build(deps): bump github.com/google/go-containerregistry from 0.19.2 to 0.20.0 #2224
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| push: | |
| branches: [ "main" ] | |
| pull_request: | |
| branches: [ "main" ] | |
| jobs: | |
| build-melange: | |
| name: Build melange and add to artifact cache | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
| - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1 | |
| with: | |
| go-version-file: './go.mod' | |
| check-latest: true | |
| - name: build | |
| run: | | |
| make melange | |
| - uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4 | |
| with: | |
| name: melange-${{ github.run_id }} | |
| path: ${{ github.workspace }}/melange | |
| retention-days: 1 | |
| build-packages: | |
| name: Build packages | |
| needs: | |
| - build-melange | |
| # TODO: Set up a larger runner for this. | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| # This is a list of packages which covers basic and exotic uses of | |
| # the built-in pipelines. Goal is to balance efficiency while also | |
| # exercising Melange with real-world package builds. | |
| # Feel free to add additional packages to this matrix which exercise | |
| # Melange in new ways (e.g. new pipelines, etc.) | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| package: | |
| - hello-wolfi | |
| - glibc | |
| - tini | |
| - lzo | |
| - bubblewrap | |
| - gdk-pixbuf | |
| - gitsign | |
| - guac | |
| - mdbook | |
| - s3cmd | |
| - perl-yaml-syck | |
| - xmlto | |
| - ncurses | |
| steps: | |
| - uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
| with: | |
| repository: wolfi-dev/os | |
| - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8 | |
| with: | |
| name: melange-${{ github.run_id }} | |
| path: ${{ github.workspace }}/.melange-dir | |
| run-id: ${{ github.run_id }} | |
| - run: | | |
| sudo mv ${{ github.workspace }}/.melange-dir/melange /usr/bin/melange | |
| sudo chmod a+x /usr/bin/melange | |
| melange version | |
| - run: | | |
| sudo apt-get -y install bubblewrap | |
| - run: | | |
| make SHELL="/bin/bash" MELANGE="sudo melange" package/${{ matrix.package }} | |
| - name: "Retrieve Wolfi advisory data" | |
| uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
| with: | |
| repository: "wolfi-dev/advisories" | |
| path: "data/wolfi-advisories" | |
| # this need to point to main to always get the latest action | |
| - uses: wolfi-dev/actions/install-wolfictl@main # main | |
| - name: Test installable and Scan for CVEs | |
| run: | | |
| docker run --rm -v $(pwd):/work --workdir /work cgr.dev/chainguard/wolfi-base apk add --allow-untrusted packages/x86_64/${{ matrix.package }}-*.apk | |
| # There is a huge fixed cost for every wolfictl scan invocation for grype DB init. | |
| # Do this outside of the loop in one invocation with every package. | |
| wolfictl scan \ | |
| --advisories-repo-dir 'data/wolfi-advisories' \ | |
| --advisory-filter 'resolved' \ | |
| --require-zero \ | |
| packages/x86_64/${{ matrix.package }}-*.apk \ | |
| 2> /dev/null # The error message renders strangely on GitHub Actions, and the important information is already being sent to stdout. |