fix(Erbscheinsantrag): Correct summary component URL #19116
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: buildAppImage | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| # Allow to run this workflow manually | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| env: | |
| REGISTRY: ghcr.io | |
| jobs: | |
| code-quality: | |
| uses: ./.github/workflows/code-quality.yml | |
| secrets: | |
| SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} | |
| GERICHTSFINDER_ENCRYPTION_KEY: ${{ secrets.GERICHTSFINDER_ENCRYPTION_KEY }} | |
| sonarcloud-scan: | |
| if: ${{ github.actor != 'dependabot[bot]' }} | |
| runs-on: ubuntu-latest | |
| needs: [code-quality] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| name: coverage | |
| - name: SonarQube Scan | |
| uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1 | |
| env: | |
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} | |
| get-content-file: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - id: fetchLatestImageContent | |
| run: ./docker.sh --contentFromImage && mv content_from_image.json content.json | |
| continue-on-error: true | |
| - if: steps.fetchLatestImageContent.outcome == 'failure' | |
| run: pnpm i && pnpm run build:localContent | |
| env: | |
| STRAPI_API: "${{ vars.STRAPI_API }}" | |
| STRAPI_ACCESS_KEY: "${{ secrets.STRAPI_ACCESS_KEY }}" | |
| - name: Calculate content checksum | |
| id: checksum | |
| run: echo "content_checksum=$(./docker.sh --contentHashFromImage)" >> $GITHUB_OUTPUT | |
| - name: Upload content.json | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: content-file | |
| path: content.json | |
| outputs: | |
| content_checksum: ${{ steps.checksum.outputs.content_checksum }} | |
| # integration-tests: | |
| # runs-on: ubuntu-latest | |
| # env: | |
| # STRAPI_API: "${{ vars.STRAPI_API }}" | |
| # STRAPI_ACCESS_KEY: "${{ secrets.STRAPI_ACCESS_KEY }}" | |
| # steps: | |
| # - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| # - uses: ./.github/actions/cached-checkout-install | |
| # - run: pnpm run test:integration | |
| verify-local-e2e: | |
| needs: [get-content-file] | |
| uses: ./.github/workflows/e2e-test.yml | |
| with: | |
| require-published-app: false | |
| e2e-target: local | |
| secrets: | |
| GERICHTSFINDER_ENCRYPTION_KEY: ${{ secrets.GERICHTSFINDER_ENCRYPTION_KEY }} | |
| build-app-image: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: ./.github/actions/cached-checkout-install | |
| - run: ./docker.sh --build app | |
| env: | |
| SENTRY_AUTH_TOKEN: "${{ secrets.SENTRY_AUTH_TOKEN }}" | |
| - name: Save Docker image to file | |
| if: github.ref == 'refs/heads/main' | |
| run: docker save ${{ env.REGISTRY }}/${{ github.repository }}-app:latest | gzip > image.tar.gz | |
| - name: Upload docker image to artifact | |
| if: github.ref == 'refs/heads/main' | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: docker-build | |
| path: image.tar.gz | |
| retention-days: 1 | |
| testing-feature: | |
| if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/APL-266-feature-release' | |
| needs: [code-quality, verify-local-e2e, build-app-image] | |
| permissions: | |
| id-token: write # for cosign w/ keyless signing | |
| packages: write # for updating cosign attestation | |
| security-events: write | |
| uses: ./.github/workflows/testing-feature.yml | |
| secrets: inherit | |
| push-app-image: | |
| if: github.ref == 'refs/heads/main' | |
