env mode deferred #124
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dev Build | |
| on: | |
| push: | |
| branches: | |
| - 'dev_*' | |
| paths-ignore: | |
| - '.github/**' | |
| - 'README.md' | |
| - 'LICENSE' | |
| workflow_dispatch: | |
| concurrency: | |
| group: dev-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| actions: read | |
| security-events: write | |
| jobs: | |
| build-dev: | |
| name: Build & Push dev_latest | |
| runs-on: ubuntu-latest | |
| env: | |
| DOCKER_USER: ${{ secrets.DOCKER_USER }} | |
| DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }} | |
| steps: | |
| - name: Log workflow context | |
| run: | | |
| set -euo pipefail | |
| echo "::notice::INFO: workflow=dev repo=${GITHUB_REPOSITORY} ref=${GITHUB_REF_NAME} actor=${GITHUB_ACTOR}" | |
| - name: Validate Docker secrets | |
| run: | | |
| set -euo pipefail | |
| if [ -z "${DOCKER_USER:-}" ]; then | |
| echo "::error::FATAL: DOCKER_USER secret is missing." | |
| exit 1 | |
| fi | |
| if [ -z "${DOCKER_TOKEN:-}" ]; then | |
| echo "::error::FATAL: DOCKER_TOKEN secret is missing." | |
| exit 1 | |
| fi | |
| echo "::notice::SUCCESS: Docker secrets are present." | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Docker Hub login | |
| uses: docker/login-action@v3 | |
| with: | |
| username: ${{ env.DOCKER_USER }} | |
| password: ${{ env.DOCKER_TOKEN }} | |
| - name: Derive branch slug | |
| id: vars | |
| run: | | |
| set -euo pipefail | |
| slug=${GITHUB_REF_NAME//\//-} | |
| echo "branch_slug=$slug" >> "$GITHUB_OUTPUT" | |
| echo "::notice::INFO: branch_slug=$slug" | |
| - name: Prepare build context | |
| run: | | |
| set -euo pipefail | |
| echo "::notice::INFO: Preparing Docker build context." | |
| rm -rf ./image_context | |
| mkdir -p ./image_context | |
| cp -a Dockerfile ./image_context/Dockerfile | |
| cp -a server_manager ./image_context/ | |
| echo "::notice::SUCCESS: Build context prepared." | |
| - name: Build and load dev image (scan first) | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: ./image_context | |
| file: ./image_context/Dockerfile | |
| platforms: linux/amd64 | |
| push: false | |
| load: true | |
| provenance: false | |
| sbom: false | |
| tags: | | |
| ${{ env.DOCKER_USER }}/enshrouded_server_docker:dev_latest | |
| ${{ env.DOCKER_USER }}/enshrouded_server_docker:${{ steps.vars.outputs.branch_slug }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Docker Scout run (CRITICAL/HIGH, non-blocking) | |
| uses: docker/scout-action@v1 | |
| with: | |
| command: quickview,cves | |
| image: ${{ env.DOCKER_USER }}/enshrouded_server_docker:dev_latest | |
| write-comment: false | |
| summary: true | |
| only-severities: critical,high | |
| exit-code: false | |
| - name: Docker Scout SARIF (all severities) | |
| uses: docker/scout-action@v1 | |
| with: | |
| command: quickview,cves | |
| image: ${{ env.DOCKER_USER }}/enshrouded_server_docker:dev_latest | |
| sarif-file: scout.sarif | |
| write-comment: false | |
| summary: true | |
| only-severities: critical,high,medium | |
| - name: Trim Scout SARIF (limit locations) | |
| run: | | |
| jq ' | |
| .runs[0].results |= map( | |
| if (.locations | length) > 1000 | |
| then .locations = (.locations[:1000]) | . | |
| else . | |
| end | |
| ) | |
| ' scout.sarif > scout.limited.sarif | |
| - name: Upload Scout SARIF | |
| uses: github/codeql-action/upload-sarif@v4 | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false | |
| with: | |
| sarif_file: scout.limited.sarif | |
| category: docker-scout | |
| - name: Trivy scan (non-blocking) | |
| uses: aquasecurity/trivy-action@0.33.1 | |
| with: | |
| image-ref: ${{ env.DOCKER_USER }}/enshrouded_server_docker:dev_latest | |
| format: table | |
| ignore-unfixed: true | |
| vuln-type: 'os,library' | |
| severity: 'CRITICAL,HIGH' | |
| exit-code: 0 | |
| - name: Trivy SARIF (all severities) | |
| uses: aquasecurity/trivy-action@0.33.1 | |
| with: | |
| image-ref: ${{ env.DOCKER_USER }}/enshrouded_server_docker:dev_latest | |
| format: sarif | |
| output: trivy.sarif | |
| ignore-unfixed: true | |
| vuln-type: 'os,library' | |
| severity: 'CRITICAL,HIGH,MEDIUM' | |
| exit-code: 0 | |
| - name: Trim Trivy SARIF (limit locations) | |
| run: | | |
| jq ' | |
| .runs[0].results |= map( | |
| if (.locations | length) > 1000 | |
| then .locations = (.locations[:1000]) | . | |
| else . | |
| end | |
| ) | |
| ' trivy.sarif > trivy.limited.sarif | |
| - name: Upload Trivy SARIF | |
| uses: github/codeql-action/upload-sarif@v4 | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false | |
| with: | |
| sarif_file: trivy.limited.sarif | |
| category: trivy | |
| - name: Push dev tags (after successful scans) | |
| run: | | |
| set -euo pipefail | |
| echo "::notice::INFO: Pushing dev tags to Docker Hub." | |
| docker push ${{ env.DOCKER_USER }}/enshrouded_server_docker:dev_latest | |
| docker push ${{ env.DOCKER_USER }}/enshrouded_server_docker:${{ steps.vars.outputs.branch_slug }} | |
| echo "::notice::SUCCESS: Push complete." |