Skip to content

Commit 1069b51

Browse files
mmguerommguero
committed
testing cisagov#717, refactoring github build workflows
1 parent cc500ab commit 1069b51

20 files changed

+81
-1877
lines changed

‎.github/workflows/dashboards-helper-build-and-push-ghcr.yml‎

Lines changed: 4 additions & 104 deletions
Original file line numberDiff line numberDiff line change
@@ -26,107 +26,7 @@ on:
2626

2727
jobs:
2828
docker:
29-
runs-on: ${{ matrix.os }}
30-
permissions:
31-
actions: write
32-
packages: write
33-
contents: read
34-
security-events: write
35-
strategy:
36-
fail-fast: false
37-
matrix:
38-
include:
39-
- os: ubuntu-24.04
40-
arch: amd64
41-
platform: linux/amd64
42-
- os: ubuntu-24.04-arm
43-
arch: arm64
44-
platform: linux/arm64
45-
steps:
46-
-
47-
name: Cancel previous run in progress
48-
uses: styfle/cancel-workflow-action@0.12.1
49-
with:
50-
ignore_sha: true
51-
all_but_latest: true
52-
access_token: ${{ secrets.GITHUB_TOKEN }}
53-
-
54-
name: Checkout
55-
uses: actions/checkout@v4
56-
-
57-
name: Generate build timestamp
58-
shell: bash
59-
run: echo "btimestamp=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
60-
id: generate_build_timestamp
61-
-
62-
name: Extract branch name
63-
shell: bash
64-
run: echo "branch=$(echo ${GITHUB_REF#refs/heads/})" >> $GITHUB_OUTPUT
65-
id: extract_branch
66-
-
67-
name: Generate arch tag suffix
68-
shell: bash
69-
run: echo "archtag=$([[ "${{ matrix.platform }}" == 'linux/amd64' ]] && echo '' || ( echo -n '-' ; echo "${{ matrix.platform }}" | cut -d '/' -f 2) )" >> $GITHUB_OUTPUT
70-
id: arch_tag_suffix
71-
-
72-
name: Extract commit SHA
73-
shell: bash
74-
run: echo "sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
75-
id: extract_commit_sha
76-
-
77-
name: Extract Malcolm version
78-
shell: bash
79-
run: echo "mversion=$(grep -P "^\s+image:.*/malcolm/" docker-compose-dev.yml | awk '{print $2}' | cut -d':' -f2 | uniq -c | sort -nr | awk '{print $2}' | head -n 1)" >> $GITHUB_OUTPUT
80-
id: extract_malcolm_version
81-
-
82-
name: Set up Docker Buildx
83-
uses: docker/setup-buildx-action@v3
84-
with:
85-
driver-opts: |
86-
image=moby/buildkit:master
87-
-
88-
name: Log in to registry
89-
uses: docker/login-action@v3
90-
with:
91-
registry: ghcr.io
92-
username: ${{ github.repository_owner }}
93-
password: ${{ secrets.GITHUB_TOKEN }}
94-
-
95-
name: Build and push
96-
uses: docker/build-push-action@v6
97-
with:
98-
context: .
99-
file: ./Dockerfiles/dashboards-helper.Dockerfile
100-
build-args: |
101-
TARGETPLATFORM=${{ matrix.platform }}
102-
MALCOLM_VERSION=${{ steps.extract_malcolm_version.outputs.mversion }}
103-
BUILD_DATE=${{ steps.generate_build_timestamp.outputs.btimestamp }}
104-
VCS_REVISION=${{ steps.extract_commit_sha.outputs.sha }}
105-
push: true
106-
provenance: false
107-
platforms: ${{ matrix.platform }}
108-
tags: ghcr.io/${{ github.repository_owner }}/malcolm/dashboards-helper:${{ steps.extract_branch.outputs.branch }}${{ steps.arch_tag_suffix.outputs.archtag }}
109-
-
110-
name: Run Trivy vulnerability scanner
111-
if: ${{ matrix.platform == 'linux/amd64' }}
112-
id: trivy-scan
113-
uses: aquasecurity/trivy-action@0.29.0
114-
env:
115-
TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db
116-
with:
117-
scan-type: 'image'
118-
scanners: 'vuln'
119-
image-ref: ghcr.io/${{ github.repository_owner }}/malcolm/dashboards-helper:${{ steps.extract_branch.outputs.branch }}${{ steps.arch_tag_suffix.outputs.archtag }}
120-
format: 'sarif'
121-
output: 'trivy-results.sarif'
122-
severity: 'HIGH,CRITICAL'
123-
vuln-type: 'os,library'
124-
hide-progress: true
125-
ignore-unfixed: true
126-
exit-code: '0'
127-
-
128-
name: Upload Trivy scan results to GitHub Security tab
129-
if: ${{ matrix.platform == 'linux/amd64' }}
130-
uses: github/codeql-action/upload-sarif@v3
131-
with:
132-
sarif_file: 'trivy-results.sarif'
29+
uses: ./.github/workflows/docker-build-push-scan.yml
30+
with:
31+
service: dashboards-helper
32+
dockerfile: ./Dockerfiles/dashboards-helper.Dockerfile

‎.github/workflows/dirinit-build-and-push-ghcr.yml‎

Lines changed: 4 additions & 104 deletions
Original file line numberDiff line numberDiff line change
@@ -14,107 +14,7 @@ on:
1414

1515
jobs:
1616
docker:
17-
runs-on: ${{ matrix.os }}
18-
permissions:
19-
actions: write
20-
packages: write
21-
contents: read
22-
security-events: write
23-
strategy:
24-
fail-fast: false
25-
matrix:
26-
include:
27-
- os: ubuntu-24.04
28-
arch: amd64
29-
platform: linux/amd64
30-
- os: ubuntu-24.04-arm
31-
arch: arm64
32-
platform: linux/arm64
33-
steps:
34-
-
35-
name: Cancel previous run in progress
36-
uses: styfle/cancel-workflow-action@0.12.1
37-
with:
38-
ignore_sha: true
39-
all_but_latest: true
40-
access_token: ${{ secrets.GITHUB_TOKEN }}
41-
-
42-
name: Checkout
43-
uses: actions/checkout@v4
44-
-
45-
name: Generate build timestamp
46-
shell: bash
47-
run: echo "btimestamp=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
48-
id: generate_build_timestamp
49-
-
50-
name: Extract branch name
51-
shell: bash
52-
run: echo "branch=$(echo ${GITHUB_REF#refs/heads/})" >> $GITHUB_OUTPUT
53-
id: extract_branch
54-
-
55-
name: Generate arch tag suffix
56-
shell: bash
57-
run: echo "archtag=$([[ "${{ matrix.platform }}" == 'linux/amd64' ]] && echo '' || ( echo -n '-' ; echo "${{ matrix.platform }}" | cut -d '/' -f 2) )" >> $GITHUB_OUTPUT
58-
id: arch_tag_suffix
59-
-
60-
name: Extract commit SHA
61-
shell: bash
62-
run: echo "sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
63-
id: extract_commit_sha
64-
-
65-
name: Extract Malcolm version
66-
shell: bash
67-
run: echo "mversion=$(grep -P "^\s+image:.*/malcolm/" docker-compose-dev.yml | awk '{print $2}' | cut -d':' -f2 | uniq -c | sort -nr | awk '{print $2}' | head -n 1)" >> $GITHUB_OUTPUT
68-
id: extract_malcolm_version
69-
-
70-
name: Set up Docker Buildx
71-
uses: docker/setup-buildx-action@v3
72-
with:
73-
driver-opts: |
74-
image=moby/buildkit:master
75-
-
76-
name: Log in to registry
77-
uses: docker/login-action@v3
78-
with:
79-
registry: ghcr.io
80-
username: ${{ github.repository_owner }}
81-
password: ${{ secrets.GITHUB_TOKEN }}
82-
-
83-
name: Build and push
84-
uses: docker/build-push-action@v6
85-
with:
86-
context: .
87-
file: ./Dockerfiles/dirinit.Dockerfile
88-
build-args: |
89-
TARGETPLATFORM=${{ matrix.platform }}
90-
MALCOLM_VERSION=${{ steps.extract_malcolm_version.outputs.mversion }}
91-
BUILD_DATE=${{ steps.generate_build_timestamp.outputs.btimestamp }}
92-
VCS_REVISION=${{ steps.extract_commit_sha.outputs.sha }}
93-
push: true
94-
provenance: false
95-
platforms: ${{ matrix.platform }}
96-
tags: ghcr.io/${{ github.repository_owner }}/malcolm/dirinit:${{ steps.extract_branch.outputs.branch }}${{ steps.arch_tag_suffix.outputs.archtag }}
97-
-
98-
name: Run Trivy vulnerability scanner
99-
if: ${{ matrix.platform == 'linux/amd64' }}
100-
id: trivy-scan
101-
uses: aquasecurity/trivy-action@0.29.0
102-
env:
103-
TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db
104-
with:
105-
scan-type: 'image'
106-
scanners: 'vuln'
107-
image-ref: ghcr.io/${{ github.repository_owner }}/malcolm/dirinit:${{ steps.extract_branch.outputs.branch }}${{ steps.arch_tag_suffix.outputs.archtag }}
108-
format: 'sarif'
109-
output: 'trivy-results.sarif'
110-
severity: 'HIGH,CRITICAL'
111-
vuln-type: 'os,library'
112-
hide-progress: true
113-
ignore-unfixed: true
114-
exit-code: '0'
115-
-
116-
name: Upload Trivy scan results to GitHub Security tab
117-
if: ${{ matrix.platform == 'linux/amd64' }}
118-
uses: github/codeql-action/upload-sarif@v3
119-
with:
120-
sarif_file: 'trivy-results.sarif'
17+
uses: ./.github/workflows/docker-build-push-scan.yml
18+
with:
19+
service: dirinit
20+
dockerfile: ./Dockerfiles/dirinit.Dockerfile

