devrel #113
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: devrel | |
| on: | |
| push: | |
| branches: [ "main" ] | |
| pull_request: | |
| branches: [ "main" ] | |
| workflow_dispatch: | |
| permissions: | |
| actions: read # for detecting the Github Actions environment. | |
| id-token: write # for creating OIDC tokens for signing. | |
| packages: write # for uploading attestations. | |
| security-events: write # Required for uploading code scanning | |
| attestations: write | |
| contents: read | |
| jobs: | |
| build-publish-docker: | |
| runs-on: ubuntu-latest | |
| env: | |
| DOCKER_REPO: devrel-docker | |
| IMAGE_NAME: devrel | |
| JF_URL: https://${{ vars.JF_URL }}/ | |
| DOCKER_BUILD_SUMMARY: false | |
| DOCKER_BUILD_RECORD_UPLOAD: false | |
| JFROG_CLI_LOG_LEVEL: DEBUG | |
| steps: | |
| - name: Checkout the repository | |
| uses: actions/checkout@v4 | |
| - name: Setup JFrog CLI | |
| uses: jfrog/setup-jfrog-cli@v4 | |
| id: setup-cli | |
| env: | |
| JF_URL: https://${{ vars.JF_URL }}/ | |
| with: | |
| oidc-provider-name: jfrog-github-oidc | |
| - name: Set CLI Config | |
| run: jf npm-config --global=true --repo-resolve=devrel-npm --repo-deploy=devrel-npm | |
| - name: build webapp | |
| run: | | |
| jf npm ci | |
| jf npm publish | |
| npm run build | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Authenticate Docker | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ vars.JF_URL }} | |
| username: ${{ steps.setup-cli.outputs.oidc-user }} | |
| password: ${{ steps.setup-cli.outputs.oidc-token }} | |
| - name: Build the Docker image | |
| uses: docker/build-push-action@v6 | |
| id: build | |
| with: | |
| push: true | |
| context: . | |
| platforms: linux/amd64,linux/arm64 | |
| tags: ${{ vars.JF_URL }}/${{ env.DOCKER_REPO }}/${{ env.IMAGE_NAME }} | |
| provenance: false | |
| - name: Generate docker attestation | |
| if: ${{ false }} | |
| uses: actions/attest-build-provenance@v1 | |
| with: | |
| subject-name: ${{ vars.JF_URL }}/${{ env.DOCKER_REPO }}/${{ env.IMAGE_NAME }} | |
| subject-digest: ${{ steps.build.outputs.digest }} | |
| push-to-registry: false | |
| - name: docker scan | |
| if: ${{ true }} | |
| run: | | |
| jf docker pull ${{ vars.JF_URL }}/${{ env.DOCKER_REPO }}/${{ env.IMAGE_NAME }}:latest | |
| jf docker scan ${{ vars.JF_URL }}/${{ env.DOCKER_REPO }}/${{ env.IMAGE_NAME }}:latest --vuln --fail=false | |
| - name: add docker package to build | |
| run: | | |
| echo "${{ vars.JF_URL }}/${{ env.DOCKER_REPO }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}" > metadata.json | |
| jf rt build-docker-create ${{ env.DOCKER_REPO }} --image-file metadata.json | |
| - name: publish build info | |
| run: | | |
| jf rt build-collect-env | |
| jf rt build-add-git | |
| jf rt build-publish | |
| - name: Sleep for 60 seconds | |
| uses: jakejarvis/wait-action@master | |
| with: | |
| time: '60s' | |
| - name: build scan | |
| if: ${{ true }} | |
| run: | | |
| jf build-scan --vuln --fail=false |