The DevOps project's finished pipeline played one event at a time — a push to a topic branch, a pull request through its checks and its review, the merge that builds, pushes and deploys the image, and a push to main the branch rule refuses.
The project's finished pipeline, played one event at a time.
- A push to a topic branch runs the branch workflow: quick tests, for the developer; it blocks nothing.
- A pull request runs the gate: every check, on a trial merge, then the review; a new commit runs the checks again.
- A merge is a push to
main, and runs the merge workflow: the image to Docker Hub, the deploy to EKS, the smoke test. - A push to
main is refused by the branch rule, so it starts nothing.
Reading the drawing
- Left: your machine's terminal, the repository (branches, the pull request, commits on
main, the branch rule,
the secrets), and pr-reviewer. - Middle, GitHub Actions: the event, the runs it started with their jobs, the runner of the job in view, and the
OpenID Provider.
- A job is ○ waiting, ● running or ✓ done.
- The runner's Credentials show what the job holds: 🔒 marks a credential.
- Right: Docker Hub's image tags, and AWS: the IAM role, STS, the cluster's deployment and pods, the load balancer.
- Viewer steps, far right: each step of the story, with its explanation.
The credentials, and where they live
| Credential | Lives in | Reaches the job | Lasts |
|---|
GITHUB_TOKEN | made by GitHub for each job | every job | until the job ends |
DOCKERHUB_TOKEN | the repository's secrets | image-push only | until it expires or is deactivated |
| ID token | made by GitHub's OpenID Provider on request | deploy | minutes, used once |
| AWS credentials | made by STS for the ID token | deploy | one hour |
The tasks that build each part are in
The Plan.