mkdir -p ~/docker-practice/step23 cd ~/docker-practice/step23 pwd

# ディレクトリ構造を作成 mkdir -p .github/workflows # 構造 # myproject/ # ├── .github/ # │ └── workflows/ # │ ├── docker-build.yml # ビルドワークフロー # │ └── docker-publish.yml # プッシュワークフロー # ├── Dockerfile # ├── requirements.txt # └── app.py

# ワークフローファイルを作成 cat > .github/workflows/docker-build.yml << ‘EOF’ # ワークフローの名前 name: Docker Build # トリガー：いつ実行するか on: push: branches: [ main ] # mainブランチへのプッシュ時 pull_request: branches: [ main ] # mainへのPR作成時 # ジョブ：実行する処理 jobs: build: runs-on: ubuntu-latest # 実行環境 steps: # ステップ1: コードをチェックアウト – name: Checkout code uses: actions/checkout@v3 # ステップ2: Dockerイメージをビルド – name: Build Docker image run: | docker build -t myapp:test . # ステップ3: 簡単なテスト – name: Test Docker image run: | docker run –rm myapp:test python -c “print(‘Hello CI/CD!’)” EOF cat .github/workflows/docker-build.yml

cat > .github/workflows/docker-publish.yml << ‘EOF’ name: Docker Publish on: push: branches: [ main ] tags: – ‘v*’ # v1.0.0 のようなタグ env: IMAGE_NAME: myapp jobs: build-and-push: runs-on: ubuntu-latest steps: # コードをチェックアウト – name: Checkout code uses: actions/checkout@v3 # Docker Buildxをセットアップ（マルチプラットフォーム対応） – name: Set up Docker Buildx uses: docker/setup-buildx-action@v2 # Docker Hubにログイン – name: Login to Docker Hub uses: docker/login-action@v2 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} # メタデータを抽出（タグ生成） – name: Extract metadata id: meta uses: docker/metadata-action@v4 with: images: ${{ secrets.DOCKERHUB_USERNAME }}/${{ env.IMAGE_NAME }} tags: | type=ref,event=branch type=semver,pattern={{version}} type=sha # ビルドしてプッシュ – name: Build and push uses: docker/build-push-action@v4 with: context: . push: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha cache-to: type=gha,mode=max EOF

cat > .github/workflows/security-scan.yml << ‘EOF’ name: Security Scan on: push: branches: [ main ] schedule: – cron: ‘0 0 * * 0’ # 毎週日曜日の0時（UTC） jobs: scan: runs-on: ubuntu-latest steps: – name: Checkout code uses: actions/checkout@v3 – name: Build image for scanning run: docker build -t myapp:scan . – name: Run Trivy vulnerability scanner uses: aquasecurity/trivy-action@master with: image-ref: ‘myapp:scan’ format: ‘table’ exit-code: ‘1’ # 脆弱性発見時は失敗 ignore-unfixed: true # 修正不可なものは無視 severity: ‘CRITICAL,HIGH’ # 重大度の高いもののみ – name: Run Trivy and output SARIF uses: aquasecurity/trivy-action@master if: always() with: image-ref: ‘myapp:scan’ format: ‘sarif’ output: ‘trivy-results.sarif’ – name: Upload scan results uses: github/codeql-action/upload-sarif@v2 if: always() with: sarif_file: ‘trivy-results.sarif’ EOF

# Flaskアプリを作成 cat > app.py << ‘EOF’ from flask import Flask, jsonify app = Flask(__name__) @app.route(‘/’) def hello(): return jsonify({‘message’: ‘Hello CI/CD!’, ‘status’: ‘ok’}) @app.route(‘/health’) def health(): return jsonify({‘status’: ‘healthy’}) if __name__ == ‘__main__’: app.run(host=’0.0.0.0′, port=5000) EOF # 依存関係ファイル cat > requirements.txt << ‘EOF’ flask==2.3.0 pytest==7.4.0 EOF # テストファイル mkdir -p tests cat > tests/test_app.py << ‘EOF’ import pytest from app import app @pytest.fixture def client(): app.config[‘TESTING’] = True with app.test_client() as client: yield client def test_hello(client): response = client.get(‘/’) assert response.status_code == 200 assert b’Hello CI/CD!’ in response.data def test_health(client): response = client.get(‘/health’) assert response.status_code == 200 assert b’healthy’ in response.data EOF

cat > Dockerfile << ‘EOF’ FROM python:3.9-slim WORKDIR /app COPY requirements.txt . RUN pip install –no-cache-dir -r requirements.txt COPY . . EXPOSE 5000 HEALTHCHECK –interval=30s –timeout=3s \ CMD curl -f http://localhost:5000/health || exit 1 CMD [“python”, “app.py”] EOF

cat > .github/workflows/ci-cd.yml << ‘EOF’ name: CI/CD Pipeline on: push: branches: [ main, develop ] pull_request: branches: [ main ] release: types: [ published ] env: DOCKER_IMAGE: ${{ secrets.DOCKERHUB_USERNAME }}/myapp jobs: # ジョブ1: テスト test: runs-on: ubuntu-latest steps: – uses: actions/checkout@v3 – name: Set up Python uses: actions/setup-python@v4 with: python-version: ‘3.9’ – name: Install dependencies run: | pip install -r requirements.txt – name: Run tests run: pytest tests/ -v # ジョブ2: ビルドとスキャン build-and-scan: needs: test runs-on: ubuntu-latest steps: – uses: actions/checkout@v3 – name: Set up Docker Buildx uses: docker/setup-buildx-action@v2 – name: Build image uses: docker/build-push-action@v4 with: context: . load: true tags: ${{ env.DOCKER_IMAGE }}:test – name: Run Trivy scan uses: aquasecurity/trivy-action@master with: image-ref: ${{ env.DOCKER_IMAGE }}:test format: ‘table’ exit-code: ‘0’ severity: ‘CRITICAL,HIGH’ # ジョブ3: プッシュ（mainブランチのみ） push: needs: build-and-scan if: github.ref == ‘refs/heads/main’ runs-on: ubuntu-latest steps: – uses: actions/checkout@v3 – name: Set up Docker Buildx uses: docker/setup-buildx-action@v2 – name: Login to Docker Hub uses: docker/login-action@v2 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} – name: Extract metadata id: meta uses: docker/metadata-action@v4 with: images: ${{ env.DOCKER_IMAGE }} tags: | type=ref,event=branch type=sha type=raw,value=latest – name: Build and push uses: docker/build-push-action@v4 with: context: . push: true tags: ${{ steps.meta.outputs.tags }} cache-from: type=gha cache-to: type=gha,mode=max # ジョブ4: デプロイ通知 notify: needs: push if: success() runs-on: ubuntu-latest steps: – name: Send notification run: | echo “✅ Deployment successful!” echo “Image: ${{ env.DOCKER_IMAGE }}:latest” EOF

# 1. ローカルでテスト pytest tests/ -v # 2. コードをコミット・プッシュ git add . git commit -m “Add CI/CD pipeline” git push origin main # 3. GitHubでActionsタブを確認 # → テスト → ビルド → スキャン → プッシュ の順で実行される # 4. Docker Hubでイメージを確認 # https://hub.docker.com/r/username/myapp/tags

# ワークフローにデバッグステップを追加 – name: Debug info run: | echo “Branch: ${{ github.ref }}” echo “Event: ${{ github.event_name }}” echo “SHA: ${{ github.sha }}” ls -la cat Dockerfile