CI/CD

Github Actions

• Pricing
• Contexts
• Workflow syntax
• act

Security Considerations

• Preventing pwn requests
  • TL;DR: Combining pull_request_target workflow trigger with an explicit checkout of an untrusted PR is a dangerous practice that may lead to repository compromise.
• Self-hosted
  • TL;DR: Using native GH events in your workflow can lead to arbitrary code execution
• Dependabot
• snyk.io

Workflows

• Synk Example
• Pa11y
• Synk Workflow
• Discord

Prettier

Append to jobs.code-quality.steps:

- uses: actions/setup-node@v3
  with:
    node-version: 16
- run: npx prettier --check .

Discord Notification

Append to jobs.code-quality.steps:

- name: Discord Success
  if: $
  uses: appleboy/discord-action@0.0.3
  with:
    webhook_id: $
    webhook_token: $
    color: "#00ff00"
    message: |
      Job Succeeded 🧘
      $/$/actions/runs/$

- name: Discord Failure
  if: $
  uses: appleboy/discord-action@0.0.3
  with:
    webhook_id: $
    webhook_token: $
    color: "#FF0000"
    message: |
      Job Failed 🫠
      $/$/actions/runs/$

Deployment

Append to jobs:

deploy:
  runs-on: ubuntu-latest
  needs: code-quality
  steps:
    - name: Checkout code
      uses: actions/checkout@v3
    - name: Setup SSH
      uses: webfactory/ssh-agent@v0.5.3
      with:
        ssh-private-key: $
    - name: Setup PHP
      uses: shivammathur/setup-php@v2
      with:
        php-version: 8.0
        tools: composer:v2
        ini-values: post_max_size=256M, max_execution_time=180, memory_limit=512M
        extensions: ctype,curl,dom,iconv,imagick,intl,json,mbstring,openssl,pcre,pdo,reflection,spl,zip
    - name: Require Forge CLI
      run: composer global require laravel/forge-cli
    - name: Deploy Site
      run: |
        forge server:switch hidden-firefly
        forge deploy applefakenews.com
        forge command applefakenews.com --command="php craft migrate/all --no-content --interactive=0"
        forge command applefakenews.com --command="php craft project-config/apply"
        forge command applefakenews.com --command="php craft migrate --track=content --interactive=0"
      env:
        FORGE_API_TOKEN: $
    - uses: lhansford/bugsnag-report-build-action@v1.1.0
      name: Report Build to Bugsnag
      with:
        appVersion: $
        apiKey: $

Cron

.github/workflows/cron.yml:

on:
  workflow_dispatch:
  schedule:
    - cron: 0 0 * * *

jobs:
  log-out:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      - name: Setup SSH
        uses: webfactory/ssh-agent@v0.5.3
        with:
          ssh-private-key: $
      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: 8.0
          tools: composer:v2
          ini-values: post_max_size=256M, max_execution_time=180, memory_limit=512M
          extensions: ctype,curl,dom,iconv,imagick,intl,json,mbstring,openssl,pcre,pdo,reflection,spl,zip
      - name: Require Forge CLI
        run: composer global require laravel/forge-cli
      - name: Log 'em out!
        run: |
          forge server:switch hidden-firefly
          forge command applefakenews.com --command="php craft users/logout-all"
        env:
          FORGE_API_TOKEN: $