chore(deps): Bump github/codeql-action from 2.2.3 to 2.3.1 #123
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Pull Request | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| jobs: | |
| build: | |
| name: Build OCI Image | |
| permissions: write-all | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [alpine, debian] | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| shell: bash | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0 | |
| - name: Run Hadolint | |
| uses: hadolint/hadolint-action@54c9adbab1582c2ef04b2016b760714a4bfde3cf # v3.1.0 | |
| with: | |
| dockerfile: ./${{ matrix.os }}.dockerfile | |
| format: sarif | |
| output-file: hadolint.sarif | |
| no-fail: true | |
| - name: Upload Hadolint SARIF report | |
| uses: github/codeql-action/upload-sarif@8662eabe0e9f338a07350b7fd050732745f93848 # v2.3.1 | |
| with: | |
| category: hadolint-${{ matrix.os }} | |
| sarif_file: hadolint.sarif | |
| - name: Generate OCI image metadata | |
| id: metadata | |
| uses: docker/metadata-action@507c2f2dc502c992ad446e3d7a5dfbe311567a96 # v4.3.0 | |
| with: | |
| flavor: | | |
| latest=false | |
| images: | | |
| ${{ github.repository }} | |
| tags: | | |
| type=raw,value=${{ matrix.os }}-local | |
| labels: | | |
| org.opencontainers.image.description=Fluentd aggregator OCI image based on the default Fluentd OCI image. | |
| org.opencontainers.image.authors=Fluentd developers <fluentd@googlegroups.com> | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@f03ac48505955848960e80bbb68046aa35c7b9e7 # v2.4.1 | |
| - name: Build OCI image | |
| id: build | |
| uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671 # v4.0.0 | |
| with: | |
| file: ./${{ matrix.os }}.dockerfile | |
| context: . | |
| provenance: false | |
| sbom: false | |
| platforms: linux/amd64 | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| tags: ${{ steps.metadata.outputs.tags }} | |
| labels: ${{ steps.metadata.outputs.labels }} | |
| load: true | |
| push: false | |
| - name: Generate OCI image Syft SBOM | |
| uses: anchore/sbom-action@07978da4bdb4faa726e52dfc6b1bed63d4b56479 # v0.13.3 | |
| with: | |
| image: "${{ github.repository }}:${{ steps.metadata.outputs.version }}" | |
| dependency-snapshot: true | |
| format: spdx-json | |
| artifact-name: ${{ github.event.repository.name }}-${{ matrix.os }}-syft-sbom | |
| output-file: ${{ github.event.repository.name }}-${{ matrix.os }}-syft-sbom.spdx.json | |
| - name: Scan OCI image Syft SBOM with Grype | |
| id: scan | |
| uses: anchore/scan-action@84aa2c1d0eba986ed2274869c27f1e35a625449f # v3.3.3 | |
| with: | |
| sbom: ${{ github.event.repository.name }}-${{ matrix.os }}-syft-sbom.spdx.json | |
| severity-cutoff: medium | |
| output-format: sarif | |
| fail-build: false | |
| - name: Upload Grype SARIF report | |
| uses: github/codeql-action/upload-sarif@8662eabe0e9f338a07350b7fd050732745f93848 # v2.3.1 | |
| with: | |
| category: grype-${{ matrix.os }} | |
| sarif_file: ${{ steps.scan.outputs.sarif }} |