build-and-publish-secdb.yaml

name: Build and publish secdb

on:
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build-publish:
    name: Build and publish security database
    runs-on: ubuntu-latest
    if: github.repository == 'wolfi-dev/advisories'

    permissions:
      id-token: write
      contents: read

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
        with:
          egress-policy: audit

      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4

      # this need to point to main to always get the latest action
      - uses: wolfi-dev/actions/build-and-publish-secdb@main # main
        with:
          workload_identity_provider: "projects/618116202522/locations/global/workloadIdentityPools/prod-shared-e350/providers/prod-shared-gha"
          service_account: "prod-images-ci@prod-images-c6e5.iam.gserviceaccount.com"
          gcp_project_id: prod-images-c6e5
          wolfictl_args: "advisory secdb --advisories-repo-dir . --arch x86_64 --arch aarch64 -o security.json"
          gcs_apk_bucket_name: wolfi-production-registry-destination
          gcs_apk_directory_name: os

      - name: Post failure notice to Slack
        uses: rtCamp/action-slack-notify@4e5fb42d249be6a45a298f3c9543b111b02f7907 # ratchet:rtCamp/action-slack-notify@v2.3.0
        if: ${{ failure() }}
        env:
          SLACK_ICON: http://github.com/chainguard-dev.png?size=48
          SLACK_USERNAME: guardian
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_URL }}
          SLACK_CHANNEL: 'eng-squad-lifecycle-alerts'
          SLACK_COLOR: '#8E1600'
          MSG_MINIMAL: 'true'
          SLACK_TITLE: Build/Publish SecDB for ${{ github.repository }} failed!
          SLACK_MESSAGE: |
            For detailed logs: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}