Skip to content

Commit 32504a8

Browse files
joostvdgjoostvdg
committed
testing copied pipelines
1 parent d2e4ed6 commit 32504a8

File tree

1 file changed

+186
-20
lines changed

1 file changed

+186
-20
lines changed

‎.github/workflows/main.yaml‎

Lines changed: 186 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ on:
88

99
env:
1010
CARGO_TERM_COLOR: always
11+
REGISTRY: ghcr.io
12+
IMAGE_NAME: joostvdg/git-next-tag
1113

1214
jobs:
1315
test:
@@ -53,15 +55,18 @@ jobs:
5355
cargo install cargo-tarpaulin
5456
cargo tarpaulin --out xml --output-dir coverage/
5557
56-
- name: Upload coverage to Codecov
57-
uses: codecov/codecov-action@v3
58+
- name: Upload coverage reports to Codecov
59+
uses: codecov/codecov-action@v5
5860
with:
59-
file: coverage/cobertura.xml
60-
fail_ci_if_error: true
61+
token: ${{ secrets.CODECOV_TOKEN }}
6162

6263
scans:
6364
name: Scans
6465
runs-on: ubuntu-latest
66+
permissions:
67+
contents: read
68+
security-events: write
69+
actions: read
6570
steps:
6671
- uses: actions/checkout@v4
6772

@@ -92,24 +97,185 @@ jobs:
9297
- name: Perform CodeQL Analysis
9398
uses: github/codeql-action/analyze@v3
9499

95-
build-docker:
96-
name: Build Docker Image
100+
security-scan:
97101
runs-on: ubuntu-latest
98-
needs: [test, scans]
99-
if: github.ref == 'refs/heads/main'
102+
permissions:
103+
contents: read
104+
security-events: write
100105
steps:
101-
- uses: actions/checkout@v4
106+
- uses: actions/checkout@v4
102107

103-
- name: Set up Docker Buildx
104-
uses: docker/setup-buildx-action@v3
108+
- name: Run Trivy vulnerability scanner
109+
uses: aquasecurity/trivy-action@master
110+
with:
111+
scan-type: 'fs'
112+
scan-ref: '.'
113+
format: 'sarif'
114+
output: 'trivy-results.sarif'
105115

