First Import #5
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI Bmeme Mule Standalone container images | |
| on: | |
| push: | |
| branches: | |
| - "*" | |
| - "*/*" | |
| - "**" | |
| - "!main" | |
| env: | |
| registry: docker.io | |
| repository: bmeme/mule-standalone | |
| jobs: | |
| configure: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| matrix: ${{ steps.set-matrix.outputs.matrix }} | |
| steps: | |
| - | |
| name: Checkout to repository | |
| uses: actions/checkout@v3 | |
| - | |
| name: Set matrix data | |
| id: set-matrix | |
| run: echo "matrix=$(jq -c . < ./config.json)" >> $GITHUB_OUTPUT | |
| build: | |
| name: Build and test Bmeme Mule Standalone container images using Docker | |
| runs-on: ubuntu-latest | |
| needs: configure | |
| strategy: | |
| matrix: ${{ fromJson(needs.configure.outputs.matrix) }} | |
| env: | |
| dockerfile: ${{ matrix.mule_version }}/${{ matrix.java_version }}/Dockerfile | |
| main_tag: ${{ matrix.name }} | |
| steps: | |
| - | |
| name: Check out the codebase. | |
| uses: actions/checkout@v3 | |
| - | |
| name: Login to Docker Hub | |
| uses: docker/login-action@v3 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - | |
| name: Lint Dockerfile | |
| id: lint | |
| uses: hadolint/hadolint-action@v3.1.0 | |
| with: | |
| dockerfile: ${{ env.dockerfile }} | |
| config: .hadolint.yaml | |
| - | |
| name: Build images | |
| id: build | |
| run: | | |
| { | |
| docker build \ | |
| -t ${{ env.registry }}/${{ env.repository }}:${{ env.main_tag }} \ | |
| -f ${{ env.dockerfile }} .; \ | |
| if ${{ matrix.latest }}; then | |
| docker build -t ${{ env.registry }}/${{ env.repository }}:latest \ | |
| -f ${{ env.dockerfile }} .; \ | |
| fi | |
| } | |
| - | |
| name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@master | |
| id: trivy | |
| with: | |
| image-ref: ${{ env.registry }}/${{ env.repository }}:${{ matrix.name }} | |
| format: 'sarif' | |
| exit-code: '0' | |
| ignore-unfixed: true | |
| vuln-type: 'os,library' | |
| severity: 'CRITICAL' | |
| output: 'trivy-results-${{ matrix.name }}.sarif' | |
| - | |
| name: Upload Trivy scan results to GitHub Security tab | |
| id: trivy-upload | |
| uses: github/codeql-action/upload-sarif@v2 | |
| with: | |
| sarif_file: 'trivy-results-${{ matrix.name }}.sarif' | |
| - | |
| name: Scan image | |
| id: scan | |
| uses: anchore/scan-action@v3 | |
| with: | |
| image: ${{ env.registry }}/${{ env.repository }}:${{ matrix.name }} | |
| severity-cutoff: critical | |
| fail-build: false | |
| - | |
| name: upload Anchore scan SARIF report | |
| id: scan-upload | |
| uses: github/codeql-action/upload-sarif@v2 | |
| with: | |
| sarif_file: ${{ steps.scan.outputs.sarif }} |