‎.github/workflows/docker-build-push-scan.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@ on:
1717
required: false
1818
maxmind_alternate_url:
1919
required: false
20+
zeek_deb_alternate_download_url:
21+
required: false
2022

2123
jobs:
2224
docker:
@@ -97,8 +99,10 @@ jobs:
9799
MALCOLM_VERSION=${{ steps.extract_malcolm_version.outputs.mversion }}
98100
BUILD_DATE=${{ steps.generate_build_timestamp.outputs.btimestamp }}
99101
VCS_REVISION=${{ steps.extract_commit_sha.outputs.sha }}
102+
GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
100103
${{ secrets.maxmind_license_key && format('MAXMIND_GEOIP_DB_LICENSE_KEY={0}', secrets.maxmind_license_key) || '' }}
101104
${{ secrets.maxmind_alternate_url && format('MAXMIND_GEOIP_DB_ALTERNATE_DOWNLOAD_URL={0}', secrets.maxmind_alternate_url) || '' }}
105+
${{ secrets.zeek_deb_alternate_download_url && format('ZEEK_DEB_ALTERNATE_DOWNLOAD_URL={0}', secrets.zeek_deb_alternate_download_url) || '' }}
102106
${{ inputs.extra_build_args || '' }}
103107
push: true
104108
provenance: false

‎.github/workflows/file-monitor-build-and-push-ghcr.yml‎

Lines changed: 4 additions & 104 deletions
Original file line numberDiff line numberDiff line change
@@ -22,107 +22,7 @@ on:
2222

