GitHub Action to deploy Serverless Container to Yandex Cloud

Create a serverless container with the provided name if there is no one. Then deploy a new revision using the provided image name and tag.

Table of Contents

• Usage
• Permissions
• License Summary

Usage

yaml
1    - uses: actions/checkout@v4
2    
3    - name: Get Yandex Cloud IAM token
4      id: get-iam-token
5      uses: docker://ghcr.io/yc-actions/yc-iam-token-fed:1.0.0
6      with:
7        yc-sa-id: aje***
8
9    - name: Login to Docker Hub
10      uses: docker/login-action@v3
11      with:
12        registry: cr.yandex
13        username: iam
14        password: ${{ steps.get-iam-token.outputs.token }}
15
16    - name: Build, tag, and push image to Yandex Cloud Container Registry
17      env:
18        CR_REGISTRY: crp00000000000000000
19        CR_REPOSITORY: my-cr-repo
20        IMAGE_TAG: ${{ github.sha }}
21      run: |
22        docker build -t cr.yandex/$CR_REGISTRY/$CR_REPOSITORY:$IMAGE_TAG .
23        docker push cr.yandex/$CR_REGISTRY/$CR_REPOSITORY:$IMAGE_TAG
24
25    - name: Deploy Serverless Container
26      id: deploy-sls-container
27      uses: yc-actions/yc-sls-container-deploy@v3
28      with:
29        yc-sa-id: aje***
30        container-name: yc-action-demo
31        folder-id: bbajn5q2d74c********
32        revision-service-account-id: ajeqnasj95o7********
33        revision-cores: 1
34        revision-memory: 512Mb
35        revision-core-fraction: 100
36        revision-concurrency: 8
37        revision-image-url: cr.yandex/crp00000000000000000/my-cr-repo:${{ github.sha }}
38        revision-execution-timeout: 10

One of yc-sa-json-credentials, yc-iam-token or yc-sa-id should be provided depending on the authentication method you want to use. The action will use the first one it finds.

• yc-sa-json-credentials should contain JSON with authorized key for Service Account. More info in Yandex Cloud IAM documentation.
• yc-iam-token should contain IAM token. It can be obtained using yc iam create-token command or using yc-actions/yc-iam-token-fed

yaml
1      - name: Get Yandex Cloud IAM token
2        id: get-iam-token
3        uses: docker://ghcr.io/yc-actions/yc-iam-token-fed:1.0.0
4        with:
5          yc-sa-id: aje***

• yc-sa-id should contain Service Account ID. It can be obtained using yc iam service-accounts list command. It is used to exchange GitHub token for IAM token using Workload Identity Federation. More info in Yandex Cloud IAM documentation.

See action.yml for the full documentation for this action's inputs and outputs.

Permissions

Deploy time permissions

To perform this action, the service account on behalf of which we are acting must have the serverless-containers.editor role or higher.

Additionally, you may need to grant the following optional roles depending on your specific needs:

Runtime permissions

The service account provided to container via revision-service-account-id parameter must have the following roles:

License Summary

This code is made available under the MIT license.