Skip to content

feat: Bump go version to 1.21 #280

feat: Bump go version to 1.21

feat: Bump go version to 1.21 #280

name: Create, Scan and Publish KAITO image
on:
pull_request:
branches:
- main
- release-**
types: [ closed ]
permissions:
contents: write
packages: write
env:
REGISTRY: ghcr.io
GO_VERSION: '1.21'
IMAGE_NAME: 'workspace'
jobs:
export-registry:
if: github.event.pull_request.merged == true && contains(github.event.pull_request.title, 'update manifest and helm charts')
runs-on: ubuntu-20.04
environment: preset-env
outputs:
registry: ${{ steps.export.outputs.registry }}
steps:
- id: export
run: |
# registry must be in lowercase
echo "registry=$(echo "${{ env.REGISTRY }}/${{ github.repository }}" | tr [:upper:] [:lower:])" >> $GITHUB_OUTPUT
publish-images:
if: github.event.pull_request.merged == true && contains(github.event.pull_request.title, 'update manifest and helm charts')
needs:
- export-registry
env:
REGISTRY: ${{ needs.export-registry.outputs.registry }}
runs-on: ubuntu-20.04
environment: preset-env
steps:
- id: get-tag
name: Get tag
run: echo "IMG_TAG=$(echo ${{ github.event.pull_request.head.ref }} | tr -d release-)" >> $GITHUB_ENV
- uses: actions/checkout@v4
with:
submodules: true
fetch-depth: 0
ref: ${{ env.IMG_TAG }}
- name: Login to ${{ env.REGISTRY }}
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Set Image tag
run: |
ver=${{ env.IMG_TAG }}
echo "IMG_TAG=${ver#"v"}" >> $GITHUB_ENV
- name: Build image
run: |
OUTPUT_TYPE=type=registry make docker-build-kaito
env:
VERSION: ${{ env.IMG_TAG }}
- name: Scan ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMG_TAG }}
uses: aquasecurity/trivy-action@master
with:
image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMG_TAG }}
format: 'table'
exit-code: '1'
ignore-unfixed: true
vuln-type: 'os,library'
severity: 'CRITICAL,HIGH'
timeout: '5m0s'
env:
TRIVY_USERNAME: ${{ github.actor }}
TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
- name: 'Dispatch release tag'
uses: peter-evans/repository-dispatch@v3
with:
token: ${{ secrets.GITHUB_TOKEN }}
event-type: release-tag
client-payload: '{"isRelease": true,"registry": "$${{ env.REGISTRY }}","tag": "v${{ env.IMG_TAG }}"}'