mirror of
https://github.com/chillpadclub/bedolaga-cabinet.git
synced 2026-07-28 09:33:46 +00:00
0a8b1a46d1
- trivy-action@0.24.0 — несуществующий тег (у trivy-action теги с префиксом v): резолв экшенов в Set up job валил бы весь docker-воркфлоу даже на PR. Пин на SHA v0.36.0 — как в бот-репо. - image-ref из github.repository сохраняет регистр (BEDOLAGA-DEV/…), а OCI требует lowercase — добавлен lowercase-шаг. - codeql-action v3 → v4 (v3 закатный; бот-репо уже на v4).
101 lines
3.1 KiB
YAML
101 lines
3.1 KiB
YAML
name: Docker Build
|
||
|
||
on:
|
||
push:
|
||
branches: [main]
|
||
tags:
|
||
- 'v*'
|
||
pull_request:
|
||
branches: [main]
|
||
|
||
env:
|
||
REGISTRY: ghcr.io
|
||
IMAGE_NAME: ${{ github.repository }}
|
||
|
||
permissions:
|
||
contents: read
|
||
|
||
jobs:
|
||
lint:
|
||
uses: ./.github/workflows/lint.yml
|
||
|
||
build-and-push:
|
||
needs: lint
|
||
runs-on: ubuntu-latest
|
||
permissions:
|
||
contents: read
|
||
packages: write
|
||
security-events: write
|
||
|
||
steps:
|
||
- name: Checkout code
|
||
uses: actions/checkout@v4
|
||
|
||
- name: Set up Docker Buildx
|
||
uses: docker/setup-buildx-action@v3
|
||
|
||
- name: Log in to Container Registry
|
||
if: github.event_name != 'pull_request'
|
||
uses: docker/login-action@v3
|
||
with:
|
||
registry: ${{ env.REGISTRY }}
|
||
username: ${{ github.actor }}
|
||
password: ${{ secrets.GITHUB_TOKEN }}
|
||
|
||
- name: Extract metadata
|
||
id: meta
|
||
uses: docker/metadata-action@v5
|
||
with:
|
||
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
|
||
tags: |
|
||
type=ref,event=branch
|
||
type=ref,event=pr
|
||
type=semver,pattern={{version}}
|
||
type=semver,pattern={{major}}.{{minor}}
|
||
type=semver,pattern={{major}}
|
||
type=sha
|
||
type=raw,value=latest,enable={{is_default_branch}}
|
||
|
||
- name: Build and push Docker image
|
||
id: build
|
||
uses: docker/build-push-action@v5
|
||
with:
|
||
context: .
|
||
push: ${{ github.event_name != 'pull_request' }}
|
||
tags: ${{ steps.meta.outputs.tags }}
|
||
labels: ${{ steps.meta.outputs.labels }}
|
||
cache-from: type=gha
|
||
cache-to: type=gha,mode=max
|
||
build-args: |
|
||
VITE_API_URL=/api
|
||
VITE_TELEGRAM_BOT_USERNAME=
|
||
VITE_APP_NAME=Cabinet
|
||
VITE_APP_LOGO=V
|
||
|
||
# OCI-референсы требуют lowercase, а github.repository сохраняет регистр
|
||
# (BEDOLAGA-DEV/…) — Trivy падал бы на 'repository name must be lowercase'.
|
||
- name: Lowercase image name for Trivy
|
||
if: github.event_name != 'pull_request'
|
||
id: image
|
||
run: echo "name=${IMAGE_NAME,,}" >> "$GITHUB_OUTPUT"
|
||
|
||
# Сканируем запушенный образ на CVE. Пока non-blocking (exit-code: 0):
|
||
# находки уезжают в Security → Code scanning, но сборку не роняют.
|
||
# Для ужесточения — поставить severity-фильтр в exit-code и убрать PR-гейт.
|
||
- name: Scan image with Trivy
|
||
if: github.event_name != 'pull_request'
|
||
uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
|
||
with:
|
||
image-ref: ${{ env.REGISTRY }}/${{ steps.image.outputs.name }}@${{ steps.build.outputs.digest }}
|
||
format: sarif
|
||
output: trivy-results.sarif
|
||
severity: HIGH,CRITICAL
|
||
exit-code: "0"
|
||
|
||
- name: Upload Trivy results to Security tab
|
||
if: github.event_name != 'pull_request'
|
||
uses: github/codeql-action/upload-sarif@v4
|
||
with:
|
||
sarif_file: trivy-results.sarif
|
||
category: trivy
|