
+        with:
+          token_format: "access_token"
+          workload_identity_provider: "${{ env.WIF_PROVIDER }}"
+          service_account: "${{ env.WIF_SERVICE_ACCOUNT }}"
+
+      - name: Docker Auth
+        id: docker-auth
+        uses: docker/login-action@v1
+        with:
+          username: "oauth2accesstoken"
+          password: "${{ steps.auth.outputs.access_token }}"
+          registry: "${{ env.GAR_LOCATION }}-docker.pkg.dev"
+
+      - name: Build and Push Docker Image to GCP Artifact Registry
+        run: |-
+          docker build -t "${{ env.IMAGE_NAME }}:${{ github.sha }}" .
+          docker push "${{ env.IMAGE_NAME }}:${{ github.sha }}"
+
+      - name: "Set up Cloud SDK"
+        uses: "google-github-actions/setup-gcloud@v1"
+
+      - name: Scan Vulnerabilities
+        run: |
+          (gcloud artifacts docker images scan "${{ env.IMAGE_NAME }}:${{ github.sha }}" --format="value(response.scan)" --remote --quiet) > ./scan_id.txt
+
+      - name: Checking Critical Vulnerabilities
+        run: |-
+          #!/bin/bash
+
+          # Check if the scan_id.txt file exists
+          if [ ! -f ./scan_id.txt ]; then
+              echo "Error: scan_id.txt not found."
+              exit 1
+          fi
+
+          # Use gcloud to list vulnerabilities and check for CRITICAL severity
+          severity=$(gcloud artifacts docker images list-vulnerabilities \
+                          "$(cat ./scan_id.txt)" \
+                          --format="value(vulnerability.effectiveSeverity)")
+          
+          # Check if CRITICAL vulnerability is found
+          chk=$(echo "$severity" | grep -c "CRITICAL")
+          if [ "$chk" -gt ${{ env.CRITICAL_COUNT }} ]; then
+            echo "Failed vulnerability check for CRITICAL level"
+              exit 1
+          else
+              echo "No CRITICAL vulnerability found. Congratulations!"
+              exit 0
+          fi
+
+      - name: Sign the docker image
+        run: |-
+          export CLOUDSDK_CORE_DISABLE_PROMPTS=1
+          gcloud components install beta --quiet
+          
+          DIGEST=$(gcloud container images describe ${{ env.IMAGE_NAME }}:${{ github.sha }} --format='get(image_summary.digest)')
+          
+          gcloud beta container binauthz attestations sign-and-create \
+              --artifact-url="${{ env.IMAGE_NAME }}@${DIGEST}" \
+              --attestor="${{ env.ATTESTOR }}" \
+              --attestor-project="${{ env.ATTESTOR_PROJECT_ID }}" \
+              --keyversion-project="${{ env.ATTESTOR_PROJECT_ID }}" \
+              --keyversion-location="${{ env.GAR_LOCATION }}" \
+              --keyversion-keyring="${{ env.KEY_RING }}" \
+              --keyversion-key="${{ env.KEY }}" \
+              --keyversion="1"
+
+      - name: Update Helm values # the helm-chart name should be standardized or parameterized
+        run: |-
+          DIGEST=$(gcloud container images describe ${{ env.IMAGE_NAME }}:${{ github.sha }} \
+              --format='get(image_summary.digest)')
+          
+          sed -i "s|image:.*|image: ${{ env.IMAGE_NAME }}@${DIGEST}|" ./helm-chart/values.yaml
+
+      - name: Set up Git, Commit and Push Changes to Update Container Image
+        uses: stefanzweifel/git-auto-commit-action@v5
+        with:  # the helm-chart name should be standardized or parameterized
+          commit_message: Apply automatic changes to Update image repository in Helm values
+          file_pattern: './helm-chart/values.yaml'
+          branch: wbutton-dev-test
+          create_branch: true

Dockerfile

@@ -0,0 +1,23 @@
+# Use an official Go runtime as a parent image
+FROM golang:1.21 as builder
+
+# Set the working directory inside the container
+WORKDIR /go/src/app
+
+# Copy the Go source code into the container
+COPY . .
+
+# Build your Go app
+RUN make build
+
+# Use a smaller base image to create a minimal final image
+FROM alpine:latest  
+RUN apk --no-cache add ca-certificates
+
+WORKDIR /root/
+
+# Copy the binary from the builder stage
+COPY --from=builder /go/src/app/out/polycli .
+
+# Command to run the binary
+CMD ["./polycli"]

helm-chart/Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: webflow-apis
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"