Chris Christiansen
79b100caff
Some checks are pending
Check Python Version Consistency / Check Python Version (push) Waiting to run
- SECURITY.md: Overordnet visjon med lenker til alle manifestfiler - SECURITY_AUDITS.md: Historikk og To-Do liste - RUNBOOK.md: 6 operasjonelle scenarier (ukjent bruker, eksponert secret, 401/403, 50x, VPC-SC, BinAuthz) - INCIDENT_RESPONSE.md: PICERL-modell med eskaleringsmatrise - SECRET_MANAGEMENT.md: Policy + lokal utvikling - ACCESS_CONTROL.md: IAM-policy med service account-oversikt - COMPLIANCE.md: TYR, Binary Auth, KMS-attestasjon Opprydding: - Slettet sensitive filer (test_secret.txt, final-secret-test.txt, tyr/certs/ca_password.txt) - Slettet engangsskript og midlertidige filer - Oppdatert .gitignore med *.txt
58 lines
2.0 KiB
YAML
58 lines
2.0 KiB
YAML
# agents/mcp_server/cloudbuild.yaml
|
|
# Deploy opax-mcp som separat Cloud Run-tjeneste
|
|
# Trigger: path filter agents/mcp_server/** på branch main
|
|
|
|
substitutions:
|
|
_TAG: 'latest'
|
|
_OSVAUCO_TRIGGER_ID: '38423976-91ff-4ff4-859e-1f262344c609'
|
|
|
|
steps:
|
|
- name: 'python:3.11-slim'
|
|
id: 'SecurityScan'
|
|
entrypoint: 'bash'
|
|
args:
|
|
- '-c'
|
|
- |
|
|
pip install bandit pip-audit
|
|
echo "=== SAST (bandit) ==="
|
|
bandit -r . -ll -ii || true
|
|
echo "=== Dependency scan (pip-audit) ==="
|
|
pip-audit -r agents/mcp_server/requirements.txt || true
|
|
|
|
- name: 'gcr.io/cloud-builders/docker'
|
|
entrypoint: bash
|
|
args:
|
|
- '-c'
|
|
- |
|
|
TAG="${SHORT_SHA:-${_TAG}}"
|
|
docker build \
|
|
-t us-central1-docker.pkg.dev/$PROJECT_ID/osvauco-repo/opax-mcp:$$TAG \
|
|
-f agents/mcp_server/Dockerfile \
|
|
agents/mcp_server
|
|
docker push us-central1-docker.pkg.dev/$PROJECT_ID/osvauco-repo/opax-mcp:$$TAG
|
|
echo "$$TAG" > /workspace/image_tag.txt
|
|
|
|
- name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
|
|
entrypoint: bash
|
|
args:
|
|
- '-c'
|
|
- |
|
|
TAG=$(cat /workspace/image_tag.txt)
|
|
gcloud run deploy opax-mcp \
|
|
--image=us-central1-docker.pkg.dev/$PROJECT_ID/osvauco-repo/opax-mcp:$$TAG \
|
|
--region=us-central1 \
|
|
--platform=managed \
|
|
--no-allow-unauthenticated \
|
|
--service-account=jason-vauger@$PROJECT_ID.iam.gserviceaccount.com \
|
|
--set-env-vars=GOOGLE_CLOUD_PROJECT=$PROJECT_ID,STATIC_BUCKET=opax-vauco-static,CLOUD_RUN_SERVICE=osvauco-agent,CLOUD_BUILD_TRIGGER_ID=${_OSVAUCO_TRIGGER_ID},OPAX_IAP_CLIENT_ID=357036551735-kq8nt7ld38hfqlcfb3n52ef7tala4meo.apps.googleusercontent.com \
|
|
--update-secrets=MCP_SECRET=mcp-server-key:latest,GITEA_TOKEN=gitea-token:latest,GITHUB_PAT=github-pat:latest \
|
|
--memory=512Mi \
|
|
--cpu=1 \
|
|
--min-instances=0 \
|
|
--max-instances=5 \
|
|
--timeout=60
|
|
|
|
options:
|
|
logging: CLOUD_LOGGING_ONLY
|
|
defaultLogsBucketBehavior: REGIONAL_USER_OWNED_BUCKET
|