-
Notifications
You must be signed in to change notification settings - Fork 4
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
3 changed files
with
143 additions
and
20 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,102 @@ | ||
| name: Build Docker image | ||
| description: Builds a Docker image | ||
| inputs: | ||
| context: | ||
| description: The directory containing the Dockerfile | ||
| required: true | ||
| file: | ||
| description: The Dockerfile to use | ||
| required: false | ||
| platforms: | ||
| description: The platforms to build for | ||
| required: false | ||
| default: linux/amd64,linux/arm64 | ||
| push: | ||
| description: Whether to push the image to the registry | ||
| required: true | ||
| primaryTag: | ||
| description: The primary tag to use for the image | ||
| required: true | ||
| tags: | ||
| description: The tags to use for the image | ||
| required: false | ||
| args: | ||
| description: List of build-time variables | ||
| required: false | ||
| cache-from: | ||
| description: List of external cache sources for buildx | ||
| required: false | ||
| cache-to: | ||
| description: List of cache export destinations for buildx | ||
| required: false | ||
| no-cache: | ||
| description: Do not use cache when building the image | ||
| required: false | ||
| default: 'false' | ||
| registry: | ||
| description: The registry to use | ||
| required: false | ||
| default: https://ghcr.io | ||
| username: | ||
| description: The username to use for the registry | ||
| required: false | ||
| password: | ||
| description: The password to use for the registry | ||
| required: false | ||
| default: ${{ github.token }} | ||
| runs: | ||
| using: composite | ||
| steps: | ||
| - name: Set up QEMU | ||
| uses: docker/setup-qemu-action@v3 | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
|
|
||
| - name: Log in to Docker Registry | ||
| uses: docker/login-action@v3 | ||
| with: | ||
| registry: ${{ inputs.registry }} | ||
| username: ${{ inputs.username }} | ||
| password: ${{ inputs.password }} | ||
| if: ${{ inputs.push }} | ||
|
|
||
| - name: Build container image | ||
| uses: docker/build-push-action@v5 | ||
| with: | ||
| load: true | ||
| push: false | ||
| context: ${{ inputs.context }} | ||
| file: ${{ inputs.file }} | ||
| tags: | | ||
| ${{ inputs.primaryTag }} | ||
| ${{ inputs.tags }} | ||
| build-args: ${{ inputs.args }} | ||
| cache-from: ${{ inputs.cache-from }} | ||
| no-cache: ${{ inputs.no-cache }} | ||
|
|
||
| - name: Push container image | ||
| uses: docker/build-push-action@v5 | ||
| with: | ||
| context: ${{ inputs.context }} | ||
| file: ${{ inputs.file }} | ||
| platforms: ${{ inputs.platforms }} | ||
| push: ${{ inputs.push }} | ||
| tags: | | ||
| ${{ inputs.primaryTag }} | ||
| ${{ inputs.tags }} | ||
| build-args: ${{ inputs.args }} | ||
| cache-from: ${{ inputs.cache-from }} | ||
| cache-to: ${{ inputs.cache-to }} | ||
| no-cache: ${{ inputs.no-cache }} | ||
| if: ${{ inputs.push }} | ||
|
|
||
| - name: Security Scan | ||
| uses: aquasecurity/trivy-action@master | ||
| id: scan | ||
| with: | ||
| image-ref: ${{ inputs.primaryTag }} | ||
| format: template | ||
| template: "@.github/actions/build-docker-image/markdown.tpl" | ||
| output: trivy.md | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| ## Trivy Scan Report | ||
| {{- if . }} | ||
| {{- range . }} | ||
| ## {{ .Target }} | ||
| ### Vulnerabilities | ||
| {{- if (eq (len .Vulnerabilities) 0) }} | ||
| No vulnerabilities found. | ||
| {{- else }} | ||
| | Package | Vulnerability ID | Severity | Installed Version | Fixed Version | Links | | ||
| | ------- | ---------------- | :------: | ----------------- | ------------- | ----- | | ||
| {{- range .Vulnerabilities }} | ||
| | {{ .PkgName }} | {{ .VulnerabilityID }} | {{ .Vulnerability.Severity }} | {{ .InstalledVersion }} | {{ .FixedVersion }} | {{ .PrimaryURL }} | | ||
| {{- end }} | ||
|
|
||
| {{- end }} <!-- Vulnerabilities --> | ||
|
|
||
| ### Misconfigurations | ||
| {{- if (eq (len .Misconfigurations ) 0) }} | ||
| No misconfigurations found. | ||
| {{- else }} | ||
| | Type | Misconfiguration ID | Check | Severity | Message | | ||
| | ---- | ------------------- | ----- | -------- | ------- | | ||
| {{- range .Misconfigurations }} | ||
| | {{ .Type }} | {{ .ID }} | {{ .Title }} | {{ .Severity }} | {{ .Message }}<br>{{ .PrimaryURL }} | | ||
| {{- end }} | ||
|
|
||
| {{- end }} <!-- Misconfigurations --> | ||
|
|
||
| {{- end }} <!-- Targets --> | ||
|
|
||
| {{- else }} | ||
| Trivy Returned Empty Report | ||
| {{- end }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters