ci: add Doppler validation and fetch in workflow #11
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Sentinel | ||
|
Check failure on line 1 in .github/workflows/sentinel.yml
|
||
| on: | ||
| workflow_dispatch: | ||
| schedule: | ||
| - cron: "0 7,8 * * 6" | ||
| permissions: | ||
| contents: write | ||
| concurrency: | ||
| group: sentinel-scan | ||
| cancel-in-progress: false | ||
| jobs: | ||
| scan: | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 10 | ||
| steps: | ||
| - name: Check Europe/Rome schedule | ||
| id: schedule | ||
| if: github.event_name == 'schedule' | ||
| run: | | ||
| if [ "$(TZ=Europe/Rome date +%H)" = "09" ]; then | ||
| echo "should_run=true" >> "$GITHUB_OUTPUT" | ||
| else | ||
| echo "Fuori dalla finestra 09:00 Europe/Rome, skip." | ||
| echo "should_run=false" >> "$GITHUB_OUTPUT" | ||
| fi | ||
| - name: Verifica variabili Doppler | ||
| if: github.event_name != 'schedule' || steps.schedule.outputs.should_run == 'true' | ||
| env: | ||
| DOPPLER_PROJECT: ${{ vars.DOPPLER_PROJECT }} | ||
| DOPPLER_CONFIG: ${{ vars.DOPPLER_CONFIG }} | ||
| DOPPLER_TOKEN_PRESENT: ${{ secrets.DOPPLER_TOKEN }} | ||
| run: | | ||
| if [ -z "${DOPPLER_PROJECT:-}" ]; then | ||
| echo "::warning::DOPPLER_PROJECT non impostato" | ||
| fi | ||
| if [ -z "${DOPPLER_CONFIG:-}" ]; then | ||
| echo "::warning::DOPPLER_CONFIG non impostata" | ||
| fi | ||
| if [ -z "${DOPPLER_TOKEN_PRESENT:-}" ]; then | ||
| echo "::notice::DOPPLER_TOKEN assente: il fetch non verrà eseguito." | ||
| fi | ||
| - name: Fetch secrets from Doppler | ||
| if: ${{ secrets.DOPPLER_TOKEN != '' && vars.DOPPLER_PROJECT != '' && vars.DOPPLER_CONFIG != '' && (github.event_name != 'schedule' || steps.schedule.outputs.should_run == 'true') }} | ||
| uses: dopplerhq/secrets-fetch-action@v2.0.0 | ||
| with: | ||
| doppler-token: ${{ secrets.DOPPLER_TOKEN }} | ||
| project: ${{ vars.DOPPLER_PROJECT }} | ||
| config: ${{ vars.DOPPLER_CONFIG }} | ||
| inject-env-vars: true | ||
| - name: Check email secrets | ||
| if: github.event_name != 'schedule' || steps.schedule.outputs.should_run == 'true' | ||
| env: | ||
| SENTINEL_EMAIL_TO: ${{ secrets.SENTINEL_EMAIL_TO }} | ||
| SENTINEL_EMAIL_FROM: ${{ secrets.SENTINEL_EMAIL_FROM }} | ||
| SENTINEL_GMAIL_USER: ${{ secrets.SENTINEL_GMAIL_USER }} | ||
| SENTINEL_GMAIL_APP_PASSWORD: ${{ secrets.SENTINEL_GMAIL_APP_PASSWORD }} | ||
| run: | | ||
| missing=0 | ||
| for name in \ | ||
| SENTINEL_EMAIL_TO \ | ||
| SENTINEL_EMAIL_FROM \ | ||
| SENTINEL_GMAIL_USER \ | ||
| SENTINEL_GMAIL_APP_PASSWORD | ||
| do | ||
| if [ -z "${!name}" ]; then | ||
| echo "::error::Secret mancante: $name" | ||
| missing=1 | ||
| fi | ||
| done | ||
| if [ "$missing" -ne 0 ]; then | ||
| echo "Configura i secret Gmail prima di avviare la scansione Sentinel." | ||
| exit 1 | ||
| fi | ||
| - name: Checkout | ||
| if: github.event_name != 'schedule' || steps.schedule.outputs.should_run == 'true' | ||
| uses: actions/checkout@v6 | ||
| - name: Setup Node | ||
| if: github.event_name != 'schedule' || steps.schedule.outputs.should_run == 'true' | ||
| uses: actions/setup-node@v6 | ||
| with: | ||
| node-version: 22 | ||
| cache: npm | ||
| - name: Install | ||
| if: github.event_name != 'schedule' || steps.schedule.outputs.should_run == 'true' | ||
| run: npm ci | ||
| - name: Test | ||
| if: github.event_name != 'schedule' || steps.schedule.outputs.should_run == 'true' | ||
| run: npm test | ||
| - name: Build | ||
| if: github.event_name != 'schedule' || steps.schedule.outputs.should_run == 'true' | ||
| run: npm run build | ||
| - name: Scan | ||
| id: scan | ||
| if: github.event_name != 'schedule' || steps.schedule.outputs.should_run == 'true' | ||
| env: | ||
| SENTINEL_EMAIL_TO: ${{ secrets.SENTINEL_EMAIL_TO }} | ||
| SENTINEL_EMAIL_FROM: ${{ secrets.SENTINEL_EMAIL_FROM }} | ||
| SENTINEL_GMAIL_USER: ${{ secrets.SENTINEL_GMAIL_USER }} | ||
| SENTINEL_GMAIL_APP_PASSWORD: ${{ secrets.SENTINEL_GMAIL_APP_PASSWORD }} | ||
| SENTINEL_ICLOUD_USER: ${{ secrets.SENTINEL_ICLOUD_USER }} | ||
| SENTINEL_ICLOUD_APP_PASSWORD: ${{ secrets.SENTINEL_ICLOUD_APP_PASSWORD }} | ||
| run: | | ||
| set +e | ||
| npm run sentinel -- scan | ||
| status=$? | ||
| echo "exit_code=$status" >> "$GITHUB_OUTPUT" | ||
| exit 0 | ||
| - name: Generate dashboard | ||
| if: github.event_name != 'schedule' || steps.schedule.outputs.should_run == 'true' | ||
| run: npm run sentinel -- dashboard | ||
| - name: Commit application outputs | ||
| if: github.event_name != 'schedule' || steps.schedule.outputs.should_run == 'true' | ||
| run: | | ||
| git config user.name "github-actions[bot]" | ||
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | ||
| mkdir -p data snapshots reports | ||
| git add data snapshots reports | ||
| if git diff --cached --quiet; then | ||
| echo "Nessun output da committare." | ||
| exit 0 | ||
| fi | ||
| git commit -m "chore: update sentinel outputs" | ||
| git push | ||
| - name: Fail on scan errors | ||
| if: github.event_name != 'schedule' || steps.schedule.outputs.should_run == 'true' | ||
| run: | | ||
| if [ "${{ steps.scan.outputs.exit_code }}" != "0" ]; then | ||
| echo "Scan conclusa con exit code ${{ steps.scan.outputs.exit_code }}." | ||
| exit "${{ steps.scan.outputs.exit_code }}" | ||
| fi | ||
