Merge pull request #41 from gifi71/chore/trivyignore-cleanup #44
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI/CD | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ['v*.*.*-r*'] | |
| pull_request: | |
| branches: [main] | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }} | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Hadolint | |
| uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0 | |
| with: | |
| dockerfile: Dockerfile | |
| - name: ShellCheck | |
| uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0 | |
| with: | |
| scandir: . | |
| - name: Install yamllint | |
| run: pip install --user yamllint | |
| - name: yamllint | |
| run: yamllint -d relaxed docker-compose.yml tests/docker-compose.test.yml .pre-commit-config.yaml | |
| test: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 | |
| - name: Build ocserv image | |
| uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0 | |
| with: | |
| context: . | |
| load: true | |
| tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:test | |
| cache-from: type=gha,scope=test | |
| cache-to: type=gha,scope=test,mode=max | |
| - name: Run integration tests | |
| run: | | |
| chmod +x tests/run.sh | |
| tests/run.sh | |
| env: | |
| IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| TAG: test | |
| - name: Collect test logs | |
| if: failure() | |
| run: | | |
| mkdir -p /tmp/test-logs | |
| docker compose -f tests/docker-compose.test.yml logs ocserv > /tmp/test-logs/ocserv.log 2>&1 || true | |
| docker compose -f tests/docker-compose.test.yml logs test-runner > /tmp/test-logs/test-runner.log 2>&1 || true | |
| - name: Upload test logs | |
| if: failure() | |
| uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 | |
| with: | |
| name: test-logs | |
| path: /tmp/test-logs/ | |
| retention-days: 7 | |
| build: | |
| runs-on: ubuntu-latest | |
| needs: [lint, test] | |
| if: github.event_name == 'push' | |
| permissions: | |
| contents: read | |
| packages: write | |
| outputs: | |
| digest: ${{ steps.build-and-push.outputs.digest }} | |
| image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 | |
| - name: Log into registry | |
| uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract Docker metadata | |
| id: meta | |
| uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| flavor: | | |
| latest=auto | |
| tags: | | |
| type=match,pattern=v(.*),group=1 | |
| type=match,pattern=v(\d+\.\d+\.\d+),group=1 | |
| type=match,pattern=v(\d+\.\d+),group=1 | |
| type=match,pattern=v(\d+),group=1 | |
| type=ref,event=branch | |
| type=sha | |
| - name: Build and push | |
| id: build-and-push | |
| uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0 | |
| with: | |
| context: . | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| sbom: true | |
| cache-from: type=gha,scope=build | |
| cache-to: type=gha,scope=build,mode=max | |
| scan: | |
| runs-on: ubuntu-latest | |
| needs: [build] | |
| permissions: | |
| contents: read | |
| packages: read | |
| security-events: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Check for critical/high vulnerabilities | |
| uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0 | |
| with: | |
| image-ref: ${{ needs.build.outputs.image }}@${{ needs.build.outputs.digest }} | |
| format: table | |
| severity: CRITICAL,HIGH | |
| # Suppress CVEs with no upstream fix (Debian "will_not_fix"/"affected"/ | |
| # "fix_deferred"); only fixable-but-unpatched CVEs gate the build, plus | |
| # whatever is explicitly listed in .trivyignore. | |
| ignore-unfixed: true | |
| exit-code: '1' | |
| trivyignores: .trivyignore | |
| - name: Generate SARIF report | |
| uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0 | |
| if: always() | |
| with: | |
| image-ref: ${{ needs.build.outputs.image }}@${{ needs.build.outputs.digest }} | |
| format: sarif | |
| output: trivy-results.sarif | |
| trivyignores: .trivyignore | |
| - name: Upload Trivy SARIF | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 | |
| with: | |
| sarif_file: trivy-results.sarif | |
| sign: | |
| runs-on: ubuntu-latest | |
| needs: [build, scan] | |
| permissions: | |
| packages: write | |
| id-token: write | |
| steps: | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0 | |
| - name: Log into registry | |
| uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Sign image | |
| env: | |
| DIGEST: ${{ needs.build.outputs.digest }} | |
| IMAGE: ${{ needs.build.outputs.image }} | |
| run: cosign sign --yes "${IMAGE}@${DIGEST}" | |
| release: | |
| runs-on: ubuntu-latest | |
| needs: [sign] | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Create GitHub Release | |
| uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1 | |
| with: | |
| generate_release_notes: true | |
| body: | | |
| ## Docker Image | |
| ``` | |
| docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }} | |
| ``` |