-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
ci: sync workflows from central-workflows Signed-off-by: Scott <busin…
…gescott@gmail.com>
- Loading branch information
github-actions
committed
Dec 2, 2024
1 parent
59a0c71
commit 6af49c3
Showing
12 changed files
with
306 additions
and
91 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
|
Check notice Code scanning / Checkov (reported by Codacy) Ensure top-level permissions are not set to write-all Note
Ensure top-level permissions are not set to write-all
|
||
|
|
||
| # This GitHub Actions workflow checks that all commits in a pull request (PR) have a "Signed-off-by" line to ensure Developer Certificate of Origin (DCO) compliance. | ||
|
|
||
| # Please do not attempt to edit this flow without the direct consent from the DevOps team. This file is managed centrally. | ||
|
|
||
| name: DCO | ||
|
|
||
| # Trigger the workflow on pull request events | ||
| on: [pull_request] | ||
|
|
||
| jobs: | ||
| dco: | ||
| if: github.actor != 'dependabot[bot]' && github.actor != 'dependabot-preview[bot]' | ||
| # Define the runner environment | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| # Step to check out the repository | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 # Fetch all history for all branches to ensure complete commit history is available | ||
|
|
||
| - name: Set up environment variables | ||
|
Check notice Code scanning / Checkov (reported by Codacy) Ensure run commands are not vulnerable to shell injection Note
Ensure run commands are not vulnerable to shell injection
|
||
| run: | | ||
|
Check failure Code scanning / Semgrep (reported by Codacy) Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. Error
Using variable interpolation ${...} with github context data in a run: step could allow an attacker to inject their own code into the runner.
|
||
| echo "BASE_BRANCH=${{ github.event.pull_request.base.ref }}" >> $GITHUB_ENV | ||
| echo "HEAD_BRANCH=${{ github.event.pull_request.head.ref }}" >> $GITHUB_ENV | ||
| # Step to check each commit in the pull request for a Signed-off-by line | ||
| - name: Check for DCO Sign-off | ||
| run: | | ||
| # Get the base branch and head branch of the pull request | ||
| base_branch=$BASE_BRANCH | ||
| head_branch=$HEAD_BRANCH | ||
| # Get the list of commit hashes between the head branch and base branch | ||
| commits=$(git log --pretty=format:%H origin/${head_branch}..origin/${base_branch}) | ||
| non_compliant_commits="" | ||
| # Loop through each commit and check for the Signed-off-by line | ||
| for commit in $commits; do | ||
| # Check if the commit message contains the Signed-off-by line | ||
| if ! git show --quiet --format=%B $commit | grep -q "^Signed-off-by: "; then | ||
| # If not, add the commit hash to the list of non-compliant commits | ||
| non_compliant_commits="$non_compliant_commits $commit" | ||
| fi | ||
| done | ||
| # If there are any non-compliant commits, output their hashes and fail the job | ||
| if [ -n "$non_compliant_commits" ]; then | ||
| echo "The following commits do not have a Signed-off-by line:" | ||
| for commit in $non_compliant_commits; do | ||
| echo "- $commit" | ||
| done | ||
| exit 1 | ||
| fi | ||
| shell: bash | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| # This workflow uses actions that are not certified by GitHub. | ||
| # They are provided by a third-party and are governed by | ||
| # separate terms of service, privacy policy, and support | ||
| # documentation. | ||
| # hadoint is a Dockerfile linter written in Haskell | ||
| # that helps you build best practice Docker images. | ||
| # More details at https://github.com/hadolint/hadolint | ||
|
|
||
| # Please do not attempt to edit this flow without the direct consent from the DevOps team. This file is managed centrally. | ||
|
|
||
| name: Hadolint | ||
|
|
||
| on: | ||
| push: | ||
| branches: [ "dev", "main" ] | ||
| pull_request: | ||
| # The branches below must be a subset of the branches above | ||
| branches: [ "dev" ] | ||