| runs-on: ubuntu-latest | |
| needs: [code-quality, verify-local-e2e, build-app-image] | |
| permissions: | |
| id-token: write # for cosign w/ keyless signing | |
| packages: write # for updating cosign attestation | |
| security-events: write | |
| steps: | |
| - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: docker-build | |
| - name: Load Docker image | |
| run: docker load --input image.tar.gz | |
| - name: Push the app image | |
| run: ./docker.sh --push app | |
| - run: ./docker.sh --build prod | |
| - run: echo "PROD_IMAGE_TAG=$(./docker.sh --prodImageTag)" >> $GITHUB_ENV | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 | |
| with: | |
| cosign-release: "v2.6.1" # use latest 2.x release until Kyverno supports 3.x | |
| - name: Generate cosign vulnerability scan record for PROD image | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| env: | |
| TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db | |
| with: | |
| image-ref: ${{ env.REGISTRY }}/${{ github.repository }}:${{ env.PROD_IMAGE_TAG }} | |
| format: "cosign-vuln" | |
| output: "vulnerabilities.json" | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| env: | |
| TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db | |
| with: | |
| image-ref: ${{ env.REGISTRY }}/${{ github.repository }}:${{ env.PROD_IMAGE_TAG }} | |
| format: "sarif" | |
| output: "trivy-results.sarif" | |
| ignore-unfixed: true | |
| vuln-type: "os,library" | |
| severity: "CRITICAL,HIGH" | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd #v4.37.7 | |
| with: | |
| sarif_file: "trivy-results.sarif" | |
| - run: ./docker.sh --push prod | |
| - run: ./docker.sh --sign prod | |
| - id: prod_image_tag | |
| run: echo "prod_image_tag=$(./docker.sh --prodImageTag)" >> $GITHUB_OUTPUT | |
| - name: Create SBOM | |
| uses: digitalservicebund/create-sbom@8446cc7ecd4955f86be1856e72306989bea38e36 # main branch, HEAD as of 2026-04-07 | |
| with: | |
| image_name: ${{ github.repository }}-app | |
| outputs: | |
| prod_image_tag: ${{ steps.prod_image_tag.outputs.prod_image_tag }} | |
| deploy-preview: | |
| if: github.ref == 'refs/heads/main' | |
| needs: [push-app-image] | |
| runs-on: ubuntu-latest | |
| environment: preview | |
| concurrency: deploy-preview | |
| steps: | |
| - name: Deploy new preview image | |
| uses: digitalservicebund/argocd-deploy@e8f6b8f77c8b8eeef3f67fc5bba9521f89145645 # v1.0.0 | |
| with: | |
| environment: environments/preview | |
| version: ${{ needs.push-app-image.outputs.prod_image_tag }} | |
| deploying_repo: a2j-rechtsantragstelle | |
| infra_repo: a2j-rechtsantragstelle-infra | |
| github_app_client_id: ${{ secrets.GITOPS_A2J_APP_CLIENT_ID }} | |
| github_app_private_key: ${{ secrets.GITOPS_A2J_APP_PRIVATE_KEY }} | |
| app: a2j-preview | |
| argocd_auth_token: ${{ secrets.ARGOCD_AUTH_TOKEN }} | |
| argocd_server: ${{ secrets.ARGOCD_SERVER_STACKIT }} | |
| argocd_sync_timeout: 600 | |
| - name: Report Deployment | |
| uses: digitalservicebund/track-deployment@5a2815e150e1268983aac5ca04c8c046ed1b614a # v1.0.0 | |
| with: | |
| project: a2j-rechtsantragstelle | |
| environment: preview | |
| metrics_deployment_webhook_url: ${{ secrets.METRICS_DEPLOYMENT_WEBHOOK_URL }} | |
| metrics_webhook_token: ${{ secrets.METRICS_WEBHOOK_TOKEN }} | |
| verify-preview-e2e: | |
| needs: [deploy-preview] | |
| uses: ./.github/workflows/e2e-test.yml | |
| with: | |
