-
Notifications
You must be signed in to change notification settings - Fork 5
51 lines (50 loc) · 1.67 KB
/
build.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
---
name: Build Container
permissions: read-all
on:
push:
branches:
- main
jobs:
container-build:
permissions:
packages: write
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: docker/login-action@v3
with:
registry: ghcr.io/${{ github.repository_owner }}/${{ github.repository }}
username: ${{ github.actor }}
password: ${{ github.token }}
- uses: docker/metadata-action@v5
id: meta
with:
images: ghcr.io/${{ github.repository_owner }}/${{ github.repository }}
- uses: docker/build-push-action@v5
with:
context: .
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
container-scan:
needs: [container-build]
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
runs-on: ubuntu-latest
steps:
- uses: docker/login-action@v3
with:
registry: ghcr.io/${{ github.repository_owner }}/${{ github.repository }}
username: ${{ github.actor }}
password: ${{ github.token }}
- uses: aquasecurity/trivy-action@0.21.0
with:
image-ref: ghcr.io/${{ github.repository_owner }}/${{ github.repository }}:main
format: sarif
output: trivy-results-main.sarif
- uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: trivy-results-main.sarif