Skip to content

Commit bbc4401

Browse files
author
karmaking
committed
fix restore build pipeline
1 parent 4a20168 commit bbc4401

4 files changed

Lines changed: 234 additions & 0 deletions

File tree

‎.github/workflows/auto_update_base_image.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: Regular base image update check
2+
on:
3+
schedule:
4+
- cron: "0 5 * * *"
5+
workflow_dispatch:
6+
7+
env:
8+
## Sets environment variable
9+
DOCKER_HUB_ORGANIZATION: ${{ vars.DOCKER_HUB_ORGANIZATION }}
10+
11+
jobs:
12+
build:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Checkout repository
16+
uses: actions/checkout@v4
17+
18+
- name: Docker Image Update Checker
19+
id: baseupdatecheck
20+
uses: lucacome/docker-image-update-checker@v2.0.0
21+
with:
22+
base-image: jetty:9.4-jdk11-alpine
23+
image: ${{ env.DOCKER_HUB_ORGANIZATION }}/obp-api:latest
24+
25+
- name: Trigger build_container_develop_branch workflow
26+
uses: actions/github-script@v6
27+
with:
28+
script: |
29+
await github.rest.actions.createWorkflowDispatch({
30+
owner: context.repo.owner,
31+
repo: context.repo.repo,
32+
workflow_id: 'build_container_develop_branch.yml',
33+
ref: 'refs/heads/develop'
34+
});
35+
if: steps.baseupdatecheck.outputs.needs-updating == 'true'

‎.github/workflows/build_container_develop_branch.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,3 +86,34 @@ jobs:
8686
with:
8787
name: ${{ github.sha }}
8888
path: push/
89+
90+
- name: Build the Docker image
91+
run: |
92+
echo "${{ secrets.DOCKER_HUB_TOKEN }}" | docker login -u "${{ secrets.DOCKER_HUB_USERNAME }}" --password-stdin docker.io
93+
docker build . --file .github/Dockerfile_PreBuild --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:$GITHUB_SHA --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:latest --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:develop
94+
docker build . --file .github/Dockerfile_PreBuild_OC --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:$GITHUB_SHA-OC --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:latest-OC --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:develop-OC --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:${GITHUB_REF##*/}-OC
95+
docker push docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }} --all-tags
96+
echo docker done
97+
98+
- uses: sigstore/cosign-installer@main
99+
100+
- name: Write signing key to disk (only needed for `cosign sign --key`)
101+
run: echo "${{ secrets.COSIGN_PRIVATE_KEY }}" > cosign.key
102+
103+
- name: Sign container image
104+
run: |
105+
cosign sign -y --key cosign.key \
106+
docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:develop
107+
cosign sign -y --key cosign.key \
108+
docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:latest
109+
cosign sign -y --key cosign.key \
110+
docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:$GITHUB_SHA
111+
cosign sign -y --key cosign.key \
112+
docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:develop-OC
113+
cosign sign -y --key cosign.key \
114+
docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:latest-OC
115+
env:
116+
COSIGN_PASSWORD: "${{secrets.COSIGN_PASSWORD}}"
117+
118+
119+

