-
Notifications
You must be signed in to change notification settings - Fork 5
150 lines (135 loc) · 4.45 KB
/
dispatch_daily_build.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
name: "[Dispatch] Daily build"
on:
workflow_dispatch:
env:
BRANCH: master
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
jobs:
docker:
runs-on: ubuntu-latest
outputs:
TIME: ${{ steps.get_date.outputs.TIME }}
steps:
- name: Checkout
uses: actions/checkout@v3
with:
ref: ${{ env.BRANCH }}
token: ${{ secrets.PAT_TOKEN }}
- name: Set up QEMU
uses: docker/setup-qemu-action@v2
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v2
- name: Login to Docker Hub
uses: docker/login-action@v2
with:
username: ${{ secrets.CLOUDFORET_DOCKER_USERNAME }}
password: ${{ secrets.CLOUDFORET_DOCKER_PASSWORD }}
- name: Get Date
id: get_date
run: |
sudo ln -sf /usr/share/zoneinfo/Asia/Seoul /etc/localtime
CURRENT_TIME=$(date +'%Y%m%d.%H%M%S')
echo "TIME=$CURRENT_TIME" >> $GITHUB_ENV
echo "TIME=$CURRENT_TIME" >> $GITHUB_OUTPUT
- name: Build and push to dockerhub
uses: docker/build-push-action@v4
with:
context: .
push: true
tags: |
cloudforetdev/${{ github.event.repository.name }}:latest
cloudforetdev/${{ github.event.repository.name }}:${{ env.TIME }}
build-args: |
PACKAGE_VERSION=${{ env.PACKAGE_VERSION }}
BRANCH_NAME=${{ env.BRANCH_NAME }}
provenance: false
- name: Notice when job fails
if: failure()
uses: 8398a7/action-slack@v3.15.0
with:
status: ${{job.status}}
fields: repo,workflow,job
author_name: Github Action Slack
scan:
needs: docker
runs-on: ubuntu-20.04
steps:
- name: Run Trivy vulnerability scanner
id: trivy-scan
uses: aquasecurity/trivy-action@master
with:
image-ref: cloudforetdev/${{ github.event.repository.name }}:${{ needs.docker.outputs.TIME }}
format: 'sarif'
output: 'trivy-results.sarif'
ignore-unfixed: true
vuln-type: 'os,library'
severity: 'CRITICAL,HIGH'
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: 'trivy-results.sarif'
- name: Count vulnerabilities
id: vulnerabilities
run: |
count=$(jq '.runs[].results[].ruleId' ./trivy-results.sarif | wc -c)
echo "result_count=$count" >> $GITHUB_OUTPUT
echo "$count"
- name: slack
if: ${{ steps.vulnerabilities.outputs.result_count != 0 }}
uses: 8398a7/action-slack@v3
with:
status: custom
fields: workflowRun
custom_payload: |
{
"blocks": [
{
"type": "section",
"text": {
"type": "mrkdwn",
"text": ":warning: Image vulnerability detected"
}
},
{
"type": "section",
"fields": [
{
"type": "mrkdwn",
"text": "*Image:*\ncloudforetdev/${{ github.event.repository.name }}:${{ needs.docker.outputs.TIME }}"
},
{
"type": "mrkdwn",
"text": "*Repo name:*\n${{ github.repository }}"
}
]
},
{
"type": "actions",
"elements": [
{
"type": "button",
"text": {
"type": "plain_text",
"emoji": true,
"text": "View Detail"
},
"style": "danger",
"url": "https://github.com/${{ github.repository }}/security/code-scanning"
}
]
}
]
}
env:
SLACK_WEBHOOK_URL: ${{secrets.VULNERABILITY_SLACK_WEBHOOK_URL}}
notification:
needs: docker
runs-on: ubuntu-latest
steps:
- name: Slack
if: always()
uses: 8398a7/action-slack@v3.15.0
with:
status: ${{job.status}}
fields: repo,message,commit,author,action,ref,workflow,job
author_name: Github Action Slack