| schedule: | ||
| - cron: '17 13 * * 0' | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| hadolint: | ||
| if: github.actor != 'dependabot[bot]' && github.actor != 'dependabot-preview[bot]' | ||
| name: Run hadolint scanning | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read # for actions/checkout to fetch code | ||
| security-events: write # for github/codeql-action/upload-sarif to upload SARIF results | ||
| actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Run hadolint | ||
| uses: hadolint/hadolint-action@f988afea3da57ee48710a9795b6bb677cc901183 | ||
| with: | ||
| dockerfile: ./Dockerfile | ||
| format: sarif | ||
| output-file: hadolint-results.sarif | ||
| no-fail: true | ||
|
|
||
| - name: Upload analysis results to GitHub | ||
| uses: github/codeql-action/upload-sarif@v3 | ||
| with: | ||
| sarif_file: hadolint-results.sarif | ||
| wait-for-processing: true |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,80 @@ | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| # This workflow uses actions that are not certified by GitHub. | ||
| # They are provided by a third-party and are governed by | ||
| # separate terms of service, privacy policy, and support | ||
| # documentation. | ||
|
|
||
| # GitHub recommends pinning actions to a commit SHA. | ||
| # To get a newer version, you will need to update the SHA. | ||
| # You can also reference a tag or branch, but the action may change without warning. | ||
|
|
||
| # Please do not attempt to edit this flow without the direct consent from the DevOps team. This file is managed centrally. | ||
|
|
||
| name: Publish Docker image | ||
|
|
||
| on: | ||
| push: | ||
| branches: [ "main" ] | ||
| release: | ||
| types: [published] | ||
|
|
||
| jobs: | ||
| push_to_registry: | ||
| if: github.actor != 'dependabot[bot]' && github.actor != 'dependabot-preview[bot]' | ||
| name: Push Docker image to Docker Hub | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| packages: write | ||
| contents: read | ||
| attestations: write | ||
| id-token: write | ||
| steps: | ||
| - name: Check out the repo | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Log in to Docker Hub | ||
| uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a | ||
| with: | ||
| username: ${{ secrets.DOCKER_USERNAME }} | ||
| password: ${{ secrets.DOCKER_PASSWORD }} | ||
|
|
||
| - name: Set ENV variables | ||
| run: | | ||
| echo "REPO_NAME=${GITHUB_REPOSITORY#$GITHUB_REPOSITORY_OWNER/}" >> $GITHUB_ENV | ||
| - name: Use the custom ENV variable | ||
| run: | | ||
| echo $REPO_NAME | ||
| - name: Extract metadata (tags, labels) for Docker | ||
| id: meta | ||
| uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7 | ||
| with: | ||
| images: tazamaorg/${{ env.REPO_NAME }} | ||
| tags: | | ||
| type=raw,value=2.1.0 | ||
| - name: Build and push Docker image | ||
| id: push | ||
| uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671 | ||
| with: | ||
| context: . | ||
| file: ./Dockerfile | ||
| push: true | ||
| tags: ${{ steps.meta.outputs.tags }} | ||
| labels: ${{ steps.meta.outputs.labels }} | ||
| build-args: GH_TOKEN=${{ secrets.GH_TOKEN }} | ||
|
|
||
| - name: Generate artifact attestation | ||
| uses: actions/attest-build-provenance@v1 | ||
| with: | ||
| subject-name: docker.io/tazamaorg/${{ env.REPO_NAME }} | ||
| subject-digest: ${{ steps.push.outputs.digest }} | ||
| push-to-registry: true | ||
|
|
||
| - name: Send Slack Notification | ||
| env: | ||
| SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} | ||
| run: | | ||
| curl -X POST -H 'Content-type: application/json' --data '{"blocks": [{"type": "header","text": {"type": "plain_text","text": "New Dockerhub Image published :ship::ship:","emoji": true}},{"type": "section","fields": [{"type": "mrkdwn","text": "*Service:*\n${{ env.REPO_NAME }} "},{"type": "mrkdwn","text": "*Tazama Dockerhub:*\n<https://hub.docker.com/orgs/tazamaorg/repositories>"}]}]}' $SLACK_WEBHOOK_URL |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.