Skip to content

Commit 5415e1e

Browse files
miragecenturycursoragent
miragecentury
and
cursoragent
committed
ci(release): refactor workflows with reusable validate, buildah-only builds
- Add reusable validate.yaml: hadolint + build-and-scan (buildah, dive, trivy) - CI: call validate workflow instead of duplicating hadolint/build jobs - Release: gate semantic-release behind validate; build-and-push only builds and pushes (no re-scan) Co-authored-by: Cursor <cursoragent@cursor.com>
1 parent f269999 commit 5415e1e

File tree

4 files changed

+103
-88
lines changed

4 files changed

+103
-88
lines changed

‎.github/workflows/ci.yaml‎

Lines changed: 2 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -19,58 +19,5 @@ jobs:
1919

2020
- uses: wagoid/commitlint-github-action@v6
2121

22-
hadolint:
23-
name: Lint Containerfile
24-
runs-on: ubuntu-latest
25-
steps:
26-
- uses: actions/checkout@v4
27-
28-
- uses: hadolint/hadolint-action@v3.1.0
29-
with:
30-
dockerfile: Containerfile
31-
32-
build:
33-
name: Build and scan
34-
runs-on: ubuntu-latest
35-
needs: [hadolint]
36-
steps:
37-
- uses: actions/checkout@v4
38-
39-
- name: Install yq
40-
run: |
41-
sudo curl -sSL -o /usr/local/bin/yq "https://github.com/mikefarah/yq/releases/download/v4.45.4/yq_linux_amd64"
42-
sudo chmod +x /usr/local/bin/yq
43-
44-
- name: Build image
45-
run: |
46-
BUILD_ARGS=""
47-
for arg in $(yq e '.build.args[]' manifest.yaml); do
48-
BUILD_ARGS="${BUILD_ARGS} --build-arg ${arg}"
49-
done
50-
# shellcheck disable=SC2086
51-
docker build -f Containerfile ${BUILD_ARGS} -t test-build .
52-
53-
- name: Install Dive
54-
run: |
55-
DIVE_VERSION=0.12.0
56-
curl -sSL -o /tmp/dive.deb "https://github.com/wagoodman/dive/releases/download/v${DIVE_VERSION}/dive_${DIVE_VERSION}_linux_amd64.deb"
57-
sudo apt install -y /tmp/dive.deb
58-
rm /tmp/dive.deb
59-
60-
- name: Dive filesystem scan
61-
run: dive --ci --source=docker test-build
62-
63-
- name: Cache Trivy vulnerability DB
64-
uses: actions/cache@v4
65-
with:
66-
path: ~/.cache/trivy
67-
key: trivy-db-${{ runner.os }}-${{ github.run_id }}
68-
restore-keys: |
69-
trivy-db-${{ runner.os }}-
70-
71-
- name: Trivy vulnerability scan
72-
uses: aquasecurity/trivy-action@0.24.0
73-
with:
74-
image-ref: test-build
75-
severity: 'HIGH,CRITICAL'
76-
exit-code: '1'
22+
validate:
23+
uses: ./.github/workflows/validate.yaml

‎.github/workflows/release.yaml‎

Lines changed: 6 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,12 @@ permissions:
99
packages: write
1010

1111
jobs:
12+
validate:
13+
uses: ./.github/workflows/validate.yaml
14+
1215
release:
1316
name: Semantic release
17+
needs: validate
1418
runs-on: ubuntu-latest
1519
outputs:
1620
new_release_published: ${{ steps.semantic.outputs.new_release_published }}
@@ -30,7 +34,7 @@ jobs:
3034
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3135

3236
build-and-push:
33-
name: Build, scan & push
37+
name: Build & push
3438
needs: release
3539
if: needs.release.outputs.new_release_published == 'true'
3640
runs-on: ubuntu-latest
@@ -49,11 +53,6 @@ jobs:
4953
echo "registry=$(yq e '.registry' manifest.yaml)" >> "$GITHUB_OUTPUT"
5054
echo "format=$(yq e '.build.format' manifest.yaml)" >> "$GITHUB_OUTPUT"
5155
52-
- name: Validate Containerfile
53-
run: |
54-
docker pull -q ghcr.io/hadolint/hadolint:latest
55-
docker run --rm -i -v "$(pwd)/.hadolint.yaml:/.hadolint.yaml:ro" hadolint/hadolint:latest hadolint --config /.hadolint.yaml - < Containerfile
56-
5756
- name: Build image
5857
env:
5958
IMAGE_NAME: ${{ steps.manifest.outputs.image_name }}
@@ -89,35 +88,10 @@ jobs:
8988
--tag "${IMAGE_NAME}:${IMAGE_VERSION}" \
9089
.
9190
92-
# Save to OCI archive for scanning and pushing
91+
# Save to OCI archive for pushing
9392
mkdir -p build
9493
buildah push "${IMAGE_NAME}:${IMAGE_VERSION}" "oci-archive:build/${IMAGE_NAME}.tar"
9594
96-
# Load into Docker daemon for dive scan
97-
skopeo copy "oci-archive:build/${IMAGE_NAME}.tar" "docker-daemon:${IMAGE_NAME}:${IMAGE_VERSION}"
98-
99-
- name: Dive filesystem scan
100-
env:
101-
IMAGE_NAME: ${{ steps.manifest.outputs.image_name }}
102-
run: dive --ci --source=docker "${IMAGE_NAME}:${IMAGE_VERSION}"
103-
104-
- name: Cache Trivy vulnerability DB
105-
uses: actions/cache@v4
106-
with:
107-
path: ~/.cache/trivy
108-
key: trivy-db-${{ runner.os }}-${{ github.run_id }}
109-
restore-keys: |
110-
trivy-db-${{ runner.os }}-
111-
112-
- name: Trivy vulnerability scan
113-
env:
114-
IMAGE_NAME: ${{ steps.manifest.outputs.image_name }}
115-
run: |
116-
trivy image \
117-
--severity HIGH,CRITICAL \
118-
--exit-code 1 \
119-
--input "build/${IMAGE_NAME}.tar"
120-
12195
- name: Login to GHCR
12296
env:
12397
REGISTRY: ${{ steps.manifest.outputs.registry }}