106-
- name: Build Docker image
107-
uses: docker/build-push-action@v5
108-
with:
109-
context: .
110-
platforms: linux/amd64,linux/arm64
111-
push: false
112-
tags: git-next-tag:latest
113-
cache-from: type=gha
114-
cache-to: type=gha,mode=max
116+
- name: Upload Trivy scan results
117+
uses: github/codeql-action/upload-sarif@v3
118+
with:
119+
sarif_file: 'trivy-results.sarif'
120+
121+
- name: Run Snyk security scan
122+
uses: snyk/actions/maven@master
123+
env:
124+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
125+
with:
126+
args: --severity-threshold=high
127+
128+
generate-version:
129+
runs-on: ubuntu-latest
130+
outputs:
131+
version: ${{ steps.version.outputs.version }}
132+
major: ${{ steps.version.outputs.major }}
133+
minor: ${{ steps.version.outputs.minor }}
134+
patch: ${{ steps.version.outputs.patch }}
135+
steps:
136+
- uses: actions/checkout@v4
137+
with:
138+
fetch-depth: 0
139+
140+
- name: Generate version
141+
id: version
142+
run: |
143+
# Get the latest tag or default to v0.0.0
144+
LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "v0.0.0")
145+
echo "Latest tag: $LATEST_TAG"
146+
147+
# Extract major.minor.patch
148+
VERSION=${LATEST_TAG#v}
149+
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"
150+
151+
# Increment patch version
152+
PATCH=$((PATCH + 1))
153+
NEW_VERSION="$MAJOR.$MINOR.$PATCH"
154+
155+
echo "version=$NEW_VERSION" >> $GITHUB_OUTPUT
156+
echo "major=$MAJOR" >> $GITHUB_OUTPUT
157+
echo "minor=$MINOR" >> $GITHUB_OUTPUT
158+
echo "patch=$PATCH" >> $GITHUB_OUTPUT
159+
echo "Generated version: $NEW_VERSION"
160+
161+
build-and-push:
162+
needs: [scans, test, security-scan, generate-version]
163+
runs-on: ubuntu-latest
164+
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
165+
permissions:
166+
contents: read
167+
packages: write
168+
id-token: write
169+
attestations: write
170+
outputs:
171+
image-digest: ${{ steps.build.outputs.digest }}
172+
steps:
173+
- uses: actions/checkout@v4
174+
175+
- name: Set up Docker Buildx
176+
uses: docker/setup-buildx-action@v3
177+
178+
- name: Log in to Container Registry
179+
uses: docker/login-action@v3
180+
with:
181+
registry: ${{ env.REGISTRY }}
182+
username: ${{ github.actor }}
183+
password: ${{ secrets.GITHUB_TOKEN }}
184+
185+
- name: Install Cosign
186+
uses: sigstore/cosign-installer@v3
187+
188+
- name: Extract metadata
189+
id: meta
190+
uses: docker/metadata-action@v5
191+
with:
192+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
193+
tags: |
194+
type=raw,value=latest
195+
type=raw,value=${{ needs.generate-version.outputs.version }}
196+
type=sha,prefix={{branch}}-
197+
198+
- name: Build and push Docker image
199+
id: build
200+
uses: docker/build-push-action@v5
201+
with:
202+
context: .
203+
file: Dockerfile.jvm
204+
platforms: linux/amd64,linux/arm64
205+
push: true
206+
tags: ${{ steps.meta.outputs.tags }}
207+
labels: ${{ steps.meta.outputs.labels }}
208+
cache-from: type=gha
209+
cache-to: type=gha,mode=max
210+
211+
- name: Sign container image
212+
run: |
213+
cosign sign --yes ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}
214+
215+
- name: Generate SLSA attestation
216+
uses: actions/attest-build-provenance@v1
217+
with:
218+
subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
219+
subject-digest: ${{ steps.build.outputs.digest }}
220+
221+
image-security-scan:
222+
needs: [build-and-push]
223+
runs-on: ubuntu-latest
224+
permissions:
225+
contents: read
226+
security-events: write
227+
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
228+
steps:
229+
- name: Run Trivy vulnerability scanner on image
230+
uses: aquasecurity/trivy-action@master
231+
with:
232+
image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build-and-push.outputs.image-digest }}
233+
format: 'sarif'
234+
output: 'trivy-image-results.sarif'
235+
236+
- name: Upload Trivy scan results
237+
uses: github/codeql-action/upload-sarif@v3
238+
with:
239+
sarif_file: 'trivy-image-results.sarif'
240+
241+
- name: Run Snyk container scan
242+
uses: snyk/actions/docker@master
243+
env:
244+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
245+
with:
246+
image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build-and-push.outputs.image-digest }}
247+
args: --severity-threshold=high
248+
249+
create-release:
250+
needs: [generate-version, build-and-push, image-security-scan]
251+
runs-on: ubuntu-latest
252+
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
253+
permissions:
254+
contents: write
255+
steps:
256+
- uses: actions/checkout@v4
257+
258+
- name: Create Git tag
259+
run: |
260+
git config user.name "github-actions[bot]"
261+
git config user.email "github-actions[bot]@users.noreply.github.com"
262+
git tag -a "v${{ needs.generate-version.outputs.version }}" -m "Release v${{ needs.generate-version.outputs.version }}"
263+
git push origin "v${{ needs.generate-version.outputs.version }}"
264+
265+
- name: Create GitHub release
266+
uses: actions/create-release@v1
267+
env:
268+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
269+
with:
270+
tag_name: v${{ needs.generate-version.outputs.version }}
271+
release_name: Release v${{ needs.generate-version.outputs.version }}
272+
body: |
273+
## Changes
274+
- Automated release v${{ needs.generate-version.outputs.version }}
275+
276+
## Container Image
277+
- `${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.generate-version.outputs.version }}`
278+
- `${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build-and-push.outputs.image-digest }}`
279+
draft: false
280+
prerelease: false
115281

0 commit comments

Comments
 (0)