forked from docker/scout-demo-service
-
Notifications
You must be signed in to change notification settings - Fork 4
101 lines (88 loc) · 2.95 KB
/
docker-build.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
name: docker-build
on:
push:
branches: ["main"]
tags: ["v*.*.*"]
pull_request_target:
branches: ["main"]
env:
IMAGE_NAME: docker/scout-demo-service
SHA: ${{ github.event.pull_request.head.sha || github.event.after }}
DOCKERFILE_PATH: Dockerfile
jobs:
build:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v3
with:
ref: ${{ env.SHA }}
- name: Setup Docker buildx
uses: docker/[email protected]
- name: Log into registry
uses: docker/[email protected]
with:
username: christiandupuis299
password: ${{ secrets.CDUPUIS_PAT }}
- name: Extract Docker metadata
id: meta
uses: docker/[email protected]
with:
images: ${{ env.IMAGE_NAME }}
labels: |
org.opencontainers.image.revision=${{ env.SHA }}
com.docker.image.source.entrypoint=${{ env.DOCKERFILE_PATH }}
- name: Build and push Docker image on push
id: build-and-push
if: ${{ github.event_name != 'pull_request_target' }}
uses: docker/[email protected]
with:
context: .
load: false
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
platforms: "linux/amd64,linux/arm64"
sbom: false
provenance: false
- name: Build and push Docker image on PR
id: build-and-push-pr
if: ${{ github.event_name == 'pull_request_target' }}
uses: docker/[email protected]
with:
context: .
load: true
push: false
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
platforms: "linux/arm64"
sbom: false
provenance: false
- name: Analyze for critical and high CVEs
id: docker-scout-cves
if: ${{ github.event_name != 'pull_request_target' }}
uses: docker/scout-action@788bd7991dd23939af62db37c4b77ec009021e17
with:
command: cves
image: ${{ steps.meta.outputs.tags }}
sarif-file: sarif.output.json
platform: "linux/arm64"
summary: true
- name: Upload SARIF result
id: upload-sarif
if: ${{ github.event_name != 'pull_request_target' }}
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: sarif.output.json
- name: Compare to deployed image
id: docker-scout-compare
if: ${{ github.event_name == 'pull_request_target' }}
uses: docker/scout-action@788bd7991dd23939af62db37c4b77ec009021e17
with:
command: compare
image: ${{ steps.meta.outputs.tags }}
only-severities: critical,high
to-stream: prod
platform: "linux/arm64"
exit-code: true
summary: true