Skip to content

Bump @testing-library/user-event from 13.5.0 to 14.5.1 #37

Bump @testing-library/user-event from 13.5.0 to 14.5.1

Bump @testing-library/user-event from 13.5.0 to 14.5.1 #37

Workflow file for this run

---
# Workflow syntax for GitHub Actions: https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions
# Build Application and Upload Container Image to Docker Hub
name: Build and Scan Image
# Events: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows
on:
# Run workflow on push except for ignored branches and paths
push:
# Secrets aren't available for dependabot on push. https://docs.github.com/en/enterprise-cloud@latest/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/troubleshooting-the-codeql-workflow#error-403-resource-not-accessible-by-integration-when-using-dependabot
branches-ignore:
# - 'dependabot/**'
- 'cherry-pick-*'
paths-ignore:
- '**.md' # Ignore documentation changes
- '.github/**(!build.yml)' # Ignore other workflow changes
# Run workflow on pull request
pull_request: # By default, a workflow only runs when a pull_request event's activity type is opened, synchronize, or reopened
# Allow user to manually trigger Workflow execution
workflow_dispatch:
# Set Workflow-level permissions: https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
permissions:
contents: read
# Run a single job at a time: https://docs.github.com/en/actions/using-jobs/using-concurrency
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
unit-test:
# Run job when not triggered by a merge
if: (github.event_name == 'push' && contains(toJSON(github.event.head_commit.message), 'Merge pull request ') == false) || (github.event_name != 'push')
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4 # https://github.com/marketplace/actions/checkout
# Cache NPM dependencies
- name: Cache NPM dependencies
id: cache
uses: actions/cache@v3 # https://github.com/marketplace/actions/cache#using-a-combination-of-restore-and-save-actions
with:
path: |
node_modules
key: npm-${{ hashFiles('package-lock.json') }}
# Install NPM dependencies
- name: Install NPM dependencies
run: npm ci
- name: Run tests
run: npm run test
build:
needs: unit-test
runs-on: ubuntu-latest
environment: docker-hub # Use `docker-hub` repository environment
steps:
# Workaround for the absence of github.branch_name, use github-env-vars-action to define useful environment variables not available by default
- uses: FranzDiebold/github-env-vars-action@v2 # https://github.com/marketplace/actions/github-environment-variables-action
# Set Complete Container Image URL
- name: Set CONTAINER_IMAGE_URL
run: |
echo "CONTAINER_IMAGE_URL=${{ vars.DOCKER_REGISTRY_URL }}/${{ vars.DOCKER_REPOSITORY }}/${{ env.CI_REPOSITORY_NAME }}:${{ env.CI_ACTION_REF_NAME }}" >> $GITHUB_ENV
- name: Checkout repository
uses: actions/checkout@v4 # https://github.com/marketplace/actions/checkout
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3 # https://github.com/marketplace/actions/docker-setup-build
- name: Login to DockerHub
uses: docker/login-action@v3 # https://github.com/marketplace/actions/docker-login
with:
registry: ${{ vars.DOCKER_REGISTRY_URL }}
username: ${{ secrets.DOCKER_REGISTRY_USERNAME }}
password: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
- name: Docker Build and Push
uses: docker/build-push-action@v5 # https://github.com/marketplace/actions/build-and-push-docker-images
with:
context: .
file: Containerfile
push: true
tags: ${{ env.CONTAINER_IMAGE_URL }} # CONTAINER_IMAGE_URL is defined in GITHUB_ENV
cache-from: type=gha
cache-to: type=gha,mode=max
container-structure-test:
needs: build
runs-on: ubuntu-latest
environment: docker-hub # Use `docker-hub` repository environment
steps:
# Workaround for the absence of github.branch_name, use github-env-vars-action to define useful environment variables not available by default
- uses: FranzDiebold/github-env-vars-action@v2 # https://github.com/marketplace/actions/github-environment-variables-action
# Set Complete Container Image URL
- name: Set CONTAINER_IMAGE_URL
run: |
echo "CONTAINER_IMAGE_URL=${{ vars.DOCKER_REGISTRY_URL }}/${{ vars.DOCKER_REPOSITORY }}/${{ env.CI_REPOSITORY_NAME }}:${{ env.CI_ACTION_REF_NAME }}" >> $GITHUB_ENV
- name: Login to DockerHub
uses: docker/login-action@v3 # https://github.com/marketplace/actions/docker-login
with:
registry: ${{ vars.DOCKER_REGISTRY_URL }}
username: ${{ secrets.DOCKER_REGISTRY_USERNAME }}
password: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
- name: Pull Container Image
# CONTAINER_IMAGE_URL is defined in GITHUB_ENV
run: |
docker pull ${{ env.CONTAINER_IMAGE_URL }}
- name: Checkout repository
uses: actions/checkout@v4 # https://github.com/marketplace/actions/checkout
- name: Run Container Structure Test
uses: ./.github/actions/container-structure-test
with:
image: ${{ env.CONTAINER_IMAGE_URL }} # CONTAINER_IMAGE_URL is defined in GITHUB_ENV
configFile: ./container-structure-test.yaml
scan:
needs: build
runs-on: ubuntu-latest
# Set Job-level permissions: https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idpermissions
permissions:
security-events: write # Allow Job to upload scan results to GitHub
environment: docker-hub # Use `docker-hub` repository environment
env:
TRIVY_CACHE_DIR: /tmp/trivy/
steps:
# Workaround for the absence of github.branch_name, use github-env-vars-action to define useful environment variables not available by default
- uses: FranzDiebold/github-env-vars-action@v2 # https://github.com/marketplace/actions/github-environment-variables-action
# Set Complete Container Image URL
- name: Set CONTAINER_IMAGE_URL
run: |
echo "CONTAINER_IMAGE_URL=${{ vars.DOCKER_REGISTRY_URL }}/${{ vars.DOCKER_REPOSITORY }}/${{ env.CI_REPOSITORY_NAME }}:${{ env.CI_ACTION_REF_NAME }}" >> $GITHUB_ENV
- name: Checkout repository
uses: actions/checkout@v4 # https://github.com/marketplace/actions/checkout
- name: Cache Trivy
id: cache
uses: actions/cache@v3 # https://github.com/marketplace/actions/cache#using-a-combination-of-restore-and-save-actions
with:
path: ${{ env.TRIVY_CACHE_DIR }}
key: trivy-${{ hashFiles('**/package-lock.json', '**/Containerfile*') }} # Trivy scan results are influenced by npm dependencies and Containerfile runtime image
- name: Scan Image with Aqua Security Trivy
uses: aquasecurity/trivy-action@0.13.0 # https://github.com/marketplace/actions/aqua-security-trivy
with:
image-ref: ${{ env.CONTAINER_IMAGE_URL }} # CONTAINER_IMAGE_URL is defined in GITHUB_ENV
vuln-type: 'os,library'
severity: 'LOW,MEDIUM,HIGH,CRITICAL'
scanners: 'vuln,secret,config'
ignore-unfixed: true
exit-code: '1'
cache-dir: ${{ env.TRIVY_CACHE_DIR }}
format: sarif
output: 'trivy-results.sarif'
env:
TRIVY_USERNAME: ${{ secrets.DOCKER_REGISTRY_USERNAME }}
TRIVY_PASSWORD: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v2.22.5 # https://github.com/github/codeql-action/tree/main/upload-sarif
with:
sarif_file: 'trivy-results.sarif'