Before utilizing the CodeMender workflows, the foundational authentication and repository settings must be established.
1. Google Cloud Configuration (Terraform) This repository automates the creation of a Workload Identity Pool, a GitHub-specific Provider, and a Service Account with the necessary IAM bindings.
- Initialize and apply the Terraform configurations found in this repository to your target GCP project.
- For a deeper dive into the mechanics of this setup, reference this Workload Identity Federation Guide.
2. GitHub Repository Secrets Once Terraform has provisioned the infrastructure, the resulting outputs must be mapped to your target repository's secrets (Settings > Secrets and variables > Actions):
WIF_PROVIDER: The full path of the created WIF provider.WIF_SERVICE_ACCOUNT: The email address of the provisioned GCP Service Account.
3. GitHub Actions Settings Ensure your target repository is permitted to execute workflows and manage Pull Requests (Settings > Actions > General):
- Actions permissions: Enable "Allow all actions and reusable workflows."
- Workflow permissions: Enable "Read and write permissions" to allow ChatOps workflows to generate and update PRs.
This repository includes a list of GitHub Actions examples, ranging from basic vulnerability scanning to advanced ChatOps remediation and bulk fixes.
For a complete list see the Example Workflows Documentation.
These examples introduce certain constraints:
- Execution Overhead: The CLI is currently installed dynamically on each workflow run. This creates latency and is inefficient when scaling against massive repositories.
- Containerization Constraints: Transitioning to a pre-built container image would optimize runtime performance. NOTE: Must plan to mitigate nested container execution issues.
Repositories using one or more of the example workflows