[TRAIN-3215] Creates puppeteer release workflow, sets default env vars, QoL updates #88
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,48 +1,68 @@ | ||
| # ============================================= | ||
| # Datadog API Keys and Configuration | ||
| # ============================================= | ||
| DD_API_KEY= # Required for Datadog Agent and APM | ||
| DD_APP_KEY= # Required for Datadog API access | ||
| DATADOG_API_KEY= # Used specifically for datadog-ci | ||
| NEXT_PUBLIC_DD_APPLICATION_ID= # Required for RUM in frontend service | ||
| NEXT_PUBLIC_DD_CLIENT_TOKEN= # Required for RUM in frontend service | ||
|
|
||
| # ============================================= | ||
| # Environment and Host Configuration | ||
| # ============================================= | ||
| DD_ENV=development # usually set to some form of identifier of what the course/lab is (such as `dd101-sre`) | ||
| DD_HOSTNAME=development-host # usually set to the DD_ENV with `-host` appended | ||
| NEXT_PUBLIC_DD_ENV=development # Required for RUM in frontend service | ||
| NEXT_PUBLIC_DD_SITE=datadoghq.com # Required for RUM in frontend service | ||
|
|
||
| # ============================================= | ||
| # Service Versions | ||
| # Follow Storedog releases except Redis (https://github.com/DataDog/storedog/releases) | ||
| # ============================================= | ||
| NEXT_PUBLIC_DD_VERSION_FRONTEND=1.0.0 # use NEXT_PUBLIC_* to expose var to store frontend | ||
| DD_VERSION_BACKEND=1.0.0 # Use for worker service as well, since they use the same Docker image | ||
| DD_VERSION_DBM=1.0.0 | ||
| DD_VERSION_ADS=1.0.0 | ||
| DD_VERSION_DISCOUNTS=1.0.0 | ||
| DD_VERSION_POSTGRES=1.0.0 | ||
| DD_VERSION_NGINX=1.0.0 | ||
| DD_VERSION_REDIS=6.2 | ||
|
|
||
| # ============================================= | ||
| # Database Configuration (used in backend, worker, discounts, and dbm services) | ||
| # ============================================= | ||
| POSTGRES_USER=postgres | ||
| POSTGRES_PASSWORD=postgres | ||
| DB_HOST=postgres | ||
| DB_PORT=5432 | ||
| DB_POOL=25 # Database connection pool size set in backend service (default: 25) | ||
| MAX_THREADS=5 # Maximum number of concurrent threads set in backend service (default: 5) | ||
|
|
||
| # ============================================= | ||
| # Frontend Service Configuration | ||
| # ============================================= | ||
| FRONTEND_COMMAND='npm run dev' # Command to run the frontend service (default: 'npm run dev', use 'npm run prod' for production) | ||
| NEXT_PUBLIC_DD_SERVICE_FRONTEND=store-frontend # Service name for frontend service in Datadog | ||
| NEXT_PUBLIC_FRONTEND_API_ROUTE=http://service-proxy:80 # base url for next.js API routes (default: 'http://service-proxy:80') | ||
| NEXT_PUBLIC_SPREE_API_HOST=http://service-proxy/services/backend # base url for backend service (default: 'http://service-proxy/services/backend') | ||
| NEXT_PUBLIC_SPREE_CLIENT_HOST=/services/backend # base url for backend service (default: '/services/backend') | ||
| NEXT_PUBLIC_SPREE_IMAGE_HOST=/services/backend # base url for backend service (default: '/services/backend') | ||
| NEXT_PUBLIC_SPREE_ALLOWED_IMAGE_DOMAIN=service-proxy # allowed image domain for backend service (default: 'service-proxy') | ||
| NEXT_PUBLIC_ADS_ROUTE=/services/ads # base url for ads service (default: '/services/ads') | ||
| NEXT_PUBLIC_DISCOUNTS_ROUTE=/services/discounts # base url for discounts service (default: '/services/discounts') | ||
| NEXT_PUBLIC_DBM_ROUTE=/services/dbm # base url for dbm service (default: '/services/dbm') | ||
|
|
||
| # ============================================= | ||
| # Backend Service Configuration | ||
| # ============================================= | ||
| RAILS_ENV=production | ||
| REDIS_URL=redis://redis:6379/0 | ||
| DISABLE_SPRING=1 | ||
|
|
||
| # ============================================= | ||
| # Puppeteer Configuration | ||
| # ============================================= | ||
| STOREDOG_URL=http://service-proxy:80 # base url for storedog service (default: 'http://service-proxy:80') | ||
| PUPPETEER_TIMEOUT=30000 # timeout for puppeteer (default: 30000) | ||
|
|
||
| SKIP_SESSION_CLOSE= # skip session close for puppeteer (default: ''). note that the current puppeteer script doesn't make use of this environment variable but can easily be updated to do so |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,7 +4,7 @@ permissions: {} | |
|
|
||
| on: | ||
| push: | ||
| branches: [main] | ||
| paths: | ||
| - services/ads/java/** | ||
| workflow_dispatch: | ||
|
|
@@ -14,34 +14,34 @@ defaults: | |
| working-directory: ads | ||
|
|
||
| jobs: | ||
| build: | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| packages: write | ||
| contents: read | ||
|
|
||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
|
|
||
| - name: Login to GHCR | ||
| id: login-ghcr | ||
| uses: docker/login-action@v3 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)Pin GitHub Actions by commit hash to ensure supply chain security. Using a branch ( - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
| with: | ||
| registry: ghcr.io | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Build and push | ||
| uses: docker/build-push-action@v5 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)Pin GitHub Actions by commit hash to ensure supply chain security. Using a branch ( - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
