Bonnes pratiques¶

# Cache Go modules
- name: Cache Go modules
  uses: actions/cache@v4
  with:
    path: ~/go/pkg/mod
    key: go-${{ hashFiles('go.sum') }}
    restore-keys: go-

# Cache Node modules
- name: Cache Node modules
  uses: actions/cache@v4
  with:
    path: ~/.npm
    key: npm-${{ hashFiles('package-lock.json') }}
    restore-keys: npm-

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: make lint

  test-unit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: make test-unit

  test-integration:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: make test-integration

  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: trivy fs .

  # Ce job attend tous les precedents
  build:
    needs: [lint, test-unit, test-integration, scan]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: make build

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        go-version: ["1.21", "1.22", "1.23"]
        os: [ubuntu-latest, alpine]
      fail-fast: false    # ne pas arreter les autres si un echoue
    steps:
      - uses: actions/checkout@v4
      - name: Setup Go ${{ matrix.go-version }}
        uses: actions/setup-go@v5
        with:
          go-version: ${{ matrix.go-version }}
      - run: go test ./...

# Kubernetes : utiliser un Deployment avec HPA
apiVersion: apps/v1
kind: Deployment
metadata:
  name: gitea-runner
  namespace: ci-runners
spec:
  replicas: 2        # minimum
  selector:
    matchLabels:
      app: gitea-runner
  template:
    metadata:
      labels:
        app: gitea-runner
    spec:
      serviceAccountName: gitea-runner
      containers:
        - name: runner
          image: gitea/act_runner:latest
          args: ["daemon", "--config", "/config/config.yaml"]
          resources:
            requests:
              cpu: "1"
              memory: 2Gi
            limits:
              cpu: "2"
              memory: 4Gi
          volumeMounts:
            - name: config
              mountPath: /config
            - name: data
              mountPath: /data
      volumes:
        - name: config
          configMap:
            name: runner-config
        - name: data
          emptyDir: {}
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: gitea-runner-hpa
  namespace: ci-runners
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: gitea-runner
  minReplicas: 2
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70

# clusters/production/infrastructure.yaml
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: infrastructure-controllers
  namespace: flux-system
spec:
  interval: 1h
  retryInterval: 1m
  prune: true
  sourceRef:
    kind: GitRepository
    name: flux-system
  path: ./infrastructure/controllers
---
# clusters/production/apps.yaml
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: apps
  namespace: flux-system
spec:
  interval: 5m
  prune: true
  sourceRef:
    kind: GitRepository
    name: flux-system
  path: ./apps/overlays/production
  # Les apps attendent que l'infra soit prete
  dependsOn:
    - name: infrastructure-controllers

# Workflow de promotion
- name: Promote to production
  if: github.ref == 'refs/heads/main'
  run: |
    TAG="${GITHUB_SHA::8}"

    # Copier le tag de staging vers production
    cd apps/overlays/production
    kustomize edit set image \
      harbor.example.com/org/myapp:${TAG}

    git commit -am "promote: myapp ${TAG} to production"
    git push

# Alert specifique au drift
apiVersion: notification.toolkit.fluxcd.io/v1beta3
kind: Alert
metadata:
  name: drift-alerts
  namespace: flux-system
spec:
  providerRef:
    name: mattermost
  eventSeverity: info
  eventSources:
    - kind: Kustomization
      name: "*"
  inclusionList:
    - ".*drift.*"

# Mauvais : le tag v4 peut etre modifie par le mainteneur
- uses: actions/checkout@v4

# Bon : hash immuable, verifiable
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.1.1

- name: Generate SLSA provenance
  run: |
    # Signer l'image avec cosign
    cosign sign --key env://COSIGN_PRIVATE_KEY \
      ${REGISTRY}/${IMAGE_NAME}:${TAG}

    # Generer l'attestation de provenance
    cosign attest --key env://COSIGN_PRIVATE_KEY \
      --predicate provenance.json \
      --type slsaprovenance \
      ${REGISTRY}/${IMAGE_NAME}:${TAG}

apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: myapp-production
  namespace: flux-system
spec:
  interval: 5m
  prune: true
  sourceRef:
    kind: GitRepository
    name: manifests
  path: ./overlays/production
  verify:
    provider: cosign
    secretRef:
      name: cosign-public-key

# .gitea/renovate.json
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "gitea-actions": {
    "enabled": true,
    "pinDigests": true
  },
  "dockerfile": {
    "enabled": true
  }
}