Update aquasec/trivy Docker tag to v0.51.2 #2467
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 'Push latest ARM images' | |
| on: | |
| push: | |
| branches: | |
| - master | |
| concurrency: | |
| group: ci-arm-${{ github.head_ref || github.ref }}-${{ github.repository }} | |
| cancel-in-progress: true | |
| env: | |
| FORCE_COLOR: 1 | |
| jobs: | |
| get-core-matrix: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| matrix: ${{ steps.set-matrix.outputs.matrix }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - run: | | |
| git fetch --prune --unshallow | |
| - id: set-matrix | |
| run: | | |
| content=`cat ./.github/flavors.json | jq -r 'map(select(.arch == "arm64" and .variant == "core" and .model != "generic"))'` | |
| # the following lines are only required for multi line json | |
| content="${content//'%'/'%25'}" | |
| content="${content//$'\n'/'%0A'}" | |
| content="${content//$'\r'/'%0D'}" | |
| # end of optional handling for multi line json | |
| echo "::set-output name=matrix::{\"include\": $content }" | |
| # The matrix for standard (provider) images | |
| get-standard-matrix: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| matrix: ${{ steps.set-matrix.outputs.matrix }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - run: | | |
| sudo apt update && sudo apt install -y jq | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@master | |
| with: | |
| platforms: all | |
| - name: Set up Docker Buildx | |
| id: buildx | |
| uses: docker/setup-buildx-action@master | |
| - name: Install earthly | |
| uses: Luet-lab/luet-install-action@v1.1 | |
| with: | |
| repository: quay.io/kairos/packages | |
| packages: utils/earthly | |
| - id: set-matrix | |
| run: | | |
| docker run --name luet quay.io/luet/base && docker cp luet:/usr/bin/luet ./ | |
| chmod +x luet | |
| sudo mv luet /usr/bin/luet | |
| # Construct an array like this from the found versions: | |
| earthly --platform=linux/arm64 +extract-framework-profile | |
| # fetch "k3s-openrc" versions | |
| sudo luet --config framework-profile.yaml search -o json k8s/k3s | jq '.packages | map(select(.name == "k3s-openrc")) | map(.version) | unique' > k3s_openrc.json | |
| # fetch alpine flavors | |
| jq 'map(select(.arch == "arm64" and .variant == "standard" and .model != "generic" and .flavor == "alpine"))' .github/flavors.json > flavors_openrc.json | |
| # generate combinations | |
| jq -s '. | [combinations | .[0] + {"k3s_version": .[1]}]' flavors_openrc.json k3s_openrc.json > combinations_openrc.json | |
| # fetch "k3s-systemd" versions | |
| sudo luet --config framework-profile.yaml search -o json k8s/k3s | jq '.packages | map(select(.name == "k3s-systemd")) | map(.version) | unique' > k3s_systemd.json | |
| # fetch non-alpine flavors | |
| jq 'map(select(.arch == "arm64" and .variant == "standard" and .model != "generic" and .flavor != "alpine"))' .github/flavors.json > flavors_systemd.json | |
| # generate combinations | |
| jq -s '. | [combinations | .[0] + {"k3s_version": .[1]}]' flavors_systemd.json k3s_systemd.json > combinations_systemd.json | |
| # merge the two combinations | |
| content=$(jq -s 'add' combinations_openrc.json combinations_systemd.json) | |
| # the following lines are only required for multi line json | |
| content="${content//'%'/'%25'}" | |
| content="${content//$'\n'/'%0A'}" | |
| content="${content//$'\r'/'%0D'}" | |
| # end of optional handling for multi line json | |
| echo "::set-output name=matrix::{\"include\": $content }" | |
| build-nvidia-base: | |
| runs-on: fast | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Check if cache image is available | |
| id: cache | |
| run: | | |
| if docker pull quay.io/kairos/cache:nvidia-base; then | |
| echo "cache_available=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "cache_available=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Get changed files | |
| id: changed-files | |
| uses: tj-actions/changed-files@v44 | |
| with: | |
| files_yaml: | | |
| nvidia: | |
| - 'images/Dockerfile.nvidia' | |
| - name: Install kairos-agent (for versioneer) | |
| uses: Luet-lab/luet-install-action@v1.1 | |
| with: | |
| repository: quay.io/kairos/packages | |
| packages: system/kairos-agent | |
| - name: Release space from worker | |
| if: ${{ steps.cache.outputs.cache_available == 'false' || steps.changed-files.outputs.nvidia_any_changed == 'true' }} | |
| run: | | |
| echo "Listing top largest packages" | |
| pkgs=$(dpkg-query -Wf '${Installed-Size}\t${Package}\t${Status}\n' | awk '$NF == "installed"{print $1 "\t" $2}' | sort -nr) | |
| head -n 30 <<< "${pkgs}" | |
| echo | |
| df -h | |
| echo | |
| sudo apt-get remove -y '^llvm-.*|^libllvm.*' || true | |
| sudo apt-get remove --auto-remove android-sdk-platform-tools || true | |
| sudo apt-get purge --auto-remove android-sdk-platform-tools || true | |
| sudo rm -rf /usr/local/lib/android | |
| sudo apt-get remove -y '^dotnet-.*|^aspnetcore-.*' || true | |
| sudo rm -rf /usr/share/dotnet | |
| sudo apt-get remove -y '^mono-.*' || true | |
| sudo apt-get remove -y '^ghc-.*' || true | |
