Skip to content

Commit d71f2f2

Browse files
thomas-samohtthomas-samoht
authored
Add pipeline image scanning (#217)
* Add image scanning * Add image scanning to release-docker file as well
1 parent be9087c commit d71f2f2

2 files changed

Lines changed: 155 additions & 56 deletions

File tree

‎.github/workflows/ci.yaml‎

Lines changed: 109 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -171,57 +171,112 @@ jobs:
171171
sonar-token: ${{ secrets.SONAR_TOKEN }}
172172

173173
detect_modified_files:
174-
name: Modified files
175-
runs-on: ubuntu-24.04
176-
outputs:
177-
dockerfile_changed: ${{ steps.changed-files.outputs.any_changed }}
178-
all_modified_files: ${{ steps.changed-files.outputs.all_modified_files }}
179-
steps:
180-
- name: Checkout repository
181-
uses: actions/checkout@v6
182-
- name: Get changed files
183-
id: changed-files
184-
uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1
185-
with:
186-
files: |
187-
docker/Dockerfile
188-
189-
push_container:
190-
if: |
191-
github.ref == 'refs/heads/main' ||
192-
startsWith(github.ref, 'refs/tags/v') ||
193-
needs.detect_modified_files.outputs.dockerfile_changed == 'true'
194-
name: Create and publish Docker image to the Github Package Registry
195-
runs-on: ubuntu-24.04
196-
needs: [build, lint, type-check, safety-check, spelling-check, test, detect_modified_files]
197-
steps:
198-
- name: Checkout repository
199-
uses: actions/checkout@v6
200-
201-
- name: Log in to the Container registry
202-
uses: docker/login-action@v3
203-
with:
204-
registry: ghcr.io
205-
username: ${{ github.actor }}
206-
password: ${{ secrets.GITHUB_TOKEN }}
207-
208-
- name: Extract metadata (tags, labels) for Docker
209-
id: meta
210-
uses: docker/metadata-action@v5
211-
with:
212-
images: ghcr.io/${{ github.repository }}
213-
214-
- name: Build and push Docker image
215-
uses: docker/build-push-action@v6
216-
env:
217-
NEW_UID: 1003
218-
NEW_GID: 1003
219-
with:
220-
context: .
221-
file: docker/Dockerfile
222-
push: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v') }}
223-
tags: ${{ steps.meta.outputs.tags }}
224-
labels: ${{ steps.meta.outputs.labels }}
225-
build-args: |
226-
NEW_UID=${{ env.NEW_UID }}
227-
NEW_GID=${{ env.NEW_GID }}
174+
name: Modified files
175+
runs-on: ubuntu-24.04
176+
outputs:
177+
image_files_changed: ${{ steps.image-files-changed.outputs.any_changed }}
178+
steps:
179+
- name: Checkout repository
180+
uses: actions/checkout@v6
181+
- name: Check image-related file changes
182+
id: image-files-changed
183+
uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1
184+
with:
185+
files: |
186+
docker/Dockerfile
187+
pyproject.toml
188+
poetry.lock
189+
.github/workflows/ci.yaml
190+
191+
image_build_scan_push:
192+
name: Build, scan, and push Docker image
193+
runs-on: ubuntu-24.04
194+
needs: [build, lint, type-check, safety-check, spelling-check, test, detect_modified_files]
195+
# Only run this job on main branch, version tags, or if image-related files have changed
196+
if: |
197+
github.ref == 'refs/heads/main' ||
198+
startsWith(github.ref, 'refs/tags/v') ||
199+
needs.detect_modified_files.outputs.image_files_changed == 'true'
200+
steps:
201+
- name: Checkout repository
202+
uses: actions/checkout@v6
203+
204+
- name: Log in to the Container registry
205+
uses: docker/login-action@v3
206+
with:
207+
registry: ghcr.io
208+
username: ${{ github.actor }}
209+
password: ${{ secrets.GITHUB_TOKEN }}
210+
211+
- name: Create version.json
212+
run: |
213+
RELEASE_VERSION="${GITHUB_REF#refs/*/}"
214+
echo "RELEASE_VERSION=$RELEASE_VERSION" >> $GITHUB_ENV
215+
echo "{ \"version\": \"${RELEASE_VERSION}\", \"git_ref\": \"$GITHUB_SHA\"}" > version.json
216+
217+
- name: Extract metadata (tags, labels) for Docker
218+
id: meta
219+
uses: docker/metadata-action@v5
220+
with:
221+
images: ghcr.io/${{ github.repository }}
222+
223+
- name: Build Docker image
224+
uses: docker/build-push-action@v6
225+
env:
226+
NEW_UID: 1000
227+
NEW_GID: 1000
228+
with:
229+
context: .
230+
file: docker/Dockerfile
231+
push: false
232+
load: true
233+
tags: ${{ steps.meta.outputs.tags }}
234+
labels: ${{ steps.meta.outputs.labels }}
235+
build-args: |
236+
NEW_UID=${{ env.NEW_UID }}
237+
NEW_GID=${{ env.NEW_GID }}
238+
standalone=true
239+
240+
- name: Run Trivy vulnerability scanner
241+
uses: aquasecurity/trivy-action@0.33.1
242+
with:
243+
image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
244+
format: "sarif"
245+
output: "trivy-results.sarif"
246+
exit-code: "0"
247+
severity: "CRITICAL,HIGH"
248+
vuln-type: "library"
249+
250+
- name: Upload Trivy scan results to GitHub Security tab
251+
uses: github/codeql-action/upload-sarif@v4
252+
# Only upload SARIF results on main branch or version tags
253+
if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
254+
with:
255+
sarif_file: "trivy-results.sarif"
256+
257+
- name: Fail build on vulnerabilities
258+
uses: aquasecurity/trivy-action@0.33.1
259+
with:
260+
image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
261+
format: "table"
262+
exit-code: "1"
263+
severity: "CRITICAL,HIGH"
264+
vuln-type: "library"
265+
skip-setup-trivy: true
266+
267+
- name: Push Docker image
268+
uses: docker/build-push-action@v6
269+
if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
270+
env:
271+
NEW_UID: 1000
272+
NEW_GID: 1000
273+
with:
274+
context: .
275+
file: docker/Dockerfile
276+
push: true
277+
tags: ${{ steps.meta.outputs.tags }}
278+
labels: ${{ steps.meta.outputs.labels }}
279+
build-args: |
280+
NEW_UID=${{ env.NEW_UID }}
281+
NEW_GID=${{ env.NEW_GID }}
282+
standalone=true

