Skip to content

update

update #20

Workflow file for this run

name: Continuous Delivery
on:
push:
branches:
- main # shoud be removed
workflow_dispatch:
env:
IMAGE_REPOSITORY_DIR: "ghcr.io/${{ github.repository_owner }}"
DOCKER_CONTENT_TRUST: 0
# CIS-DI-0005 recommends enable DOCKER_CONTENT_TRUST, but I disabled it becase of:
# Set up QEMU(docker/setup-qemu-action@v3It) raises
# # /usr/bin/docker pull tonistiigi/binfmt:latest
# # Error: remote trust data does not exist for docker.io/tonistiigi/binfmt: notary.docker.io does not have trust data for docker.io/tonistiigi/binfmt
jobs:
generate-jobs:
name: Generate Jobs
runs-on: ubuntu-22.04
outputs:
strategy: ${{ steps.generate-jobs.outputs.strategy }}
steps:
- name: Checkout Code
uses: actions/checkout@v4
- name: Generate Jobs
id: generate-jobs
shell: bash
run: |
cat \
cloudnativepg-configured/16/strategy.json \
|
bash .github/generate-strategy.sh |
{ echo -n "strategy=" ; jq -c . ; } |
tee -a $GITHUB_OUTPUT
build:
needs: generate-jobs
strategy: ${{ fromJson(needs.generate-jobs.outputs.strategy) }}
name: ${{ matrix.name }}
runs-on: ubuntu-22.04
permissions:
contents: read
packages: write
security-events: write
steps:
- name: Checkout Code
uses: actions/checkout@v4
- name: Set up QEMU
uses: docker/setup-qemu-action@v3
with:
platforms: ${{ matrix.platforms }}
- name: Docker meta
env:
IMAGE: ${{ env.IMAGE_REPOSITORY_DIR }}/${{ matrix.imgname }}
TAGS: ${{ toJson(matrix.tags) }}
run: |
RESULT=""
for tag in $(jq -r '.[]' <<< "${TAGS}")
do
RESULT="${RESULT},${IMAGE}-test:${tag}"
# If we are running the pipeline in the main branch images are pushed in both -testing and PROD repo
if [ "${GITHUB_REF#refs/heads/}" == main ]
then
RESULT="${RESULT},${IMAGE}:${tag}"
fi
done
echo "TAGS=${RESULT%,}" >> $GITHUB_ENV
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Log in to the GitHub Container registry
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Build and load
uses: docker/build-push-action@v5
with:
context: ${{ matrix.dir }}
file: ${{ matrix.file }}
push: false
load: true
tags: ${{ env.TAGS }}
- name: Setup dockle
env:
dockleignore: ${{ matrix.files.dockleignore }}
run: |
cp $dockleignore .
- name: Dockle scan
uses: erzz/dockle-action@v1
with:
image: "${{ env.IMAGE_REPOSITORY_DIR }}/${{ matrix.imgname }}-test:${{ matrix.tags[0] }}"
exit-code: '1'
failure-threshold: WARN
accept-keywords: key
accept-filenames: usr/share/cmake/Templates/Windows/Windows_TemporaryKey.pfx,etc/trusted-key.key,usr/share/doc/perl-IO-Socket-SSL/certs/server_enc.p12,usr/share/doc/perl-IO-Socket-SSL/certs/server.p12,usr/local/lib/python3.9/dist-packages/azure/core/settings.py,usr/local/lib/python3.8/site-packages/azure/core/settings.py,usr/share/postgresql-common/pgdg/apt.postgresql.org.asc,usr/local/lib/python3.7/dist-packages/azure/core/settings.py,etc/ssl/private/ssl-cert-snakeoil.key
- name: Build and push
uses: docker/build-push-action@v5
with:
context: ${{ matrix.dir }}
file: ${{ matrix.files.dockerfile }}
platforms: ${{ matrix.platforms }}
push: true
tags: ${{ env.TAGS }}