| sudo apt-get remove -y '.*jdk.*|.*jre.*' || true | |
| sudo apt-get remove -y 'php.*' || true | |
| sudo apt-get remove -y hhvm || true | |
| sudo apt-get remove -y powershell || true | |
| sudo apt-get remove -y firefox || true | |
| sudo apt-get remove -y monodoc-manual || true | |
| sudo apt-get remove -y msbuild || true | |
| sudo apt-get remove -y microsoft-edge-stable || true | |
| sudo apt-get remove -y '^google-.*' || true | |
| sudo apt-get remove -y azure-cli || true | |
| sudo apt-get remove -y '^mongo.*-.*|^postgresql-.*|^mysql-.*|^mssql-.*' || true | |
| sudo apt-get remove -y '^gfortran-.*' || true | |
| sudo apt-get remove -y '^gcc-*' || true | |
| sudo apt-get remove -y '^g++-*' || true | |
| sudo apt-get remove -y '^cpp-*' || true | |
| sudo apt-get autoremove -y | |
| sudo apt-get clean | |
| echo | |
| echo "Listing top largest packages" | |
| pkgs=$(dpkg-query -Wf '${Installed-Size}\t${Package}\t${Status}\n' | awk '$NF == "installed"{print $1 "\t" $2}' | sort -nr) | |
| head -n 30 <<< "${pkgs}" | |
| echo | |
| sudo rm -rfv build || true | |
| df -h | |
| - name: Set up Docker Buildx | |
| if: ${{ steps.cache.outputs.cache_available == 'false' || steps.changed-files.outputs.nvidia_any_changed == 'true' }} | |
| id: buildx | |
| uses: docker/setup-buildx-action@master | |
| - name: Block all traffic to metadata ip # For cloud runners, the metadata ip can interact with our test machines | |
| if: ${{ steps.cache.outputs.cache_available == 'false' || steps.changed-files.outputs.nvidia_any_changed == 'true' }} | |
| run: | | |
| sudo iptables -I INPUT -s 169.254.169.254 -j DROP | |
| sudo iptables -I OUTPUT -d 169.254.169.254 -j DROP | |
| - name: Login to Quay Registry | |
| if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' && (steps.cache.outputs.cache_available == 'false' || steps.changed-files.outputs.nvidia_any_changed == 'true') }} | |
| run: echo ${{ secrets.QUAY_PASSWORD }} | docker login -u ${{ secrets.QUAY_USERNAME }} --password-stdin quay.io | |
| - name: Build 🔧 & Push 🚀 | |
| if: ${{ steps.cache.outputs.cache_available == 'false' || steps.changed-files.outputs.nvidia_any_changed == 'true' }} | |
| run: | | |
| export IMAGE=quay.io/kairos/cache:nvidia-base | |
| docker build --platform=linux/arm64 -t $IMAGE -f ./images/Dockerfile.nvidia ./images | |
| docker push $IMAGE | |
| nvidia-arm-core: | |
| uses: ./.github/workflows/reusable-docker-arm-build.yaml | |
| needs: build-nvidia-base | |
| secrets: inherit | |
| with: | |
| flavor: ubuntu | |
| flavor_release: "20.04" | |
| family: ubuntu | |
| base_image: quay.io/kairos/cache:nvidia-base | |
| model: nvidia-jetson-agx-orin | |
| worker: fast | |
| build-arm-core: | |
| uses: ./.github/workflows/reusable-docker-arm-build.yaml | |
| secrets: inherit | |
| with: | |
| flavor: ${{ matrix.flavor }} | |
| flavor_release: ${{ matrix.flavorRelease }} | |
| family: ${{ matrix.family }} | |
| model: ${{ matrix.model }} | |
| base_image: ${{ matrix.baseImage }} | |
| worker: ${{ matrix.worker }} | |
| needs: | |
| - get-core-matrix | |
| strategy: | |
| fail-fast: false | |
| matrix: ${{fromJson(needs.get-core-matrix.outputs.matrix)}} | |
| image_and_iso_arm64_generic: | |
| uses: ./.github/workflows/reusable-image-and-iso-arm-generic.yaml | |
| secrets: inherit | |
| with: | |
| flavor: "opensuse" | |
| flavor_release: "leap-15.5" | |
| family: opensuse | |
| base_image: opensuse/leap:15.5 | |
| variant: core | |
| notify: | |
| runs-on: ubuntu-latest | |
| if: failure() | |
| needs: | |
| - build-arm-core | |
| - image_and_iso_arm64_generic | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - run: | | |
| git fetch --prune --unshallow | |
| - name: save commit-message | |
| if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }} && failure() | |
| run: echo "COMMIT_MSG=$(git log -1 --pretty=format:%s)" >> $GITHUB_ENV | |
| - name: notify if failure | |
| if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }} && failure() | |
| uses: slackapi/slack-github-action@v1.26.0 | |
| env: | |
| SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} | |
| SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK | |
| with: | |
| payload: | | |
| { | |
| "blocks": [ | |
| { | |
| "type": "section", | |
| "text": { | |
| "type": "mrkdwn", | |
| "text": "Job failure on master branch for job ${{ github.job }} in workflow \"${{ github.workflow }}\"\n\nCommit message is \"${{ env.COMMIT_MSG }}\"\n\n Commit sha is <https://github.com/${{ github.repository }}/commit/${{ github.sha }}|${{ github.sha }}>" | |
| } | |
| }, | |
| { | |
| "type": "divider" | |
| }, | |
| { | |
| "type": "actions", | |
| "elements": [ | |
| { | |
| "type": "button", | |
| "text": { | |
| "type": "plain_text", | |
| "text": ":thisisfine: Failed Run", | |
| "emoji": true | |
| }, | |
| "url": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" | |
| }, | |
| { | |
| "type": "button", | |
| "text": { | |
| "type": "plain_text", | |
| "text": ":kairos: Repository link", | |
| "emoji": true | |
| }, | |
| "url": "https://github.com/${{ github.repository }}" | |
| } | |
| ] | |
| } | |
| ] | |
| } |