Merge pull request #2 from avnes/snyk-fix-a5047595639bf482c3a3d916b83… #8
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker | |
| on: | |
| push: | |
| branches: | |
| - main | |
| paths-ignore: | |
| - '.github/**' | |
| release: | |
| types: [published] | |
| pull_request: | |
| branches: | |
| - main | |
| paths-ignore: | |
| - '.github/**' | |
| workflow_dispatch: | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Dynamically find the image name | |
| id: get-image-name | |
| run: | | |
| image_name=$(echo $GITHUB_REPOSITORY | cut -d '/' -f2 | sed -r 's/docker-//') | |
| echo "::set-output name=image_name::$image_name" | |
| - name: Checkout source code | |
| uses: actions/checkout@v2 | |
| - name: Run tests | |
| run: | | |
| if [ -f docker-compose.test.yml ]; then | |
| docker-compose --file docker-compose.test.yml build | |
| docker-compose --file docker-compose.test.yml run sut | |
| else | |
| docker build . --file Dockerfile --tag ${{ steps.get-image-name.outputs.image_name }} | |
| fi | |
| - name: Run the Anchore scan action itself with GitHub Advanced Security code scanning integration enabled | |
| uses: anchore/scan-action@v3 | |
| id: scan | |
| with: | |
| image: "${{ steps.get-image-name.outputs.image_name }}" | |
| acs-report-enable: true | |
| fail-build: false | |
| severity-cutoff: high | |
| - name: Upload Anchore Scan Report | |
| uses: github/codeql-action/upload-sarif@v1 | |
| with: | |
| sarif_file: ${{ steps.scan.outputs.sarif }} | |
| push: | |
| needs: test | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'push' || github.event_name == 'release' | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Dynamically find the image name | |
| id: get-image-name | |
| run: | | |
| image_name=$(echo $GITHUB_REPOSITORY | cut -d '/' -f2 | sed -r 's/docker-//') | |
| echo "::set-output name=image_name::$image_name" | |
| - name: Checkout source code | |
| uses: actions/checkout@v2 | |
| - name: Build image | |
| run: docker build . --file Dockerfile --tag ${{ steps.get-image-name.outputs.image_name }} | |
| - name: Log into registry | |
| run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin | |
| - name: Push image | |
| run: | | |
| IMAGE_ID=ghcr.io/${{ github.repository_owner }}/${{ steps.get-image-name.outputs.image_name }} | |
| # Change all uppercase to lowercase | |
| IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]') | |
| # Strip git ref prefix from version | |
| VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,') | |
| # Strip "v" prefix from tag name | |
| [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//') | |
| # Use Docker `latest` tag convention | |
| [ "$VERSION" == "main" ] && VERSION=latest | |
| echo IMAGE_ID=$IMAGE_ID | |
| echo VERSION=$VERSION | |
| docker tag ${{ steps.get-image-name.outputs.image_name }} $IMAGE_ID:$VERSION | |
| docker push $IMAGE_ID:$VERSION |