-
Notifications
You must be signed in to change notification settings - Fork 0
100 lines (84 loc) · 2.58 KB
/
build.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
name: Build main or features
on:
push:
branches:
- master
tags:
- "v*"
workflow_dispatch:
jobs:
qa:
runs-on: ubuntu-20.04
steps:
- name: Checking out
uses: actions/checkout@v4
- name: Scaning code
uses: aquasecurity/trivy-action@0.12.0
with:
scan-type: "fs"
ignore-unfixed: true
format: "table"
template: "@/contrib/sarif.tpl"
severity: "MEDIUM,HIGH,CRITICAL"
- name: Detecting secrets
uses: reviewdog/action-detect-secrets@v0.12
with:
reporter: github-check
github_token: ${{ secrets.github_token }}
fail_on_error: true
detect_secrets_flags: --exclude-files .git
build-container:
needs:
- qa
runs-on: ubuntu-20.04
steps:
- name: Checking out
uses: actions/checkout@v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v2
- name: Build image
id: build-image
uses: docker/build-push-action@v4
with:
tags: ${{ github.repository }}:${{ github.sha }}
load: true
- name: Scaning image
uses: aquasecurity/trivy-action@0.12.0
with:
image-ref: ${{ github.repository }}:${{ github.sha }}
format: "table"
exit-code: "1"
ignore-unfixed: true
severity: "MEDIUM,HIGH,CRITICAL"
vuln-type: "os,library"
- name: Try running image
run: |
docker run --rm ${{ github.repository }}:${{ github.sha }}
push-tagged-image:
needs:
- build-container
if: startsWith(github.ref, 'refs/tags/v')
runs-on: ubuntu-20.04
steps:
- name: Checking out
uses: actions/checkout@v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v2
- name: Login to Dockerhub
uses: docker/login-action@v2
with:
username: ${{ secrets.DOCKERHUB_LOGIN }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Push
uses: docker/build-push-action@v4
with:
push: true
tags: |
${{ github.repository }}:${{ github.sha }}
${{ github.repository }}:${{ github.ref_name }}
labels: |
org.opencontainers.image.authors=@Koenighotze
org.opencontainers.image.name=${{ github.repository }}
org.opencontainers.image.title=Wordcloud-cli docker wrapper
org.opencontainers.image.source=${{ github.repositoryUrl }}
org.opencontainers.image.revision=${{ github.sha }}