reusable-workflows/.github/workflows/docker-push.yaml at 7d99c455f3092e1c2dce3b9c0421f3acacc62fa8 · replicatedcom/reusable-workflows · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
on:
  workflow_call:
    inputs:
      dockerfilePath:
        description: "Path to Dockerfile."
        required: true
        type: string
      buildArgs:
        description: "Build args to be used to build the container image."
        required: false
        type: string
      imageName:
        description: "Desired name for container image."
        required: false
        type: string
      imageTag:
        description: "Desired tag for container image."
        required: false
        type: string
    secrets:
      ociRegistry:
        description: "Registry to push the image to."
        required: false
      oci_registry_user:
        description: "Username to authn"
        required: false
      oci_registry_password:
        description: "User password to authn"
        required: false

jobs:

  build:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repo
        uses: actions/checkout@v2

      - name: Build container image
        run: |
            cd ${{ inputs.dockerfilePath }}
            # Push to ttl.sh for scanning
            IMAGE_NAME=$(uuidgen)
            echo $IMAGE_NAME > random_uuid
            docker build . ${{ inputs.buildArgs }} -t ttl.sh/${IMAGE_NAME}:1h
            docker push ttl.sh/${IMAGE_NAME}:1h

      - name: Upload temp tag
        uses: actions/upload-artifact@v3
        with:
          name: random_uuid
          path: ${{ inputs.dockerfilePath }}/random_uuid
          retention-days: 1

  scan:
    runs-on: ubuntu-latest
    container:
      image: aquasec/trivy:latest
    needs: [build]

    steps:

      - name: Download tag artifact
        uses: actions/download-artifact@v3
        with:
          name: random_uuid
          path: ./

      - name: Scan image artifact
        run: |
            IMAGE_NAME=$(cat random_uuid)
            trivy image --ignore-unfixed -s CRITICAL -s HIGH ttl.sh/${IMAGE_NAME}:1h

  push:
    runs-on: ubuntu-latest
    needs: [scan]

    steps:
      - name: Checkout repo
        uses: actions/checkout@v2

      - name: Build container image
        run: |
            cd ${{ inputs.dockerfilePath }}
            docker login -p ${{ secrets.oci_registry_password }} -u ${{ secrets.oci_registry_user }} ${{ inputs.ociRegistry }}
            docker build . ${{ inputs.buildArgs }} -t ${{ inputs.ociRegistry}}/${{ inputs.imageName }}:${{ inputs.imageTag }}
            docker build . ${{ inputs.buildArgs }} -t ${{ inputs.ociRegistry}}/${{ inputs.imageName }}:latest
            docker push ${{ inputs.ociRegistry}}/${{ inputs.imageName }}:${{ inputs.imageTag }}
            docker push ${{ inputs.ociRegistry}}/${{ inputs.imageName }}:latest