infra-monitoring-kuma/.github/workflows/cd-apply-kuma-config.yml at 2936b5592558b07ab38b8c9c45d990be28b75030 · ZcashFoundation/infra-monitoring-kuma · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
name: Apply Kuma config

# Reconciles kuma-config/ onto the prod Kuma (status.zfnd.org) on merge to main.
# apply.js is declarative and non-destructive. Manual re-run via workflow_dispatch.
# Auth: WIF (keyless) -> a least-privilege SA that reads the admin/webhook secrets
# from Secret Manager. No secrets are stored in GitHub.
on:
  push:
    branches: [main]
    paths:
      - 'kuma-config/**'
  workflow_dispatch:

concurrency:
  group: apply-kuma-config
  cancel-in-progress: false

permissions:
  contents: read
  id-token: write

jobs:
  apply:
    runs-on: ubuntu-latest
    environment: prod
    timeout-minutes: 10
    # Only ever reconcile prod from main — a workflow_dispatch on a feature branch
    # must not apply unmerged kuma-config to prod.
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
        with:
          workload_identity_provider: ${{ vars.GCP_WIF }}
          service_account: ${{ vars.GCP_KUMA_APPLIER_SA }}
          project_id: ${{ vars.GCP_PROJECT }}

      - name: Set up Cloud SDK
        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '20'

      - name: Apply config-as-code
        working-directory: kuma-config
        env:
          KUMA_URL: ${{ vars.KUMA_PUBLIC_URL }}
          KUMA_USERNAME: ${{ vars.KUMA_USERNAME }}
          GCP_PROJECT: ${{ vars.GCP_PROJECT }}
        run: |
          set -euo pipefail
          KUMA_PASSWORD="$(gcloud secrets versions access latest --secret=UPTIME_KUMA_ADMIN_PASSWORD --project="$GCP_PROJECT")"
          SLACK_WEBHOOK_URL="$(gcloud secrets versions access latest --secret=SLACK_WEBHOOK_URL --project="$GCP_PROJECT")"
          echo "::add-mask::$KUMA_PASSWORD"
          echo "::add-mask::$SLACK_WEBHOOK_URL"
          export KUMA_PASSWORD SLACK_WEBHOOK_URL
          npm ci
          node apply.js