chore(deps): bump debian from 98f4b71 to 74d56e3
#13
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI/CD | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ['v*.*.*'] | |
| pull_request: | |
| branches: [main] | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }} | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Hadolint | |
| uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0 | |
| with: | |
| dockerfile: Dockerfile | |
| - name: ShellCheck | |
| uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0 | |
| with: | |
| scandir: . | |
| - name: Install yamllint | |
| run: pip install --user yamllint | |
| - name: yamllint | |
| run: yamllint -d relaxed docker-compose.yml tests/docker-compose.test.yml .pre-commit-config.yaml | |
| test: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 | |
| - name: Build ocserv image | |
| uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 | |
| with: | |
| context: . | |
| load: true | |
| tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:test | |
| cache-from: type=gha,scope=test | |
| cache-to: type=gha,scope=test,mode=max | |
| - name: Run integration tests | |
| run: | | |
| chmod +x tests/run.sh | |
| tests/run.sh | |
| env: | |
| IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| TAG: test | |
| - name: Collect test logs | |
| if: failure() | |
| run: | | |
| mkdir -p /tmp/test-logs | |
| docker compose -f tests/docker-compose.test.yml logs ocserv > /tmp/test-logs/ocserv.log 2>&1 || true | |
| docker compose -f tests/docker-compose.test.yml logs test-runner > /tmp/test-logs/test-runner.log 2>&1 || true | |
| - name: Upload test logs | |
| if: failure() | |
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 | |
| with: | |
| name: test-logs | |
| path: /tmp/test-logs/ | |
| retention-days: 7 | |
| build: | |
| runs-on: ubuntu-latest | |
| needs: [lint, test] | |
| if: github.event_name == 'push' | |
| permissions: | |
| contents: read | |
| packages: write | |
| outputs: | |
| digest: ${{ steps.build-and-push.outputs.digest }} | |
| image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 | |
| - name: Log into registry | |
| uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract Docker metadata | |
| id: meta | |
| uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| flavor: | | |
| latest=auto | |
| tags: | | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=semver,pattern={{major}} | |
| type=ref,event=branch | |
| type=sha | |
| - name: Build and push | |
| id: build-and-push | |
| uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 | |
| with: | |
| context: . | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| sbom: true | |
| cache-from: type=gha,scope=build | |
| cache-to: type=gha,scope=build,mode=max | |
| scan: | |
| runs-on: ubuntu-latest | |
| needs: [build] | |
| permissions: | |
| contents: read | |
| packages: read | |
| security-events: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Check for critical/high vulnerabilities | |
| uses: aquasecurity/trivy-action@e368e328979b113139d6f9068e03accaed98a518 # 0.34.1 | |
| with: | |
| image-ref: ${{ needs.build.outputs.image }}@${{ needs.build.outputs.digest }} | |
| format: table | |
| severity: CRITICAL,HIGH | |
| exit-code: '1' | |
| trivyignores: .trivyignore | |
| - name: Generate SARIF report | |
| uses: aquasecurity/trivy-action@e368e328979b113139d6f9068e03accaed98a518 # 0.34.1 | |
| if: always() | |
| with: | |
| image-ref: ${{ needs.build.outputs.image }}@${{ needs.build.outputs.digest }} | |
| format: sarif | |
| output: trivy-results.sarif | |
| trivyignores: .trivyignore | |
| - name: Upload Trivy SARIF | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4 | |
| with: | |
| sarif_file: trivy-results.sarif | |
| sign: | |
| runs-on: ubuntu-latest | |
| needs: [build, scan] | |
| permissions: | |
| packages: write | |
| id-token: write | |
| steps: | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 | |
| - name: Log into registry | |
| uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Sign image | |
| env: | |
| DIGEST: ${{ needs.build.outputs.digest }} | |
| IMAGE: ${{ needs.build.outputs.image }} | |
| run: cosign sign --yes "${IMAGE}@${DIGEST}" | |
| release: | |
| runs-on: ubuntu-latest | |
| needs: [sign] | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Create GitHub Release | |
| uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0 | |
| with: | |
| generate_release_notes: true | |
| body: | | |
| ## Docker Image | |
| ``` | |
| docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }} | |
| ``` |