| require-published-app: false | |
| use-existing-server: true | |
| e2e-target: preview | |
| deploy-staging: | |
| if: github.ref == 'refs/heads/main' | |
| needs: [push-app-image, deploy-preview] | |
| runs-on: ubuntu-latest | |
| environment: staging | |
| concurrency: deploy-staging | |
| steps: | |
| - name: Deploy new staging image | |
| uses: digitalservicebund/argocd-deploy@e8f6b8f77c8b8eeef3f67fc5bba9521f89145645 # v1.0.0 | |
| with: | |
| environment: environments/staging | |
| version: ${{ needs.push-app-image.outputs.prod_image_tag }} | |
| deploying_repo: a2j-rechtsantragstelle | |
| infra_repo: a2j-rechtsantragstelle-infra | |
| github_app_client_id: ${{ secrets.GITOPS_A2J_APP_CLIENT_ID }} | |
| github_app_private_key: ${{ secrets.GITOPS_A2J_APP_PRIVATE_KEY }} | |
| app: a2j-staging | |
| argocd_auth_token: ${{ secrets.ARGOCD_AUTH_TOKEN }} | |
| argocd_server: ${{ secrets.ARGOCD_SERVER_STACKIT }} | |
| argocd_sync_timeout: 600 | |
| - name: Report Deployment | |
| uses: digitalservicebund/track-deployment@5a2815e150e1268983aac5ca04c8c046ed1b614a # v1.0.0 | |
| with: | |
| project: a2j-rechtsantragstelle | |
| environment: staging | |
| metrics_deployment_webhook_url: ${{ secrets.METRICS_DEPLOYMENT_WEBHOOK_URL }} | |
| metrics_webhook_token: ${{ secrets.METRICS_WEBHOOK_TOKEN }} | |
| deploy-production: | |
| if: github.ref == 'refs/heads/main' | |
| needs: [verify-preview-e2e, push-app-image] | |
| runs-on: ubuntu-latest | |
| environment: production | |
| concurrency: deploy-production | |
| steps: | |
| - name: Deploy new production image | |
| uses: digitalservicebund/argocd-deploy@e8f6b8f77c8b8eeef3f67fc5bba9521f89145645 # v1.0.0 | |
| with: | |
| environment: environments/production | |
| version: ${{ needs.push-app-image.outputs.prod_image_tag }} | |
| deploying_repo: a2j-rechtsantragstelle | |
| infra_repo: a2j-rechtsantragstelle-infra | |
| github_app_client_id: ${{ secrets.GITOPS_A2J_APP_CLIENT_ID }} | |
| github_app_private_key: ${{ secrets.GITOPS_A2J_APP_PRIVATE_KEY }} | |
| app: a2j-production | |
| argocd_auth_token: ${{ secrets.ARGOCD_AUTH_TOKEN }} | |
| argocd_server: ${{ secrets.ARGOCD_SERVER_STACKIT }} | |
| argocd_sync_timeout: 600 | |
| - name: Report Deployment | |
| uses: digitalservicebund/track-deployment@5a2815e150e1268983aac5ca04c8c046ed1b614a # v1.0.0 | |
| with: | |
| project: a2j-rechtsantragstelle | |
| environment: production | |
| metrics_deployment_webhook_url: ${{ secrets.METRICS_DEPLOYMENT_WEBHOOK_URL }} | |
| metrics_webhook_token: ${{ secrets.METRICS_WEBHOOK_TOKEN }} | |
| test-production-text: | |
| needs: [deploy-production] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - run: curl -s -v "https://service.justiz.de" | grep -q "Justiz-Services" | |
| alert-pipeline-failure: | |
| name: Send failure message to Slack | |
| needs: | |
| [ | |
| code-quality, | |
| get-content-file, | |
| verify-local-e2e, | |
| build-app-image, | |
| push-app-image, | |
| deploy-staging, | |
| deploy-preview, | |
| verify-preview-e2e, | |
| deploy-production, | |
| test-production-text, | |
| ] | |
| if: always() && failure() && github.ref == 'refs/heads/main' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: digitalservicebund/notify-on-failure-gha@671832f192aee0a068fd92b2f6deb975df794a84 | |
| with: | |
| SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }} | |
| SLACK_CHANNEL_ID: ${{ secrets.SLACK_CHANNEL_A2J_ALERT_ID }} |