‎.github/workflows/build_container_non_develop_branch.yml‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
name: Build and publish container non develop
2+
3+
on:
4+
push:
5+
branches:
6+
- '*'
7+
- '!develop'
8+
9+
env:
10+
DOCKER_HUB_ORGANIZATION: ${{ vars.DOCKER_HUB_ORGANIZATION }}
11+
DOCKER_HUB_REPOSITORY: obp-api
12+
13+
jobs:
14+
build:
15+
runs-on: ubuntu-latest
16+
services:
17+
# Label used to access the service container
18+
redis:
19+
# Docker Hub image
20+
image: redis
21+
ports:
22+
# Opens tcp port 6379 on the host and service container
23+
- 6379:6379
24+
# Set health checks to wait until redis has started
25+
options: >-
26+
--health-cmd "redis-cli ping"
27+
--health-interval 10s
28+
--health-timeout 5s
29+
--health-retries 5
30+
steps:
31+
- uses: actions/checkout@v4
32+
- name: Extract branch name
33+
shell: bash
34+
run: echo "branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}"
35+
- name: Set up JDK 11
36+
uses: actions/setup-java@v4
37+
with:
38+
java-version: '11'
39+
distribution: 'adopt'
40+
cache: maven
41+
- name: Build with Maven
42+
run: |
43+
cp obp-api/src/main/resources/props/sample.props.template obp-api/src/main/resources/props/production.default.props
44+
echo connector=star > obp-api/src/main/resources/props/test.default.props
45+
echo starConnector_supported_types=mapped,internal >> obp-api/src/main/resources/props/test.default.props
46+
echo hostname=http://localhost:8016 >> obp-api/src/main/resources/props/test.default.props
47+
echo tests.port=8016 >> obp-api/src/main/resources/props/test.default.props
48+
echo End of minimum settings >> obp-api/src/main/resources/props/test.default.props
49+
echo payments_enabled=false >> obp-api/src/main/resources/props/test.default.props
50+
echo importer_secret=change_me >> obp-api/src/main/resources/props/test.default.props
51+
echo messageQueue.updateBankAccountsTransaction=false >> obp-api/src/main/resources/props/test.default.props
52+
echo messageQueue.createBankAccounts=false >> obp-api/src/main/resources/props/test.default.props
53+
echo allow_sandbox_account_creation=true >> obp-api/src/main/resources/props/test.default.props
54+
echo allow_sandbox_data_import=true >> obp-api/src/main/resources/props/test.default.props
55+
echo sandbox_data_import_secret=change_me >> obp-api/src/main/resources/props/test.default.props
56+
echo allow_account_deletion=true >> obp-api/src/main/resources/props/test.default.props
57+
echo allowed_internal_redirect_urls = /,/oauth/authorize >> obp-api/src/main/resources/props/test.default.props
58+
echo transactionRequests_enabled=true >> obp-api/src/main/resources/props/test.default.props
59+
echo transactionRequests_supported_types=SEPA,SANDBOX_TAN,FREE_FORM,COUNTERPARTY,ACCOUNT,SIMPLE >> obp-api/src/main/resources/props/test.default.props
60+
echo SIMPLE_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
61+
echo openredirects.hostname.whitlelist=http://127.0.0.1,http://localhost >> obp-api/src/main/resources/props/test.default.props
62+
echo remotedata.secret = foobarbaz >> obp-api/src/main/resources/props/test.default.props
63+
echo allow_public_views=true >> obp-api/src/main/resources/props/test.default.props
64+
65+
echo SIMPLE_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
66+
echo ACCOUNT_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
67+
echo SEPA_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
68+
echo FREE_FORM_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
69+
echo COUNTERPARTY_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
70+
echo SEPA_CREDIT_TRANSFERS_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
71+
72+
echo allow_oauth2_login=true >> obp-api/src/main/resources/props/test.default.props
73+
echo oauth2.jwk_set.url=https://www.googleapis.com/oauth2/v3/certs >> obp-api/src/main/resources/props/test.default.props
74+
75+
echo ResetPasswordUrlEnabled=true >> obp-api/src/main/resources/props/test.default.props
76+
77+
echo consents.allowed=true >> obp-api/src/main/resources/props/test.default.props
78+
MAVEN_OPTS="-Xmx3G -Xss2m" mvn clean package -Pprod
79+
80+
- name: Save .war artifact
81+
run: |
82+
mkdir -p ./push
83+
cp obp-api/target/obp-api-1.*.war ./push/
84+
- uses: actions/upload-artifact@v4
85+
with:
86+
name: ${{ github.sha }}
87+
path: push/
88+
89+
- name: Build the Docker image
90+
run: |
91+
echo "${{ secrets.DOCKER_HUB_TOKEN }}" | docker login -u "${{ secrets.DOCKER_HUB_USERNAME }}" --password-stdin docker.io
92+
docker build . --file .github/Dockerfile_PreBuild --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:$GITHUB_SHA --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:${GITHUB_REF##*/}
93+
docker build . --file .github/Dockerfile_PreBuild_OC --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:$GITHUB_SHA-OC --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:${GITHUB_REF##*/}-OC
94+
docker push docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }} --all-tags
95+
echo docker done
96+
97+
- uses: sigstore/cosign-installer@main
98+
99+
- name: Write signing key to disk (only needed for `cosign sign --key`)
100+
run: echo "${{ secrets.COSIGN_PRIVATE_KEY }}" > cosign.key
101+
102+
- name: Sign container image
103+
run: |
104+
cosign sign -y --key cosign.key \
105+
docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:${GITHUB_REF##*/}
106+
cosign sign -y --key cosign.key \
107+
docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:${GITHUB_REF##*/}-OC
108+
cosign sign -y --key cosign.key \
109+
docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:$GITHUB_SHA
110+
env:
111+
COSIGN_PASSWORD: "${{secrets.COSIGN_PASSWORD}}"
112+
113+
114+

‎.github/workflows/run_trivy.yml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
name: scan container image
2+
3+
on:
4+
workflow_run:
5+
workflows:
6+
- Build and publish container develop
7+
- Build and publish container non develop
8+
types:
9+
- completed
10+
env:
11+
## Sets environment variable
12+
DOCKER_HUB_ORGANIZATION: ${{ vars.DOCKER_HUB_ORGANIZATION }}
13+
DOCKER_HUB_REPOSITORY: obp-api
14+
15+
16+
jobs:
17+
build:
18+
runs-on: ubuntu-latest
19+
if: ${{ github.event.workflow_run.conclusion == 'success' }}
20+
21+
steps:
22+
- uses: actions/checkout@v4
23+
- id: trivy-db
24+
name: Check trivy db sha
25+
env:
26+
GH_TOKEN: ${{ github.token }}
27+
run: |
28+
endpoint='/orgs/aquasecurity/packages/container/trivy-db/versions'
29+
headers='Accept: application/vnd.github+json'
30+
jqFilter='.[] | select(.metadata.container.tags[] | contains("latest")) | .name | sub("sha256:";"")'
31+
sha=$(gh api -H "${headers}" "${endpoint}" | jq --raw-output "${jqFilter}")
32+
echo "Trivy DB sha256:${sha}"
33+
echo "::set-output name=sha::${sha}"
34+
- uses: actions/cache@v4
35+
with:
36+
path: .trivy
37+
key: ${{ runner.os }}-trivy-db-${{ steps.trivy-db.outputs.sha }}
38+
- name: Run Trivy vulnerability scanner
39+
uses: aquasecurity/trivy-action@master
40+
with:
41+
image-ref: 'docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:${{ github.sha }}'
42+
format: 'template'
43+
template: '@/contrib/sarif.tpl'
44+
output: 'trivy-results.sarif'
45+
security-checks: 'vuln'
46+
severity: 'CRITICAL,HIGH'
47+
timeout: '30m'
48+
cache-dir: .trivy
49+
- name: Fix .trivy permissions
50+
run: sudo chown -R $(stat . -c %u:%g) .trivy
51+
- name: Upload Trivy scan results to GitHub Security tab
52+
uses: github/codeql-action/upload-sarif@v3
53+
with:
54+
sarif_file: 'trivy-results.sarif'

0 commit comments

Comments
 (0)