Merge log-injection fix from feat/external-buyer-tool-compat (#806) i… #72
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Publish Public Storefront | |
| on: | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - 'v*' | |
| paths: | |
| - 'web/public-storefront/**' | |
| - 'Dockerfile.public-storefront' | |
| - '.github/workflows/docker-publish-storefront.yml' | |
| workflow_dispatch: | |
| concurrency: | |
| group: storefront-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| REGISTRY: ghcr.io | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract image metadata | |
| id: meta | |
| uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0 | |
| with: | |
| images: ${{ env.REGISTRY }}/obolnetwork/obol-stack-public-storefront | |
| tags: | | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| # Long SHA: needed by the security-scan step which references | |
| # ${{ github.sha }} (40-char). Without it Trivy fails with | |
| # MANIFEST_UNKNOWN. Same bug the x402 workflow used to have. | |
| type=sha,format=long,prefix= | |
| # Short SHA: matches the obol binary's version.GitCommit (set via | |
| # ldflags from `git rev-parse --short HEAD`). internal/images.Resolve | |
| # uses it to commit-pin the storefront deployment so binary upgrades | |
| # actually roll the pod. | |
| type=sha,format=short,prefix= | |
| type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }} | |
| labels: | | |
| org.opencontainers.image.title=obol-stack-public-storefront | |
| org.opencontainers.image.description=Public tunnel storefront for Obol Stack | |
| org.opencontainers.image.vendor=Obol | |
| org.opencontainers.image.source=https://github.com/ObolNetwork/obol-stack | |
| - name: Build and push | |
| uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 | |
| with: | |
| context: . | |
| file: Dockerfile.public-storefront | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha,scope=storefront | |
| cache-to: type=gha,scope=storefront,mode=max | |
| provenance: true | |
| sbom: true | |
| security-scan: | |
| needs: build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| steps: | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: ${{ env.REGISTRY }}/obolnetwork/obol-stack-public-storefront:${{ github.sha }} | |
| format: 'sarif' | |
| output: 'trivy-results.sarif' | |
| severity: 'CRITICAL,HIGH' | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0 | |
| with: | |
| sarif_file: 'trivy-results.sarif' | |
| if: always() |