|
| 1 | +# 🚀 PipeGuard Real Environment Setup Guide |
| 2 | + |
| 3 | +## Prerequisites Checklist |
| 4 | + |
| 5 | +Before setting up PipeGuard with real services, ensure you have: |
| 6 | + |
| 7 | +- [ ] GitHub account with a repository containing GitHub Actions |
| 8 | +- [ ] Google Cloud Platform account (free tier is sufficient) |
| 9 | +- [ ] Python 3.9+ installed |
| 10 | +- [ ] Git installed and configured |
| 11 | + |
| 12 | +## Step 1: GitHub Setup |
| 13 | + |
| 14 | +### 1.1 Create GitHub Personal Access Token |
| 15 | +1. Go to https://github.com/settings/tokens |
| 16 | +2. Click "Generate new token" → "Generate new token (classic)" |
| 17 | +3. Set expiration (90 days recommended for testing) |
| 18 | +4. Select these scopes: |
| 19 | + - [ ] `repo` (Full control of private repositories) |
| 20 | + - [ ] `workflow` (Update GitHub Action workflows) |
| 21 | + - [ ] `read:org` (Read org and team membership) |
| 22 | +5. Click "Generate token" and **copy it immediately** |
| 23 | + |
| 24 | +### 1.2 Update .env file |
| 25 | +```bash |
| 26 | +GITHUB_TOKEN=ghp_your_actual_token_here |
| 27 | +GITHUB_USER=your_github_username |
| 28 | +GITHUB_REPO=your_repository_name |
| 29 | +``` |
| 30 | + |
| 31 | +## Step 2: Google Cloud Platform Setup |
| 32 | + |
| 33 | +### 2.1 Create GCP Project |
| 34 | +1. Go to https://console.cloud.google.com/ |
| 35 | +2. Click "New Project" |
| 36 | +3. Name: `pipeguard-monitor` (or your preference) |
| 37 | +4. Note the Project ID |
| 38 | + |
| 39 | +### 2.2 Enable Required APIs |
| 40 | +```bash |
| 41 | +# Run these commands in Google Cloud Shell or with gcloud CLI |
| 42 | +gcloud services enable firestore.googleapis.com |
| 43 | +gcloud services enable cloudfunctions.googleapis.com |
| 44 | +gcloud services enable appengine.googleapis.com |
| 45 | +gcloud services enable cloudscheduler.googleapis.com |
| 46 | +``` |
| 47 | + |
| 48 | +### 2.3 Create Service Account |
| 49 | +1. Go to IAM & Admin → Service Accounts |
| 50 | +2. Click "Create Service Account" |
| 51 | +3. Name: `pipeguard-service` |
| 52 | +4. Grant these roles: |
| 53 | + - Cloud Datastore User |
| 54 | + - Cloud Functions Developer |
| 55 | + - App Engine Admin |
| 56 | +5. Create and download JSON key |
| 57 | +6. Save as `k:\Devops\PipeGuard-1\credentials\service-account-key.json` |
| 58 | + |
| 59 | +### 2.4 Initialize Firestore |
| 60 | +1. Go to Firestore in the Console |
| 61 | +2. Click "Create database" |
| 62 | +3. Choose "Production mode" |
| 63 | +4. Select a region (us-central1 recommended) |
| 64 | + |
| 65 | +### 2.5 Update .env file |
| 66 | +```bash |
| 67 | +GOOGLE_APPLICATION_CREDENTIALS=k:\Devops\PipeGuard-1\credentials\service-account-key.json |
| 68 | +GOOGLE_CLOUD_PROJECT=your-actual-project-id |
| 69 | +``` |
| 70 | + |
| 71 | +## Step 3: Secure the Environment |
| 72 | + |
| 73 | +### 3.1 Generate Secure Secret Key |
| 74 | +```bash |
| 75 | +cd k:\Devops\PipeGuard-1 |
| 76 | +python -c "import secrets; print('SECRET_KEY=' + secrets.token_urlsafe(32))" |
| 77 | +``` |
| 78 | +Copy the output to your `.env` file. |
| 79 | + |
| 80 | +### 3.2 Create Credentials Directory |
| 81 | +```bash |
| 82 | +mkdir credentials |
| 83 | +# Move your service account key here |
| 84 | +``` |
| 85 | + |
| 86 | +### 3.3 Update .gitignore |
| 87 | +Ensure these lines are in `.gitignore`: |
| 88 | +``` |
| 89 | +.env |
| 90 | +credentials/ |
| 91 | +*.json |
| 92 | +``` |
| 93 | + |
| 94 | +## Step 4: Test the Real Environment |
| 95 | + |
| 96 | +### 4.1 Install Dependencies |
| 97 | +```bash |
| 98 | +pip install -r requirements.txt |
| 99 | +``` |
| 100 | + |
| 101 | +### 4.2 Run Security Check |
| 102 | +```bash |
| 103 | +python security_check.py |
| 104 | +``` |
| 105 | + |
| 106 | +### 4.3 Test GitHub Connection |
| 107 | +```bash |
| 108 | +python -c " |
| 109 | +import os |
| 110 | +from dotenv import load_dotenv |
| 111 | +import requests |
| 112 | +
|
| 113 | +load_dotenv() |