2323
jobs:
2424
docker:
25-
runs-on: ${{ matrix.os }}
26-
permissions:
27-
actions: write
28-
packages: write
29-
contents: read
30-
security-events: write
31-
strategy:
32-
fail-fast: false
33-
matrix:
34-
include:
35-
- os: ubuntu-24.04
36-
arch: amd64
37-
platform: linux/amd64
38-
- os: ubuntu-24.04-arm
39-
arch: arm64
40-
platform: linux/arm64
41-
steps:
42-
-
43-
name: Cancel previous run in progress
44-
uses: styfle/cancel-workflow-action@0.12.1
45-
with:
46-
ignore_sha: true
47-
all_but_latest: true
48-
access_token: ${{ secrets.GITHUB_TOKEN }}
49-
-
50-
name: Checkout
51-
uses: actions/checkout@v4
52-
-
53-
name: Generate build timestamp
54-
shell: bash
55-
run: echo "btimestamp=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
56-
id: generate_build_timestamp
57-
-
58-
name: Extract branch name
59-
shell: bash
60-
run: echo "branch=$(echo ${GITHUB_REF#refs/heads/})" >> $GITHUB_OUTPUT
61-
id: extract_branch
62-
-
63-
name: Generate arch tag suffix
64-
shell: bash
65-
run: echo "archtag=$([[ "${{ matrix.platform }}" == 'linux/amd64' ]] && echo '' || ( echo -n '-' ; echo "${{ matrix.platform }}" | cut -d '/' -f 2) )" >> $GITHUB_OUTPUT
66-
id: arch_tag_suffix
67-
-
68-
name: Extract commit SHA
69-
shell: bash
70-
run: echo "sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
71-
id: extract_commit_sha
72-
-
73-
name: Extract Malcolm version
74-
shell: bash
75-
run: echo "mversion=$(grep -P "^\s+image:.*/malcolm/" docker-compose-dev.yml | awk '{print $2}' | cut -d':' -f2 | uniq -c | sort -nr | awk '{print $2}' | head -n 1)" >> $GITHUB_OUTPUT
76-
id: extract_malcolm_version
77-
-
78-
name: Set up Docker Buildx
79-
uses: docker/setup-buildx-action@v3
80-
with:
81-
driver-opts: |
82-
image=moby/buildkit:master
83-
-
84-
name: Log in to registry
85-
uses: docker/login-action@v3
86-
with:
87-
registry: ghcr.io
88-
username: ${{ github.repository_owner }}
89-
password: ${{ secrets.GITHUB_TOKEN }}
90-
-
91-
name: Build and push
92-
uses: docker/build-push-action@v6
93-
with:
94-
context: .
95-
file: ./Dockerfiles/file-monitor.Dockerfile
96-
build-args: |
97-
TARGETPLATFORM=${{ matrix.platform }}
98-
MALCOLM_VERSION=${{ steps.extract_malcolm_version.outputs.mversion }}
99-
BUILD_DATE=${{ steps.generate_build_timestamp.outputs.btimestamp }}
100-
VCS_REVISION=${{ steps.extract_commit_sha.outputs.sha }}
101-
push: true
102-
provenance: false
103-
platforms: ${{ matrix.platform }}
104-
tags: ghcr.io/${{ github.repository_owner }}/malcolm/file-monitor:${{ steps.extract_branch.outputs.branch }}${{ steps.arch_tag_suffix.outputs.archtag }}
105-
-
106-
name: Run Trivy vulnerability scanner
107-
if: ${{ matrix.platform == 'linux/amd64' }}
108-
id: trivy-scan
109-
uses: aquasecurity/trivy-action@0.29.0
110-
env:
111-
TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db
112-
with:
113-
scan-type: 'image'
114-
scanners: 'vuln'
115-
image-ref: ghcr.io/${{ github.repository_owner }}/malcolm/file-monitor:${{ steps.extract_branch.outputs.branch }}${{ steps.arch_tag_suffix.outputs.archtag }}
116-
format: 'sarif'
117-
output: 'trivy-results.sarif'
118-
severity: 'HIGH,CRITICAL'
119-
vuln-type: 'os,library'
120-
hide-progress: true
121-
ignore-unfixed: true
122-
exit-code: '0'
123-
-
124-
name: Upload Trivy scan results to GitHub Security tab
125-
if: ${{ matrix.platform == 'linux/amd64' }}
126-
uses: github/codeql-action/upload-sarif@v3
127-
with:
128-
sarif_file: 'trivy-results.sarif'
25+
uses: ./.github/workflows/docker-build-push-scan.yml
26+
with:
27+
service: file-monitor
28+
dockerfile: ./Dockerfiles/file-monitor.Dockerfile

0 commit comments

Comments
 (0)