first_import #9
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: CI Bmeme NG-CLI container images | |
| on: | |
| push: | |
| branches: | |
| - "*" | |
| - "*/*" | |
| - "**" | |
| - "!main" | |
| env: | |
| registry: docker.io | |
| repository: bmeme/ng-cli | |
| jobs: | |
| configure: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| matrix: ${{ steps.set-matrix.outputs.matrix }} | |
| steps: | |
| - | |
| name: Checkout to repository | |
| uses: actions/checkout@v3 | |
| - | |
| name: Set matrix data | |
| id: set-matrix | |
| run: echo "matrix=$(jq -c . < ./config.json)" >> $GITHUB_OUTPUT | |
| build: | |
| name: Build and test Bmeme NG-CLI container images using Docker | |
| runs-on: ubuntu-latest | |
| needs: configure | |
| strategy: | |
| matrix: ${{ fromJson(needs.configure.outputs.matrix) }} | |
| steps: | |
| - | |
| name: Check out the codebase. | |
| uses: actions/checkout@v3 | |
| - | |
| name: Login to Docker Hub | |
| uses: docker/login-action@v3 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - | |
| name: Lint Dockerfile | |
| id: lint | |
| uses: hadolint/hadolint-action@v3.1.0 | |
| with: | |
| dockerfile: ./Dockerfile | |
| config: .hadolint.yaml | |
| - | |
| name: Build images | |
| id: build | |
| env: | |
| NG_CLI_VERSION: ${{ matrix.ng_cli_version }} | |
| NODE_VERSION: ${{ matrix.node_version }} | |
| PRETTY_TAG: ${{ matrix.name }} | |
| run: | | |
| { | |
| docker build \ | |
| --build-arg NODE_VERSION=${NODE_VERSION} \ | |
| --build-arg NG_CLI_VERSION=${NG_CLI_VERSION} \ | |
| -t ${{ env.registry}}/${{ env.repository }}:${PRETTY_TAG} \ | |
| -f ./Dockerfile .; \ | |
| export MAIN_TAG=$(docker run --rm ${{ env.registry}}/${{ env.repository }}:${PRETTY_TAG} /bin/bash -c \ | |
| "cat /home/node/.ng_cli_version"); \ | |
| docker tag ${{ env.registry}}/${{ env.repository }}:${PRETTY_TAG} ${{ env.registry}}/${{ env.repository }}:${MAIN_TAG}-${NODE_VERSION}; \ | |
| docker images | grep ng; \ | |
| if ${{ matrix.latest }}; then | |
| docker tag ${{ env.registry}}/${{ env.repository }}:${PRETTY_TAG} ${{ env.registry}}/${{ env.repository }}:latest \ | |
| fi | |
| } | |
| # - | |
| # name: Run Trivy vulnerability scanner | |
| # uses: aquasecurity/trivy-action@master | |
| # id: trivy | |
| # with: | |
| # image-ref: ${{ env.registry }}/${{ env.repository }}:${{ matrix.name }} | |
| # format: 'sarif' | |
| # exit-code: '0' | |
| # ignore-unfixed: true | |
| # vuln-type: 'os,library' | |
| # severity: 'CRITICAL' | |
| # output: 'trivy-results-${{ matrix.name }}.sarif' | |
| # - | |
| # name: Upload Trivy scan results to GitHub Security tab | |
| # id: trivy-upload | |
| # uses: github/codeql-action/upload-sarif@v2 | |
| # with: | |
| # sarif_file: 'trivy-results-${{ matrix.name }}.sarif' | |
| # - | |
| # name: Scan image | |
| # id: scan | |
| # uses: anchore/scan-action@v3 | |
| # with: | |
| # image: ${{ env.registry }}/${{ env.repository }}:${{ matrix.name }} | |
| # severity-cutoff: critical | |
| # fail-build: false | |
| # - | |
| # name: upload Anchore scan SARIF report | |
| # id: scan-upload | |
| # uses: github/codeql-action/upload-sarif@v2 | |
| # with: | |
| # sarif_file: ${{ steps.scan.outputs.sarif }} |