Skip to content

Merge pull request #300 from cisagov/v24.03.0_merge_cisagov #64

Merge pull request #300 from cisagov/v24.03.0_merge_cisagov

Merge pull request #300 from cisagov/v24.03.0_merge_cisagov #64

name: arkime-build-and-push-ghcr
on:
push:
branches:
- main
- development
paths:
- 'arkime/**'
- 'Dockerfiles/arkime.Dockerfile'
- 'shared/bin/*'
- '!shared/bin/agg-init.sh'
- '!shared/bin/common-init.sh'
- '!shared/bin/sensor-init.sh'
- '!shared/bin/preseed_late_user_config.sh'
- '!shared/bin/configure-interfaces.py'
- '!shared/bin/configure-capture.py'
- '!shared/bin/zeek*'
- '.trigger_workflow_build'
workflow_dispatch:
repository_dispatch:
jobs:
docker:
runs-on: ubuntu-22.04
permissions:
actions: write
packages: write
contents: read
security-events: write
steps:
-
name: Cancel previous run in progress
uses: styfle/[email protected]
with:
ignore_sha: true
all_but_latest: true
access_token: ${{ secrets.GITHUB_TOKEN }}
-
name: Checkout
uses: actions/checkout@v4
-
name: Generate build timestamp
shell: bash
run: echo "btimestamp=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
id: generate_build_timestamp
-
name: Extract branch name
shell: bash
run: echo "branch=$(echo ${GITHUB_REF#refs/heads/})" >> $GITHUB_OUTPUT
id: extract_branch
-
name: Extract commit SHA
shell: bash
run: echo "sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
id: extract_commit_sha
-
name: Extract Malcolm version
shell: bash
run: echo "mversion=$(grep -P "^\s+image:.*/malcolm/" docker-compose-dev.yml | awk '{print $2}' | cut -d':' -f2 | uniq -c | sort -nr | awk '{print $2}' | head -n 1)" >> $GITHUB_OUTPUT
id: extract_malcolm_version
-
name: Set up QEMU
uses: docker/setup-qemu-action@v3
-
name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
with:
driver-opts: |
image=moby/buildkit:master
-
name: Log in to registry
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
password: ${{ secrets.GITHUB_TOKEN }}
-
name: Build and push
uses: docker/build-push-action@v5
with:
context: .
file: ./Dockerfiles/arkime.Dockerfile
build-args: |
MALCOLM_VERSION=${{ steps.extract_malcolm_version.outputs.mversion }}
BUILD_DATE=${{ steps.generate_build_timestamp.outputs.btimestamp }}
VCS_REVISION=${{ steps.extract_commit_sha.outputs.sha }}
MAXMIND_GEOIP_DB_LICENSE_KEY=${{ secrets.MAXMIND_GEOIP_DB_LICENSE_KEY }}
push: true
tags: ghcr.io/${{ github.repository_owner }}/malcolm/arkime:${{ steps.extract_branch.outputs.branch }}
-
name: Run Trivy vulnerability scanner
id: trivy-scan
uses: aquasecurity/trivy-action@master
with:
scan-type: 'image'
scanners: 'vuln'
image-ref: ghcr.io/${{ github.repository_owner }}/malcolm/arkime:${{ steps.extract_branch.outputs.branch }}
format: 'sarif'
output: 'trivy-results.sarif'
severity: 'HIGH,CRITICAL'
vuln-type: 'os,library'
hide-progress: true
ignore-unfixed: true
exit-code: '0'
-
name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v2
if: always()
with:
sarif_file: 'trivy-results.sarif'