Update external networks #731
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Update external networks | |
| on: | |
| pull_request: | |
| types: | |
| - opened | |
| - reopened | |
| - synchronize | |
| schedule: | |
| - cron: 30 10 * * * # Run this every day at 10:30 UTC | |
| workflow_dispatch: | |
| inputs: | |
| dry-run: | |
| description: Execute Dry Run | |
| required: false | |
| default: true | |
| type: boolean | |
| jobs: | |
| save-current-networks: | |
| name: Download and store currently published latest networks | |
| if: github.event_name == 'schedule' || (github.event.inputs.dry-run == 'false' && github.event_name == 'workflow_dispatch') # Can only be triggered by scheduled run or manual action with dry-run set to false | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Download and test latest networks | |
| run: ${GITHUB_WORKSPACE}/.github/workflows/scripts/download-current-networks.sh | |
| shell: bash | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: current-latest-networks | |
| path: /tmp/external-networks | |
| overwrite: true | |
| build: | |
| name: Build external-network-pusher | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Read Go version from go.mod | |
| run: echo "GO_VERSION=$(grep -E "^go\s+[0-9.]+$" go.mod | cut -d " " -f 2)" >> $GITHUB_ENV | |
| - name: Setup Go environment | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - name: Go Build Cache | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/.cache | |
| key: ${{ runner.os }}-go-build-${{ hashFiles('**/go.sum') }} | |
| - name: Go Mod Cache | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/go/pkg/mod | |
| key: ${{ runner.os }}-go-mod-${{ hashFiles('**/go.sum') }} | |
| - name: Run unit tests | |
| run: make test | |
| - name: Build binaries | |
| run: make build | |
| - name: Upload binary | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: bin | |
| path: .gobin | |
| overwrite: true | |
| include-hidden-files: true | |
| run-dry-run: # Dry run will run on PRs by default | |
| runs-on: ubuntu-latest | |
| needs: build | |
| name: Dry-run external-network-pusher and simulate results | |
| steps: | |
| - uses: 'google-github-actions/auth@v2' | |
| with: | |
| credentials_json: '${{ secrets.GCP_NETWORKS_UPLOADER_SA }}' | |
| - name: 'Set up Cloud SDK' | |
| uses: 'google-github-actions/setup-gcloud@v2' | |
| - name: Download executable | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: bin | |
| - name: Set permissions to file | |
| run: chmod +x linux/network-crawler | |
| - name: Dry run external-network-pusher | |
| run: linux/network-crawler --dry-run --bucket-name definitions.stackrox.io | |
| run-and-upload: | |
| name: Run external-network-pusher and upload results | |
| if: github.event_name == 'schedule' || (github.event.inputs.dry-run == 'false' && github.event_name == 'workflow_dispatch') # Can only be triggered by scheduled run or manual action with dry-run set to false | |
| runs-on: ubuntu-latest | |
| needs: [build, run-dry-run, save-current-networks] | |
| steps: | |
| - uses: 'google-github-actions/auth@v2' | |
| with: | |
| credentials_json: '${{ secrets.GCP_NETWORKS_UPLOADER_SA }}' | |
| - name: 'Set up Cloud SDK' | |
| uses: 'google-github-actions/setup-gcloud@v2' | |
| - name: Download executable | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: bin | |
| - name: Set permissions to file | |
| run: chmod +x linux/network-crawler | |
| - name: Run external-network-pusher | |
| run: linux/network-crawler --bucket-name definitions.stackrox.io | |
| notify: | |
| name: Notify about failed run | |
| if: failure() && (github.event_name == 'schedule' || (github.event.inputs.dry-run == 'false' && github.event_name == 'workflow_dispatch')) # Only trigger on failures of schedule & manual non-dry runs | |
| needs: run-and-upload | |
| runs-on: ubuntu-latest | |
| env: | |
| SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }} | |
| steps: | |
| - name: Post to Slack channel team-acs-maple-interruptions | |
| uses: slackapi/slack-github-action@v1.26.0 | |
| with: | |
| channel-id: "C03SWCX9W0Z" | |
| payload: >- | |
| { "blocks": [ | |
| { "type": "section", "text": { "type": "mrkdwn", "text": | |
| ":red-warning: Daily update of external networks for defintions.stackrox.io failed! :red-warning:\nRefer to the Workflow logs for more information."}}, | |
| { "type": "divider" }, | |
| { "type": "section", "text": { "type": "mrkdwn", "text": | |
| "> | |
| Repository: <${{github.server_url}}/${{github.repository}}|${{github.repository}}>\n> | |
| Workflow: <${{github.server_url}}/${{github.repository}}/actions/runs/${{github.run_id}}|${{github.workflow}}>" }} | |
| ]} |