| 114 | +token = os.getenv('GITHUB_TOKEN') |
| 115 | +user = os.getenv('GITHUB_USER') |
| 116 | +repo = os.getenv('GITHUB_REPO') |
| 117 | +
|
| 118 | +if not all([token, user, repo]): |
| 119 | + print('❌ Missing GitHub configuration') |
| 120 | + exit(1) |
| 121 | +
|
| 122 | +url = f'https://api.github.com/repos/{user}/{repo}/actions/runs' |
| 123 | +headers = {'Authorization': f'token {token}'} |
| 124 | +response = requests.get(url, headers=headers) |
| 125 | +
|
| 126 | +if response.status_code == 200: |
| 127 | + print('✅ GitHub API connection successful') |
| 128 | + print(f'Found {len(response.json().get(\"workflow_runs\", []))} workflow runs') |
| 129 | +else: |
| 130 | + print(f'❌ GitHub API error: {response.status_code}') |
| 131 | +" |
| 132 | +``` |
| 133 | + |
| 134 | +### 4.4 Test Google Cloud Connection |
| 135 | +```bash |
| 136 | +python -c " |
| 137 | +import os |
| 138 | +from dotenv import load_dotenv |
| 139 | +from google.cloud import firestore |
| 140 | +
|
| 141 | +load_dotenv() |
| 142 | +os.environ['GOOGLE_APPLICATION_CREDENTIALS'] = os.getenv('GOOGLE_APPLICATION_CREDENTIALS') |
| 143 | +
|
| 144 | +try: |
| 145 | + db = firestore.Client() |
| 146 | + collections = list(db.collections()) |
| 147 | + print('✅ Firestore connection successful') |
| 148 | + print(f'Found {len(collections)} collections') |
| 149 | +except Exception as e: |
| 150 | + print(f'❌ Firestore connection failed: {e}') |
| 151 | +" |
| 152 | +``` |
| 153 | + |
| 154 | +## Step 5: Run PipeGuard with Real Data |
| 155 | + |
| 156 | +### 5.1 Start the Application |
| 157 | +```bash |
| 158 | +python run_local.py |
| 159 | +``` |
| 160 | +Choose option 1 to start the Flask dashboard. |
| 161 | + |
| 162 | +### 5.2 Access the Dashboard |
| 163 | +Visit: http://localhost:8080 |
| 164 | + |
| 165 | +The dashboard will now display real data from your GitHub repository! |
| 166 | + |
| 167 | +## Step 6: Deploy to Production (Optional) |
| 168 | + |
| 169 | +### 6.1 Deploy to App Engine |
| 170 | +```bash |
| 171 | +gcloud app deploy app.yaml |
| 172 | +``` |
| 173 | + |
| 174 | +### 6.2 Deploy Cloud Function |
| 175 | +```bash |
| 176 | +gcloud functions deploy monitor_pipeline \ |
| 177 | + --runtime python39 \ |
| 178 | + --trigger-topic pipeline-monitor \ |
| 179 | + --entry-point main \ |
| 180 | + --source . |
| 181 | +``` |
| 182 | + |
| 183 | +### 6.3 Set up Cloud Scheduler |
| 184 | +```bash |
| 185 | +gcloud scheduler jobs create http pipeline-monitor-job \ |
| 186 | + --schedule="*/5 * * * *" \ |
| 187 | + --uri="https://your-project.cloudfunctions.net/monitor_pipeline" \ |
| 188 | + --http-method=GET |
| 189 | +``` |
| 190 | + |
| 191 | +## 🔧 Troubleshooting |
| 192 | + |
| 193 | +### Common Issues |
| 194 | + |
| 195 | +**GitHub API Rate Limiting** |
| 196 | +- Solution: Use authenticated requests (token required) |
| 197 | +- Rate limit: 5,000 requests/hour with token |
| 198 | + |
| 199 | +**Firestore Permission Denied** |
| 200 | +- Check service account has correct roles |
| 201 | +- Verify GOOGLE_APPLICATION_CREDENTIALS path |
| 202 | + |
| 203 | +**Port Already in Use** |
| 204 | +- Change FLASK_PORT in .env file |
| 205 | +- Or run: `python run_local.py` and choose different port |
| 206 | + |
| 207 | +### Security Best Practices |
| 208 | + |
| 209 | +✅ **Never commit .env files** |
| 210 | +✅ **Rotate GitHub tokens regularly** |
| 211 | +✅ **Use least-privilege IAM roles** |
| 212 | +✅ **Enable 2FA on all accounts** |
| 213 | +✅ **Monitor API usage** |
| 214 | + |
| 215 | +## 📞 Support |
| 216 | + |
| 217 | +If you encounter issues: |
| 218 | +1. Check `python security_check.py` output |
| 219 | +2. Review logs in `python run_local.py` |
| 220 | +3. Verify credentials are correctly set |
| 221 | +4. Test individual components with the test scripts above |
| 222 | + |
| 223 | +--- |
| 224 | + |
| 225 | +**🎯 You're now ready to monitor real GitHub Actions pipelines with PipeGuard!** |
0 commit comments