net 10 upgrade#356
Merged
Merged
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+110
to
+140
| runs-on: productionserver | ||
| needs: [build, deploystaging] | ||
| environment: production | ||
| name: "Deploy to Production" | ||
|
|
||
| steps: | ||
| - name: Download the artifact | ||
| uses: actions/download-artifact@v4.1.8 | ||
| with: | ||
| name: messagingservice | ||
| path: /tmp/messagingservice # Download to a temporary directory | ||
|
|
||
| - name: Remove existing service (if applicable) | ||
| name: callbackhandler | ||
|
|
||
| - name: Remove existing Windows service | ||
| run: | | ||
| SERVICE_NAME="messagingservice" | ||
| if systemctl is-active --quiet "$SERVICE_NAME"; then | ||
| echo "Stopping existing service..." | ||
| sudo systemctl stop "$SERVICE_NAME" | ||
| fi | ||
| if systemctl is-enabled --quiet "$SERVICE_NAME"; then | ||
| echo "Disabling existing service..." | ||
| sudo systemctl disable "$SERVICE_NAME" | ||
| fi | ||
| if [ -f "/etc/systemd/system/${SERVICE_NAME}.service" ]; then | ||
| echo "Removing existing service unit file..." | ||
| sudo rm "/etc/systemd/system/${SERVICE_NAME}.service" | ||
| sudo systemctl daemon-reload | ||
| fi | ||
|
|
||
| $serviceName = "Transaction Processing - Messaging Service" | ||
| # Check if the service exists | ||
| if (Get-Service -Name $serviceName -ErrorAction SilentlyContinue) { | ||
| Stop-Service -Name $serviceName | ||
| sc.exe delete $serviceName | ||
| } | ||
|
|
||
| - name: Unzip the files | ||
| run: | | ||
| sudo mkdir -p /opt/txnproc/transactionprocessing/messagingservice | ||
| sudo unzip -o /tmp/messagingservice/messagingservice.zip -d /opt/txnproc/transactionprocessing/messagingservice | ||
|
|
||
| # IMPORTANT: Add a step to ensure the .NET runtime is installed on the server | ||
| # This assumes it's not already there. If your base image already has it, you can skip this. | ||
| - name: Install .NET Runtime | ||
| run: | | ||
| # Example for Ubuntu. Adjust based on your .NET version (e.g., 8.0, 7.0) | ||
| # and if you need the SDK or just the runtime. | ||
| # This uses Microsoft's package repository for the latest versions. | ||
| wget https://packages.microsoft.com/config/ubuntu/$(lsb_release -rs)/packages-microsoft-prod.deb -O packages-microsoft-prod.deb | ||
| sudo dpkg -i packages-microsoft-prod.deb | ||
| rm packages-microsoft-prod.deb | ||
| sudo apt update | ||
| sudo apt install -y aspnetcore-runtime-9.0 | ||
|
|
||
| - name: Install and Start as a Linux service | ||
| Expand-Archive -Path messagingservice.zip -DestinationPath "C:\txnproc\transactionprocessing\messagingservice" -Force | ||
|
|
||
| - name: Install as a Windows service | ||
| run: | | ||
| SERVICE_NAME="messagingservice" | ||
| # The WorkingDirectory is crucial for .NET apps to find appsettings.json and other files | ||
| WORKING_DIRECTORY="/opt/txnproc/transactionprocessing/messagingservice" | ||
| DLL_NAME="MessagingService.dll" # Your application's DLL | ||
| SERVICE_DESCRIPTION="Transaction Processing - Messaging Service" | ||
|
|
||
| # Create a systemd service file | ||
| echo "[Unit]" | sudo tee /etc/systemd/system/${SERVICE_NAME}.service | ||
| echo "Description=${SERVICE_DESCRIPTION}" | sudo tee -a /etc/systemd/system/${SERVICE_NAME}.service | ||
| echo "After=network.target" | sudo tee -a /etc/systemd/system/${SERVICE_NAME}.service | ||
| echo "" | sudo tee -a /etc/systemd/system/${SERVICE_NAME}.service | ||
| echo "[Service]" | sudo tee -a /etc/systemd/system/${SERVICE_NAME}.service | ||
| # IMPORTANT: Use 'dotnet' to run your DLL | ||
| echo "ExecStart=/usr/bin/dotnet ${WORKING_DIRECTORY}/${DLL_NAME}" | sudo tee -a /etc/systemd/system/${SERVICE_NAME}.service | ||
| echo "WorkingDirectory=${WORKING_DIRECTORY}" | sudo tee -a /etc/systemd/system/${SERVICE_NAME}.service | ||
| echo "Restart=always" | sudo tee -a /etc/systemd/system/${SERVICE_NAME}.service | ||
| echo "User=youruser" # IMPORTANT: Change to a dedicated, less privileged user | ||
| echo "Group=yourgroup" # IMPORTANT: Change to a dedicated, less privileged group | ||
| echo "Environment=ASPNETCORE_ENVIRONMENT=Production" | sudo tee -a /etc/systemd/system/${SERVICE_NAME}.service # Example | ||
| echo "" | sudo tee -a /etc/systemd/system/${SERVICE_NAME}.service | ||
| echo "[Install]" | sudo tee -a /etc/systemd/system/${SERVICE_NAME}.service | ||
| echo "WantedBy=multi-user.target" | sudo tee -a /etc/systemd/system/${SERVICE_NAME}.service | ||
|
|
||
| # Reload systemd, enable, and start the service | ||
| sudo systemctl daemon-reload | ||
| sudo systemctl enable "$SERVICE_NAME" | ||
| sudo systemctl start "$SERVICE_NAME" | ||
| sudo systemctl status "$SERVICE_NAME" --no-pager # For debugging/verification | ||
| $serviceName = "Transaction Processing - Messaging Service" | ||
| $servicePath = "C:\txnproc\transactionprocessing\messagingservice\MessagingService.exe" | ||
|
|
||
| New-Service -Name $serviceName -BinaryPathName $servicePath -Description $serviceName -DisplayName $serviceName -StartupType Automatic | ||
| Start-Service -Name $serviceName |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 7 months ago
To fix the issue, add a permissions key near the top of the workflow YAML (either at the root level, to apply to all jobs, or within individual jobs as appropriate). The best way is to set it at the root so all jobs inherit the minimum required permissions. Review the actions: downloading/uploading artifacts (actions/upload-artifact, actions/download-artifact) and pushing NuGet packages which do not typically require more than contents: read (sometimes contents: write if you publish releases, which isn't shown in the snippets). As a minimal starting point, set:
permissions:
contents: readYou may further adjust with additional granular permissions if, in future, jobs need to interact with issues, pull requests, or other APIs. Add this block immediately after the name: line, before the on: line.
Suggested changeset
1
.github/workflows/createrelease.yml
| @@ -1,4 +1,6 @@ | ||
| name: Release | ||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| release: |
Copilot is powered by AI and may make mistakes. Always verify output.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
closes #351