-
Notifications
You must be signed in to change notification settings - Fork 4
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #565 from Automattic/refactor/build
ci: refactor build workflows
- Loading branch information
Showing
11 changed files
with
222 additions
and
175 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,123 @@ | ||
| name: Build Docker image | ||
| description: Builds a Docker image | ||
| inputs: | ||
| context: | ||
| description: The directory containing the Dockerfile | ||
| required: true | ||
| file: | ||
| description: The Dockerfile to use | ||
| required: false | ||
| platforms: | ||
| description: The platforms to build for | ||
| required: false | ||
| default: linux/amd64,linux/arm64 | ||
| push: | ||
| description: Whether to push the image to the registry | ||
| required: true | ||
| primaryTag: | ||
| description: The primary tag to use for the image | ||
| required: true | ||
| tags: | ||
| description: The tags to use for the image | ||
| required: false | ||
| args: | ||
| description: List of build-time variables | ||
| required: false | ||
| cache-from: | ||
| description: List of external cache sources for buildx | ||
| required: false | ||
| cache-to: | ||
| description: List of cache export destinations for buildx | ||
| required: false | ||
| no-cache: | ||
| description: Do not use cache when building the image | ||
| required: false | ||
| default: 'false' | ||
| registry: | ||
| description: The registry to use | ||
| required: false | ||
| default: https://ghcr.io | ||
| username: | ||
| description: The username to use for the registry | ||
| required: false | ||
| default: ${{ github.actor }} | ||
| password: | ||
| description: The password to use for the registry | ||
| required: false | ||
| default: ${{ github.token }} | ||
| runs: | ||
| using: composite | ||
| steps: | ||
| - name: Set up QEMU | ||
| uses: docker/setup-qemu-action@v3 | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
|
|
||
| - name: Log in to Docker Registry | ||
| uses: docker/login-action@v3 | ||
| with: | ||
| registry: ${{ inputs.registry }} | ||
| username: ${{ inputs.username }} | ||
| password: ${{ inputs.password }} | ||
| if: ${{ inputs.push }} | ||
|
|
||
| - name: Build and push container image | ||
| uses: docker/build-push-action@v5 | ||
| with: | ||
| context: ${{ inputs.context }} | ||
| file: ${{ inputs.file }} | ||
| platforms: ${{ inputs.platforms }} | ||
| push: ${{ inputs.push }} | ||
| tags: | | ||
| ${{ inputs.primaryTag }} | ||
| ${{ inputs.tags }} | ||
| build-args: ${{ inputs.args }} | ||
| cache-from: ${{ inputs.cache-from }} | ||
| cache-to: ${{ inputs.cache-to }} | ||
| no-cache: ${{ inputs.no-cache }} | ||
|
|
||
| - name: Load image to local Docker | ||
| uses: docker/build-push-action@v5 | ||
| with: | ||
| load: true | ||
| push: false | ||
| context: ${{ inputs.context }} | ||
| file: ${{ inputs.file }} | ||
| tags: | | ||
| ${{ inputs.primaryTag }} | ||
| ${{ inputs.tags }} | ||
| build-args: ${{ inputs.args }} | ||
|
|
||
| - name: Security Scan | ||
| uses: aquasecurity/trivy-action@master | ||
| with: | ||
| image-ref: ${{ inputs.primaryTag }} | ||
| format: template | ||
| template: "@.github/actions/build-docker-image/markdown.tpl" | ||
| output: trivy.md | ||
| if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name && github.event.sender.login != 'dependabot[bot]' | ||
|
|
||
| - name: Security Scan | ||
| uses: aquasecurity/trivy-action@master | ||
| with: | ||
| image-ref: ${{ inputs.primaryTag }} | ||
| format: table | ||
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name || github.event.sender.login == 'dependabot[bot]' | ||
|
|
||
| - name: Find Trivy Scan Report comment | ||
| uses: peter-evans/find-comment@v2 | ||
| id: fc | ||
| with: | ||
| issue-number: ${{ github.event.pull_request.number }} | ||
| body-includes: ${{ inputs.primaryTag }} | ||
| if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name && github.event.sender.login != 'dependabot[bot]' | ||
|
|
||
| - name: Create or update comment | ||
| uses: peter-evans/create-or-update-comment@v3 | ||
| with: | ||
| comment-id: ${{ steps.fc.outputs.comment-id }} | ||
| issue-number: ${{ github.event.pull_request.number }} | ||
| body-path: trivy.md | ||
| edit-mode: replace | ||
| if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name && github.event.sender.login != 'dependabot[bot]' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| ## Trivy Scan Report | ||
| {{- if . }} | ||
| {{- range . }} | ||
| ## {{ .Target }} | ||
| ### Vulnerabilities | ||
| {{- if (eq (len .Vulnerabilities) 0) }} | ||
| No vulnerabilities found. | ||
| {{- else }} | ||
| | Package | Vulnerability ID | Severity | Installed Version | Fixed Version | Links | | ||
| | ------- | ---------------- | :------: | ----------------- | ------------- | ----- | | ||
| {{- range .Vulnerabilities }} | ||
| | {{ .PkgName }} | {{ .VulnerabilityID }} | {{ .Vulnerability.Severity }} | {{ .InstalledVersion }} | {{ .FixedVersion }} | {{ .PrimaryURL }} | | ||
| {{- end }} | ||
|
|
||
| {{- end }} <!-- Vulnerabilities --> | ||
|
|
||
| ### Misconfigurations | ||
| {{- if (eq (len .Misconfigurations ) 0) }} | ||
| No misconfigurations found. | ||
| {{- else }} | ||
| | Type | Misconfiguration ID | Check | Severity | Message | | ||
| | ---- | ------------------- | ----- | -------- | ------- | | ||
| {{- range .Misconfigurations }} | ||
| | {{ .Type }} | {{ .ID }} | {{ .Title }} | {{ .Severity }} | {{ .Message }}<br>{{ .PrimaryURL }} | | ||
| {{- end }} | ||
|
|
||
| {{- end }} <!-- Misconfigurations --> | ||
|
|
||
| {{- end }} <!-- Targets --> | ||
|
|
||
| {{- else }} | ||
| Trivy Returned Empty Report | ||
| {{- end }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.