‎.github/workflows/release-docker.yaml‎

Lines changed: 46 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,15 +51,59 @@ jobs:
5151
with:
5252
images: ghcr.io/${{ github.repository }}
5353

54-
- name: Build and push Docker image
54+
- name: Build Docker image
5555
uses: docker/build-push-action@v6
5656
env:
5757
NEW_UID: 1003
5858
NEW_GID: 1003
5959
with:
6060
context: .
6161
file: docker/Dockerfile
62-
push: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v') }}
62+
push: false
63+
load: true
64+
tags: ${{ steps.meta.outputs.tags }}
65+
labels: ${{ steps.meta.outputs.labels }}
66+
build-args: |
67+
NEW_UID=${{ env.NEW_UID }}
68+
NEW_GID=${{ env.NEW_GID }}
69+
70+
- name: Run Trivy vulnerability scanner
71+
uses: aquasecurity/trivy-action@0.33.1
72+
with:
73+
image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
74+
format: "sarif"
75+
output: "trivy-results.sarif"
76+
exit-code: "0"
77+
severity: "CRITICAL,HIGH"
78+
vuln-type: "library"
79+
80+
- name: Upload Trivy scan results to GitHub Security tab
81+
uses: github/codeql-action/upload-sarif@v4
82+
# Only upload SARIF results on main branch or version tags
83+
if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
84+
with:
85+
sarif_file: "trivy-results.sarif"
86+
87+
- name: Fail on vulnerabilities
88+
uses: aquasecurity/trivy-action@0.33.1
89+
with:
90+
image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
91+
format: "table"
92+
exit-code: "1"
93+
severity: "CRITICAL,HIGH"
94+
vuln-type: "library"
95+
skip-setup-trivy: true
96+
97+
- name: Push Docker image
98+
uses: docker/build-push-action@v6
99+
if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
100+
env:
101+
NEW_UID: 1003
102+
NEW_GID: 1003
103+
with:
104+
context: .
105+
file: docker/Dockerfile
106+
push: true
63107
tags: ${{ steps.meta.outputs.tags }}
64108
labels: ${{ steps.meta.outputs.labels }}
65109
build-args: |

0 commit comments

Comments
 (0)