[KAIZEN-0] Gi skrivetilgang til workflow

navikt · Sep 14, 2023 · b7ae46f · b7ae46f
1 parent 1b4e5fb
commit b7ae46f
Show file tree

Hide file tree

Showing 2 changed files with 78 additions and 72 deletions.
diff --git a/.github/workflows/gh-pages.yml b/.github/workflows/gh-pages.yml
@@ -11,12 +11,16 @@ env:
 jobs:
     build-and-deploy:
         runs-on: ubuntu-latest
+        permissions:
+            pages: write
+            id-token: write
+
         steps:
             - name: Checkout
               uses: actions/checkout@v2
             - uses: actions/setup-node@v1
               with:
-                node-version: '16.13.1'
+                  node-version: '16.13.1'
             - uses: actions/cache@v1
               with:
                   path: ~/.npm

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -3,78 +3,80 @@ name: Build, push, and deploy
 on: [push]
 
 env:
-  IMAGE: ghcr.io/${{ github.repository }}/modiapersonoversikt:${{ github.sha }}
-  SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
-  CI: true
-  TZ: Europe/Oslo
-  Q1_TEST_BRANCH: refs/heads/branch_name
+    IMAGE: ghcr.io/${{ github.repository }}/modiapersonoversikt:${{ github.sha }}
+    SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+    CI: true
+    TZ: Europe/Oslo
+    Q1_TEST_BRANCH: refs/heads/branch_name
 
 jobs:
-  build:
-    name: Build
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
-        with:
-          node-version: '16.13.1'
-          cache: 'npm'
-      - name: Install dependencies
-        run: npm ci
-      - name: Test
-        run: npm run test
-      - name: Build
-        run: npm run build
-      - name: Upload sourcemaps
-        if: github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/master' || github.ref == env.Q1_TEST_BRANCH
-        run: npm run upload-sourcemaps
-      - name: Publish Docker image
-        if: github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/master' || github.ref == env.Q1_TEST_BRANCH
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          echo ${GITHUB_TOKEN} | docker login ghcr.io -u ${GITHUB_REPOSITORY} --password-stdin
-          docker build --tag ${IMAGE} .
-          docker push ${IMAGE}
-      - name: Deploy to Q1 (Test branch)
-        uses: nais/deploy/actions/deploy@v1
-        if: github.ref == env.Q1_TEST_BRANCH
-        env:
-          APIKEY: ${{ secrets.NAIS_DEPLOY_APIKEY }}
-          PRINT_PAYLOAD: true
-          CLUSTER: dev-fss
-          RESOURCE: .nais/qa-template.yaml
-          VAR: q_env=q1,version=${{ github.sha }}
+    build:
+        name: Build
+        runs-on: ubuntu-latest
+        permissions:
+            packages: write
+        steps:
+            - uses: actions/checkout@v3
+            - uses: actions/setup-node@v3
+              with:
+                  node-version: '16.13.1'
+                  cache: 'npm'
+            - name: Install dependencies
+              run: npm ci
+            - name: Test
+              run: npm run test
+            - name: Build
+              run: npm run build
+            - name: Upload sourcemaps
+              if: github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/master' || github.ref == env.Q1_TEST_BRANCH
+              run: npm run upload-sourcemaps
+            - name: Publish Docker image
+              if: github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/master' || github.ref == env.Q1_TEST_BRANCH
+              env:
+                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+              run: |
+                  echo ${GITHUB_TOKEN} | docker login ghcr.io -u ${GITHUB_REPOSITORY} --password-stdin
+                  docker build --tag ${IMAGE} .
+                  docker push ${IMAGE}
+            - name: Deploy to Q1 (Test branch)
+              uses: nais/deploy/actions/deploy@v1
+              if: github.ref == env.Q1_TEST_BRANCH
+              env:
+                  APIKEY: ${{ secrets.NAIS_DEPLOY_APIKEY }}
+                  PRINT_PAYLOAD: true
+                  CLUSTER: dev-fss
+                  RESOURCE: .nais/qa-template.yaml
+                  VAR: q_env=q1,version=${{ github.sha }}
 
-  deploy-qa:
-    name: Deploy to preprod
-    needs: build
-    if: github.ref == 'refs/heads/dev'
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        q_env: [q0, q1]
-    steps:
-      - uses: actions/checkout@v3
-      - uses: nais/deploy/actions/deploy@v1
-        env:
-          APIKEY: ${{ secrets.NAIS_DEPLOY_APIKEY }}
-          PRINT_PAYLOAD: true
-          CLUSTER: dev-fss
-          RESOURCE: .nais/qa-template.yaml
-          VAR: q_env=${{ matrix.q_env }},version=${{ github.sha }}
+    deploy-qa:
+        name: Deploy to preprod
+        needs: build
+        if: github.ref == 'refs/heads/dev'
+        runs-on: ubuntu-latest
+        strategy:
+            matrix:
+                q_env: [q0, q1]
+        steps:
+            - uses: actions/checkout@v3
+            - uses: nais/deploy/actions/deploy@v1
+              env:
+                  APIKEY: ${{ secrets.NAIS_DEPLOY_APIKEY }}
+                  PRINT_PAYLOAD: true
+                  CLUSTER: dev-fss
+                  RESOURCE: .nais/qa-template.yaml
+                  VAR: q_env=${{ matrix.q_env }},version=${{ github.sha }}
 
-  deploy-prod:
-    name: Deploy to prod
-    needs: build
-    if: github.ref == 'refs/heads/master'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: nais/deploy/actions/deploy@v1
-        env:
-          APIKEY: ${{ secrets.NAIS_DEPLOY_APIKEY }}
-          PRINT_PAYLOAD: true
-          CLUSTER: prod-fss
-          RESOURCE: .nais/prod.yaml
-          VAR: version=${{ github.sha }}
+    deploy-prod:
+        name: Deploy to prod
+        needs: build
+        if: github.ref == 'refs/heads/master'
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v3
+            - uses: nais/deploy/actions/deploy@v1
+              env:
+                  APIKEY: ${{ secrets.NAIS_DEPLOY_APIKEY }}
+                  PRINT_PAYLOAD: true
+                  CLUSTER: prod-fss
+                  RESOURCE: .nais/prod.yaml
+                  VAR: version=${{ github.sha }}