-
-
Notifications
You must be signed in to change notification settings - Fork 10
90 lines (79 loc) · 2.38 KB
/
ci.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
---
name: CI🚦
on:
pull_request:
branches:
- main
workflow_dispatch:
jobs:
setup-matrix:
runs-on: ubuntu-latest
outputs:
matrix: ${{ steps.set-matrix.outputs.matrix }}
steps:
- name: Source checkout
uses: actions/checkout@v4
- id: set-matrix
run: echo "matrix=$(jq -c . build_versions.json)" >> $GITHUB_OUTPUT
general_ci:
uses: voxpupuli/crafty/.github/workflows/general_ci.yaml@main
with:
shellcheck_scan_dir: './puppetdb'
build_test_container:
name: 'Build test container'
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
pull-requests: write
needs: setup-matrix
strategy:
matrix: ${{ fromJson(needs.setup-matrix.outputs.matrix) }}
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Build image
uses: docker/build-push-action@v6
with:
tags: 'ci/puppetdb:${{ matrix.version }}'
context: puppetdb
push: false
build-args: |
PUPPET_RELEASE=${{ matrix.release }}
PUPPETDB_VERSION=${{ matrix.version }}
- name: Login to Docker Hub
uses: docker/login-action@v3
with:
username: voxpupulibot
password: ${{ secrets.DOCKERHUB_BOT_PASSWORD }}
- name: Analyze container image for CVEs
id: analyze-image-cves
uses: docker/scout-action@v1
with:
command: cves
image: 'local://ci/puppetdb:${{ matrix.version }}'
sarif-file: sarif.output.${{ matrix.version }}.${{ github.sha }}.json
write-comment: false
- name: Compare container image to latest from Registry
id: compare-image
uses: docker/scout-action@v1
with:
command: compare
image: 'local://ci/puppetdb:${{ matrix.version }}'
to: 'ghcr.io/voxpupuli/puppetdb:${{ matrix.version }}-latest'
summary: true
keep-previous-comments: true
- name: Upload SARIF result
id: upload-sarif
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: sarif.output.${{ matrix.version }}.${{ github.sha }}.json
tests:
needs:
- general_ci
- build_test_container
runs-on: ubuntu-latest
name: Test suite
steps:
- run: echo Test suite completed