Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 41 additions & 0 deletions actions/gcp-workflows/CHANGELOG.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
# Changelog

All notable changes to the GCP Workflows action will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

### Added
- Future enhancements will be documented here

### Changed
- Future changes will be documented here

### Fixed
- Future bug fixes will be documented here

## [1.0.0] - 2025-10-05

### Added
- Initial release of GCP Workflows action
- Support for static workflow names via `WORKFLOW_NAME` environment variable
- Support for dynamic workflow names via `WORKFLOW_NAME_FIELD` with alert field extraction
- Comprehensive alert data passed to workflows as JSON input
- Support for GCP service account authentication via `GOOGLE_APPLICATION_CREDENTIALS`
- Support for GCP Workload Identity authentication for keyless GKE integration
- Configurable execution timeout via `TIMEOUT_SECONDS`
- Optional workflow completion monitoring via `WAIT_FOR_COMPLETION`
- Workflow name sanitization to ensure GCP naming compliance
- Rich error handling and structured logging
- Security hardening with non-root user execution (UID 1001)
- Comprehensive test suite with unit tests and integration tests
- Complete documentation with usage examples and Workload Identity setup
- Example AlertReaction configurations for various use cases
- GCP setup script (`setup-gcp.sh`) for automated resource provisioning
- Support for extracting workflow names from alert labels and annotations using dot notation
- Environment variable fallbacks for alert data when JSON parsing fails
- Configurable workflow execution source identification
- Container image optimization with multi-stage builds
- Alpine-based runtime image for minimal attack surface
52 changes: 52 additions & 0 deletions actions/gcp-workflows/Dockerfile
Original file line number Diff line number Diff line change
@@ -0,0 +1,52 @@
# Build stage
FROM golang:1.24-alpine AS builder

LABEL org.opencontainers.image.title="Alert Reaction: GCP Workflows Executor"
LABEL org.opencontainers.image.description="Executes Google Cloud Workflows based on Prometheus alerts"
LABEL org.opencontainers.image.source="https://github.com/dudizimber/alert-reactions"
LABEL org.opencontainers.image.vendor="dudizimber"

WORKDIR /app

# Install git (needed for Go modules)
RUN apk add --no-cache git

# Copy go mod files
COPY src/go.mod src/go.sum* ./

# Download dependencies
RUN go mod download

# Copy source code
COPY src/ .

# Build the application
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
-ldflags='-w -s -extldflags "-static"' \
-o gcp-workflows .

# Runtime stage
FROM alpine:3.18

# Install ca-certificates for HTTPS requests
RUN apk --no-cache add ca-certificates tzdata

# Create non-root user
RUN addgroup -g 1001 -S appgroup && \
adduser -u 1001 -S appuser -G appgroup

WORKDIR /app

# Copy binary from builder stage
COPY --from=builder /app/gcp-workflows .

# Change ownership to non-root user
RUN chown -R appuser:appgroup /app

# Switch to non-root user
USER appuser

# Set timezone
ENV TZ=UTC

ENTRYPOINT ["./gcp-workflows"]
Loading