‎.github/workflows/validate.yaml‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
name: Validate
2+
3+
on:
4+
workflow_call:
5+
6+
permissions:
7+
contents: read
8+
9+
jobs:
10+
hadolint:
11+
name: Lint Containerfile
12+
runs-on: ubuntu-latest
13+
steps:
14+
- uses: actions/checkout@v4
15+
16+
- uses: hadolint/hadolint-action@v3.1.0
17+
with:
18+
dockerfile: Containerfile
19+
20+
build-and-scan:
21+
name: Build and scan
22+
needs: hadolint
23+
runs-on: ubuntu-latest
24+
steps:
25+
- uses: actions/checkout@v4
26+
27+
- name: Install build tools
28+
run: ./scripts/install_tools.sh
29+
30+
- name: Read manifest
31+
id: manifest
32+
run: |
33+
echo "image_name=$(yq e '.name' manifest.yaml)" >> "$GITHUB_OUTPUT"
34+
echo "format=$(yq e '.build.format' manifest.yaml)" >> "$GITHUB_OUTPUT"
35+
36+
- name: Build image
37+
env:
38+
IMAGE_NAME: ${{ steps.manifest.outputs.image_name }}
39+
IMAGE_FORMAT: ${{ steps.manifest.outputs.format }}
40+
run: |
41+
# Build args from manifest
42+
BUILD_ARGS=()
43+
while IFS= read -r arg; do
44+
BUILD_ARGS+=(--build-arg "${arg}")
45+
done < <(yq e '.build.args[]' manifest.yaml)
46+
47+
# Labels from manifest
48+
LABELS=()
49+
while IFS= read -r label; do
50+
if [[ -n "${label}" ]]; then
51+
label_key="${label%%=*}"
52+
label_value="${label#*=}"
53+
label_value="${label_value%\"}"
54+
label_value="${label_value#\"}"
55+
LABELS+=(--label "${label_key}=${label_value}")
56+
fi
57+
done < <(yq e '.build.labels[]' manifest.yaml)
58+
59+
buildah build \
60+
--squash \
61+
--pull-always \
62+
--format "${IMAGE_FORMAT}" \
63+
"${BUILD_ARGS[@]}" \
64+
"${LABELS[@]}" \
65+
--tag "${IMAGE_NAME}:test" \
66+
.
67+
68+
# Save to OCI archive for scanning
69+
mkdir -p build
70+
buildah push "${IMAGE_NAME}:test" "oci-archive:build/${IMAGE_NAME}.tar"
71+
72+
# Load into Docker daemon for dive scan
73+
skopeo copy "oci-archive:build/${IMAGE_NAME}.tar" "docker-daemon:${IMAGE_NAME}:test"
74+
75+
- name: Dive filesystem scan
76+
env:
77+
IMAGE_NAME: ${{ steps.manifest.outputs.image_name }}
78+
run: dive --ci --source=docker "${IMAGE_NAME}:test"
79+
80+
- name: Cache Trivy vulnerability DB
81+
uses: actions/cache@v4
82+
with:
83+
path: ~/.cache/trivy
84+
key: trivy-db-${{ runner.os }}-${{ github.run_id }}
85+
restore-keys: |
86+
trivy-db-${{ runner.os }}-
87+
88+
- name: Trivy vulnerability scan
89+
env:
90+
IMAGE_NAME: ${{ steps.manifest.outputs.image_name }}
91+
run: |
92+
trivy image \
93+
--severity HIGH,CRITICAL \
94+
--exit-code 1 \
95+
--input "build/${IMAGE_NAME}.tar"

‎path_to_comments/discussion_r2809010124‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

0 commit comments

Comments
 (0)