feat(stuff): Added Readme.md, changed tagging system, added ng-cli 17 #23
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: CI Bmeme NG-CLI container images | |
| on: | |
| push: | |
| branches: | |
| - "*" | |
| - "*/*" | |
| - "**" | |
| - "!main" | |
| env: | |
| registry: docker.io | |
| repository: bmeme/ng-cli | |
| jobs: | |
| configure: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| matrix: ${{ steps.set-matrix.outputs.matrix }} | |
| steps: | |
| - | |
| name: Checkout to repository | |
| uses: actions/checkout@v3 | |
| - | |
| name: Set matrix data | |
| id: set-matrix | |
| run: echo "matrix=$(jq -c . < ./config.json)" >> $GITHUB_OUTPUT | |
| build: | |
| name: Build and test Bmeme NG-CLI container images using Docker | |
| runs-on: ubuntu-latest | |
| needs: configure | |
| strategy: | |
| matrix: ${{ fromJson(needs.configure.outputs.matrix) }} | |
| steps: | |
| - | |
| name: Check out the codebase. | |
| uses: actions/checkout@v3 | |
| - | |
| name: Login to Docker Hub | |
| uses: docker/login-action@v3 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - | |
| name: Lint Dockerfile | |
| id: lint | |
| uses: hadolint/hadolint-action@v3.1.0 | |
| with: | |
| dockerfile: ./Dockerfile | |
| config: .hadolint.yaml | |
| - | |
| name: Build images | |
| id: build | |
| env: | |
| NG_CLI_MAJOR_VERSION: ${{ matrix.ng_cli_major_version }} | |
| NODE_MAJOR_VERSION: ${{ matrix.node_major_version }} | |
| PRETTY_TAG: ${{ matrix.name }} | |
| run: | | |
| { | |
| docker build \ | |
| --build-arg NODE_MAJOR_VERSION=${NODE_MAJOR_VERSION} \ | |
| --build-arg NG_CLI_MAJOR_VERSION=${NG_CLI_MAJOR_VERSION} \ | |
| -t ${{ env.registry}}/${{ env.repository }}:${PRETTY_TAG} \ | |
| -f ./Dockerfile .; | |
| } | |
| - | |
| name: Get NG_CLI_VERSION value | |
| id: get-versions | |
| env: | |
| PRETTY_TAG: ${{ matrix.name }} | |
| run: | | |
| { | |
| echo "ng_cli_version=$(docker run --rm ${{ env.registry}}/${{ env.repository }}:${PRETTY_TAG} /bin/bash -c \ | |
| 'cat /home/node/.ng_cli_version')" >> "$GITHUB_OUTPUT"; \ | |
| echo "node_version=$(docker run --rm ${{ env.registry}}/${{ env.repository }}:${PRETTY_TAG} /bin/bash -c \ | |
| 'cat /home/node/.node_version')" >> "$GITHUB_OUTPUT"; \ | |
| } | |
| - | |
| name: Tag images | |
| id: tag | |
| env: | |
| NODE_VERSION: ${{ steps.get-versions.outputs.ng_cli_version }} | |
| PRETTY_TAG: ${{ matrix.name }} | |
| NG_CLI_VERSION: ${{ steps.get-versions.outputs.node_version }} | |
| run: | | |
| { | |
| docker tag ${{ env.registry}}/${{ env.repository }}:${PRETTY_TAG} \ | |
| ${{ env.registry}}/${{ env.repository }}:${NG_CLI_VERSION}-${NODE_VERSION}; \ | |
| if ${{ matrix.latest }}; then | |
| docker tag ${{ env.registry}}/${{ env.repository }}:${PRETTY_TAG} ${{ env.registry}}/${{ env.repository }}:latest; \ | |
| fi | |
| } | |
| - | |
| name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@master | |
| id: trivy | |
| with: | |
| image-ref: ${{ env.registry }}/${{ env.repository }}:${{ matrix.name }} | |
| format: 'sarif' | |
| exit-code: '0' | |
| ignore-unfixed: true | |
| vuln-type: 'os,library' | |
| severity: 'CRITICAL' | |
| output: 'trivy-results-${{ matrix.name }}.sarif' | |
| - | |
| name: Upload Trivy scan results to GitHub Security tab | |
| id: trivy-upload | |
| uses: github/codeql-action/upload-sarif@v2 | |
| with: | |
| sarif_file: 'trivy-results-${{ matrix.name }}.sarif' | |
| - | |
| name: Scan image | |
| id: scan | |
| uses: anchore/scan-action@v3 | |
| with: | |
| image: ${{ env.registry }}/${{ env.repository }}:${{ matrix.name }} | |
| severity-cutoff: critical | |
| fail-build: false | |
| - | |
| name: upload Anchore scan SARIF report | |
| id: scan-upload | |
| uses: github/codeql-action/upload-sarif@v2 | |
| with: | |
| sarif_file: ${{ steps.scan.outputs.sarif }} |