| with: | ||
| context: ./services/ads/java | ||
| platforms: linux/amd64,linux/arm64 | ||
| push: true | ||
| tags: ghcr.io/datadog/storedog/ads-java:latest | ||
| build-args: | | ||
| DD_GIT_REPOSITORY_URL=${{ github.repository }} | ||
| DD_GIT_COMMIT_SHA=${{ github.sha }} | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,7 +4,7 @@ permissions: {} | |
|
|
||
| on: | ||
| push: | ||
| branches: [main] | ||
| paths: | ||
| - services/backend/** | ||
| workflow_dispatch: | ||
|
|
@@ -14,34 +14,34 @@ defaults: | |
| working-directory: backend | ||
|
|
||
| jobs: | ||
| build: | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| packages: write | ||
| contents: read | ||
|
|
||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)Pin GitHub Actions by commit hash to ensure supply chain security. Using a branch ( - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
|
|
||
| - name: Login to GHCR | ||
| id: login-ghcr | ||
| uses: docker/login-action@v3 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)Pin GitHub Actions by commit hash to ensure supply chain security. Using a branch ( - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
| with: | ||
| registry: ghcr.io | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Build and push | ||
| uses: docker/build-push-action@v5 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)Pin GitHub Actions by commit hash to ensure supply chain security. Using a branch ( - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
| with: | ||
| context: ./services/backend | ||
| platforms: linux/amd64,linux/arm64 | ||
| push: true | ||
| tags: ghcr.io/datadog/storedog/backend:latest | ||
| build-args: | | ||
| DD_GIT_REPOSITORY_URL=${{ github.repository }} | ||
| DD_GIT_COMMIT_SHA=${{ github.sha }} | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,7 +4,7 @@ permissions: {} | |
|
|
||
| on: | ||
| push: | ||
| branches: [main] | ||
| paths: | ||
| - services/discounts/** | ||
| workflow_dispatch: | ||
|
|
@@ -14,33 +14,34 @@ defaults: | |
| working-directory: discounts | ||
|
|
||
| jobs: | ||
| build: | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| packages: write | ||
| contents: read | ||
|
|
||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)Pin GitHub Actions by commit hash to ensure supply chain security. Using a branch ( - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
|
|
||
| - name: Login to GHCR | ||
| id: login-ghcr | ||
| uses: docker/login-action@v3 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)Pin GitHub Actions by commit hash to ensure supply chain security. Using a branch ( - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
| with: | ||
| registry: ghcr.io | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Build and push | ||
| uses: docker/build-push-action@v5 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)Pin GitHub Actions by commit hash to ensure supply chain security. Using a branch ( - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
| with: | ||
| context: ./services/discounts | ||
| platforms: linux/amd64,linux/arm64 | ||
| push: true | ||
| tags: ghcr.io/datadog/storedog/discounts:latest | ||
| build-args: | | ||
| DD_GIT_REPOSITORY_URL=${{ github.repository }} | ||
| DD_GIT_COMMIT_SHA=${{ github.sha }} | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,7 +4,7 @@ permissions: {} | |
|
|
||
| on: | ||
| push: | ||
| branches: [main] | ||
| paths: | ||
| - services/frontend/** | ||
| workflow_dispatch: | ||
|
|
@@ -14,34 +14,34 @@ defaults: | |
| working-directory: frontend | ||
|
|
||
| jobs: | ||
| build: | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| packages: write | ||
| contents: read | ||
|
|
||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v3 | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)Pin GitHub Actions by commit hash to ensure supply chain security. Using a branch ( - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
|
|
||
| - name: Login to GHCR | ||
| id: login-ghcr | ||
| uses: docker/login-action@v3 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)Pin GitHub Actions by commit hash to ensure supply chain security. Using a branch ( - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
| with: | ||
| registry: ghcr.io | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Build and push | ||
| uses: docker/build-push-action@v5 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)Pin GitHub Actions by commit hash to ensure supply chain security. Using a branch ( - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
| with: | ||
| context: ./services/frontend | ||
| platforms: linux/arm64, linux/amd64 | ||
| push: true | ||
| tags: ghcr.io/datadog/storedog/frontend:latest | ||
| build-args: | | ||
| DD_GIT_REPOSITORY_URL=${{ github.server_url }}/${{ github.repository }} | ||
| DD_GIT_COMMIT_SHA=${{ github.sha }} | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🟠 Code Vulnerability
Workflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)
Pin GitHub Actions by commit hash to ensure supply chain security.
Using a branch (
@main) or tag (@v1) allows for implicit updates, which can introduce unexpected or malicious changes. Instead, always pin actions to a full length commit SHA. You can find the commit SHA for the latest tag from the action’s repository and ensure frequent updates via auto-updaters such as dependabot. Include a comment with the corresponding full-length SemVer tag for clarity: