Skip to content
CI

fix: Dockerfile to reduce vulnerabilities #100

Sign in to view logs

fix: Dockerfile to reduce vulnerabilities

fix: Dockerfile to reduce vulnerabilities #100

Workflow file for this run

.github/workflows/ci.yml at 8d161e1
name: CI
on: [push]
jobs:
editorconfig-checker:
name: editorconfig-checker
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: editorconfig-checker/action-editorconfig-checker@main
- run: editorconfig-checker
flake8:
name: flake8
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v3
- name: Setup Python
uses: actions/setup-python@v1
with:
python-version: 3.10.13
architecture: x64
- name: Install flake8
run: pip install flake8
- name: Run flake8
uses: suo/flake8-github-action@releases/v1
with:
checkName: 'flake8'
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
markdown-lint:
name: markdown-lint
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- run: npx markdown-cli *.md
unittest:
name: unittest
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v3
- name: Setup Python
uses: actions/setup-python@v1
with:
python-version: 3.10.13
architecture: x64
- name: Execute Unit Tests
run: python3 -m unittest src/test_task_manager.py
sonar-cloud:
needs: [editorconfig-checker, markdown-lint, flake8, unittest]
name: sonar-cloud
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v3
- name: Setup Python
uses: actions/setup-python@v2
with:
python-version: ${{ matrix.python }}
- name: Install tox and any other packages
run: pip install tox
- name: Run tox
run: tox -e py
- name: SonarCloud Scan
uses: sonarsource/sonarcloud-github-action@master
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
organization: anailieva
project: anailieva_task-manager
snyk:
needs: [editorconfig-checker, markdown-lint, flake8, unittest]
name: snyk
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v3
- name: Snyk test
working-directory: ./src/
run: |
npm install -g snyk
pip install -r requirements.txt
snyk test
env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
gitleaks:
needs: [editorconfig-checker, markdown-lint, flake8, unittest]
name: gitleaks
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
with:
fetch-depth: 0
- uses: gitleaks/gitleaks-action@v2
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
sql:
needs: [sonar-cloud, snyk, gitleaks]
name: sql
runs-on: ubuntu-latest
services:
postgres:
image: postgres
env:
POSTGRES_DB: db
POSTGRES_USER: user
POSTGRES_PASSWORD: password
options: >-
--health-cmd pg_isready
--health-interval 10s
--health-timeout 5s
--health-retries 5
steps:
- uses: actions/checkout@v2
- uses: joshuaavalon/flyway-action@v3.0.0
with:
url: jdbc:postgresql://postgres:5432/db
user: user
password: password
docker-build:
needs: [sql]
name: docker-build
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v3
- name: Build docker image
uses: docker/build-push-action@v3
with:
push: false
tags: anailieva/python:latest
trivy:
needs: [sql]
name: trivy
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v3
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: 'anailieva/python:latest'
format: 'table'
exit-code: '1'
severity: 'CRITICAL'
docker-push:
needs: [trivy, docker-build]
name: docker-push
runs-on: ubuntu-latest
permissions:
packages: write
steps:
- name: Login to DockerHub
uses: docker/login-action@v2
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Push docker image
uses: docker/build-push-action@v3
with:
push: true
tags: anailieva/python:latest