feature(bump): Bumped Google Cloud SDK version #9
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: CI Bmeme GCP Image Builder container image | |
| on: | |
| push: | |
| branches: | |
| - "*" | |
| - "*/*" | |
| - "**" | |
| - "!main" | |
| env: | |
| registry: docker.io | |
| repository: bmeme/gcp-image-builder | |
| jobs: | |
| build: | |
| name: Build and test Bmeme GCP Image Builder container image using Docker | |
| runs-on: ubuntu-latest | |
| steps: | |
| - | |
| name: Check out the codebase. | |
| uses: actions/checkout@v3 | |
| - | |
| name: Login to Docker Hub | |
| uses: docker/login-action@v3 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - | |
| name: Lint Dockerfile | |
| id: lint | |
| uses: hadolint/[email protected] | |
| with: | |
| dockerfile: ./Dockerfile | |
| config: .hadolint.yaml | |
| - | |
| name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - | |
| name: Set up QEMU | |
| uses: docker/setup-qemu-action@v3 | |
| - | |
| name: Set tag | |
| id: vars | |
| run: echo "tag=$(cat ./Dockerfile | grep com.bmeme.project.version | awk -F\' '{print $2}')" >> $GITHUB_OUTPUT | |
| - | |
| name: Build image | |
| id: build | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: ./Dockerfile | |
| push: false | |
| platforms: "linux/arm64,linux/amd64" | |
| tags: | | |
| ${{ env.registry }}/${{ env.repository }}:${{ steps.vars.outputs.tag }} | |
| ${{ env.registry }}/${{ env.repository }}:latest | |
| - | |
| name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@master | |
| id: trivy | |
| with: | |
| image-ref: ${{ env.registry }}/${{ env.repository }}:latest | |
| format: 'sarif' | |
| exit-code: '0' | |
| ignore-unfixed: true | |
| vuln-type: 'os,library' | |
| severity: 'CRITICAL' | |
| output: 'trivy-results-gke-helm-deployer.sarif' | |
| - | |
| name: Upload Trivy scan results to GitHub Security tab | |
| id: trivy-upload | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: 'trivy-results-gke-helm-deployer.sarif' | |
| - | |
| name: Scan image | |
| id: scan | |
| uses: anchore/scan-action@v3 | |
| with: | |
| image: ${{ env.registry }}/${{ env.repository }}:latest | |
| severity-cutoff: critical | |
| fail-build: false | |
| - | |
| name: Upload Anchore scan SARIF report | |
| id: scan-upload | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: ${{ steps.scan.outputs.sarif }} |